Coordinate CERT-In reporting and Data Protection Board of India (DPB) readiness. Keep triggers, response owners, evidence, and notifications clear from the first assessment through recovery.
Two independent triggers
From noticing an applicable incident or being informed of it.
Detailed report from personal data breach awareness. Initial notifications are without delay when Rule 7 applies.
Record both trigger times. Neither clock waits for the other to finish.
Current reporting direction
DPDP Rule 7 · readiness
Enter each trigger separately, in India Standard Time (IST). This local exercise does not submit a report or store incident details.
CERT-In reporting deadline · +6 hours
Choose a trigger date and time
DPB detailed-report deadline (readiness) · +72 hours
Choose a trigger date and time
When Rule 7 applies, initial Board and affected-person notifications are required without delay. The detailed-report calculation assumes no extension granted by the Board.
A practical response sequence
Record when the incident was first noticed and when a personal data breach became known. Assign an incident lead, security owner, privacy lead, and communications contact.
Limit ongoing exposure while preserving relevant logs, access records, and system snapshots. Record the source, collector, time, and integrity checks for each artifact.
Document affected systems, data categories, people, likely impact, and what remains unknown. Assess each reporting obligation separately and prepare the appropriate initial notices.
Record the authorized reviewer, submission time, channel, and acknowledgement. Update the incident record as facts develop, then track recovery actions and lessons learned.
Use these headings for a tabletop exercise or your internal response pack. Link to controlled evidence rather than copying sensitive records into shared notes.
Incident ID, trigger timestamps, reporting assessment, response owners, and a chronological decision log.
Affected systems and services, data categories, estimated affected people, observed impact, and outstanding questions.
Log and snapshot references, collection timestamps, hashes where appropriate, custodians, and access records.
Actions taken, their owners and timestamps, current exposure, recovery validation, and follow-up tasks.
Initial notification drafts, affected-person communication, detailed findings, and documented approval.
Copies of reports, acknowledgement references, follow-up correspondence, and any written extension granted.
Explore the free Academy, use the DPO fellowship track for your capstone, or discuss your organization's response workflow.
