CERT-In
India’s Computer Emergency Response Team, which receives reports of cybersecurity incidents.
CERT-In is India's national agency for responding to cybersecurity incidents. Certain organisations must report cyber incidents to it within six hours, separately from any DPDP report.
Meaning of CERT-In
CERT-In directions under the IT Act require certain incidents to be reported within six hours and logs to be kept for 180 days. These duties are separate from DPDP Rule 7, so organisations often need to run both reports in parallel. Check the current directions, since they can change.
CERT-In, the Indian Computer Emergency Response Team, works under the Ministry of Electronics and Information Technology (MeitY) and is the national agency for cyber incident response under the Information Technology Act, 2000. It issues alerts and advisories, coordinates the handling of incidents, and publishes guidelines. In April 2022 it issued directions under Section 70B(6) of the IT Act on reporting incidents and keeping logs, which apply to service providers, intermediaries, data centres, body corporates and government organisations.
The CERT-In directions require covered entities to report specified types of cyber incidents within six hours of noticing them or being told of them. The directions list the categories, which cover matters such as unauthorised access, data breaches and leaks, malicious code, attacks on applications and servers, and compromised accounts. They also require logs of ICT systems to be kept for a rolling 180 days within India, and ask entities to nominate a point of contact. Check the current text, since the directions and related FAQs have been updated.
None of this replaces the DPDP regime. Section 38 says the DPDP Act applies in addition to other laws, and Rule 7 runs its own timetable: notice to affected Data Principals without delay, notice to the Data Protection Board without delay, and a detailed report within 72 hours. So one incident can generate three reports on three clocks: CERT-In (six hours), the Board (without delay and 72 hours) and any sector regulator. They go to different bodies and have different content, so one cannot stand in for another.
The two systems also differ in focus. CERT-In concerns itself with the cyber event and national security posture, whether or not personal data is involved. The DPDP Board is concerned with harm to Data Principals and compliance by the fiduciary. A ransomware attack on a factory that holds no personal data may need a CERT-In report but not a DPDP one, whereas a misdirected spreadsheet of customer records needs a DPDP assessment but may not be a cyber incident in CERT-In's sense.
Examples of CERT-In
A bank detects a ransomware attack and reports to CERT-In, its sector regulator and, if personal data is affected, the Data Protection Board.
A payments app sees attackers using stolen passwords to access wallets. In the first hours, security sends an initial CERT-In report, the privacy lead alerts the sector regulator, and legal drafts customer notices and the first intimation to the Board.
A hospital chain is hit by ransomware. It reports to CERT-In inside six hours using the facts it has, activates downtime procedures, and later reports to the Board with details of which patient records were encrypted or copied.
A small SaaS company hosting HR data for client firms finds a compromised admin account. It reports to CERT-In, informs each client promptly so they can meet their own duties, and keeps 180 days of logs available for investigators.
Why CERT-In matters
Missing a CERT-In deadline is a compliance failure in its own right, and the IT Act provides for consequences where directions under Section 70B are not complied with. Alongside it sits DPDP exposure: a failure to give breach intimation can lead to up to ₹200 crore, and a failure of security safeguards up to ₹250 crore. A late report to one regulator tends to draw attention from the others.
Practically, six hours is short. Teams that have not agreed who files, with what information and through which channel will lose most of that time to discussion. The 180-day logging requirement matters as well: without logs, you cannot establish what was accessed, which weakens both the CERT-In report and the Rule 7 report to the Board.
How it works in practice
- 1Map which CERT-In directions apply to you, with legal help if needed, and record the answer. Note any sector overlay from RBI, IRDAI, SEBI or telecom rules, because some regulators set their own incident timelines.
- 2Nominate a point of contact and a backup, and register their details as the directions require. Keep the current reporting channels and form handy offline.
- 3Build the six-hour step into your incident response plan with a clear trigger, an owner, a short template and a rule that an initial report with partial facts is better than silence. Update CERT-In as facts emerge.
- 4Configure logging so that logs of relevant systems are retained for 180 days within India, in tamper-resistant storage, and ensure clocks are synchronised to the standard time sources the directions mention.
- 5Run the reports in parallel. When personal data is affected, the privacy lead prepares the Rule 7 notices while security prepares the CERT-In report, with one shared fact sheet to avoid inconsistencies.
- 6Record each report, with timestamps and reference numbers, in your breach register.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Assuming a DPDP breach notice to the Board also satisfies CERT-In. They are separate duties, with separate deadlines, recipients and content.
Waiting for full facts before filing. Report within six hours with what you know and update later.
Storing logs outside India or for too short a time. The directions call for 180 days of logs maintained within Indian jurisdiction.
Never testing the reporting channel. Contact details and forms go stale, so check them in every drill.
Compliance tips
Put CERT-In and Board timelines on one wall chart in your response plan, so responders see every clock at once.
Ask cloud and managed-service vendors how they will help you meet the six-hour window, and what logs they can give you.
Re-read the CERT-In directions and related clarifications at least yearly, since requirements and lists of reportable incidents evolve.
Common questions about CERT-In
Is CERT-In reporting required under the DPDP Act?
No. The DPDP Act and Rules require reports to the Data Protection Board and affected people. CERT-In reporting arises under the IT Act directions of 2022. Both can apply to the same incident, and Section 38 confirms the DPDP Act operates in addition to other laws.
What is the CERT-In six-hour rule?
Under the CERT-In directions of 2022, covered entities must report specified cyber incidents within six hours of noticing them or being told of them. The listed categories include unauthorised access and data breaches. Check the current directions to see whether your incident type is covered.
Do we need to keep logs for 180 days?
The CERT-In directions call for logs of ICT systems to be maintained securely for a rolling 180 days within India, for covered entities. That is separate from Rule 6 of the DPDP Rules, which expects at least one year of relevant logs for detection and investigation.