KlaritiQKlaritiQ
Sign inGet my free audit readiness assessment
IT and security

DPDP/DPDPA breach notification and CERT-In reporting.

From the first odd alert to the write-up, KlaritiQ shows the DPDP/DPDPA breach notice, CERT-In reporting and records that may apply at each step, so the plan is ready before you need it.

Get my free audit readiness assessment
No legal jargon · no commitment · every answer backed by evidence
Where the rules bite
The first hours
CERT-In's directions set short reporting windows for many kinds of cyber incidents. KlaritiQ shows them at the step where the signal is first noticed.
A personal-data breach
The DPDP/DPDPA Act and Rules expect notice to the Data Protection Board and to affected people. You see what that notice involves and where it fits in your response.
Logs you need but may not have
Rules on keeping system logs matter most on the day you need them. You see them at the preservation step, and as a setup item before any incident.
Customer data in an AI prompt
Under the DPDP/DPDPA Act, an AI vendor handling your customers' data is processing it for you. KlaritiQ shows what follows from that, at the step where the data goes in.
The problem

What usually goes wrong.

Incidents don't announce themselves

The first sign is usually a customer email, a strange bill or a message from a researcher, and it reaches the wrong person first.

Reporting windows are short

Some Indian rules count in hours, not days, and the hours may start when you notice, not when you're sure.

AI starts on personal accounts

Someone signs up, pastes in a customer ticket or a contract, and it works. Nobody decided anything, and the data settings matter more than the plan.

How it works

Your process, step by step.

  1. 1
    Notice and escalate

    When someone spots a signal and pings the decision-maker, you see when the reporting clock may already be running.

  2. 2
    Assess and contain

    When the team opens a war room, decides how bad it is and contains the damage, you see what to record as you go.

  3. 3
    Preserve and get help

    When logs are pulled and outside help is called in, you see which records to keep and for how long.

  4. 4
    Decide and report

    When you decide whether to tell anyone outside, you see which reports may apply, to whom, and in what timeframe.

  5. 5
    Tell people and close

    When you notify customers, answer questions, brief investors and write the post-mortem, you see what each message should cover and what proof to file.

Deadlines

The reporting clocks

Each figure is read from the rule itself. A person confirms which ones apply to your organisation, and the DPDP Rules item applies once those provisions are in force.

6h
CERT-In
To report the cyber incidents it lists, within 6 hours of noticing them.
72h
DPDP Rules, detailed breach report
To the Data Protection Board, within 72 hours of becoming aware. The Board and affected people are told without delay before that.
180d
CERT-In, system logs
A standing duty, not a deadline: keep ICT system logs for a rolling 180 days, within India.

See every deadline KlaritiQ tracks

What you get

A map, a certainty label and the proof.

A ready-to-use map of your response

The deadlines and duties that may apply at each step.

A certainty label on every item

In a crisis you know what is settled and what needs a lawyer's call.

A proof list

The logs, decisions, timestamps and notices that show you responded properly.

Who it is for

Built for your team.

Founders, CTOs, engineering and security leads, and legal or compliance owners at Indian startups and digital businesses, especially those holding customer data or payments.

Common questions

Straight answers

Under the DPDP Rules, the Data Protection Board is told without delay and then sent a detailed report within 72 hours of becoming aware, and affected people are told without delay. This applies once those provisions are in force.

Have the plan before you need it.

See what applies to your incident response with the founders at KlaritiQ.

KlaritiQ provides information about laws and regulations to help organisations understand how rules may apply to their processes. It is not legal advice and does not create a lawyer-client relationship. Rules change, and how they apply depends on your facts; consult a qualified professional before acting. Law names are given for reference only. © KlaritiQ.