A single incident may need three notices: the client within the contract hours, CERT-In within six hours if reportable, and for your own staff data, the DPDP intimation without delay and the detailed report within 72 hours. Remote access, laptops and sub-contractor accounts are where most alerts come from.
The first four things to sort out
Keep a list of client notice hours next to the SOC runbook.
Watch privileged, vendor and sub-contractor accounts on client systems.
Keep logs a year, and ICT logs 180 days in India.
Sync clocks to NIC or NPL time servers.
A worked example
Information security / SOC department
A sub-contractor account downloads client records
01:40The SOC sees a sub-contractor account exporting records from client systems.
02:00The account is disabled and logs preserved.
03:30The client is told within the agreed hours.
07:00CERT-In is informed within six hours.
Evidence kept
Alert
Timeline
Client notice
CERT-In record
Watch sub-contractor accounts as closely as your own.
What others in the sector usually do. Many SOC teams run one drill a year on a client-data incident, timing each notice.
Where it usually goes wrong, by organisation type
Organisation type
Hotspots
IT services and consulting
Production data copied to laptops or test environments; Shared client credentials in team chats; Sub-contractors working under your client access
BPO and contact centre
Card numbers spoken on recorded calls; Phones and paper on the floor; Outbound calls without consent checks for Indian customers
Global capability centre
Indian customer data mixed into global data sets; Global HR systems hosted abroad; Intra-group agreements that predate DPDP
SaaS and software products
Support staff browsing customer tenants; Analytics on customer data beyond the contract; Deletion that does not reach backups
Managed services, data centres and cloud
Privileged admin access across many clients; Subscriber records kept with no access limits; Backups of client systems held for years
Control map: DPDP to NIST CSF 2.0 and ISO/IEC 27001:2022
Short answer: Named, logged and removed at roll-off
Through named accounts, from managed devices or controlled jump servers, with multi-factor sign-in and logging. Access should be removed the day someone rolls off. Client data should stay in client systems and not be copied to laptops, internal tickets or chat.
Short answer: Client first, within contract hours; CERT-In in six hours
Tell the client first, within the time your contract sets, because the client is the fiduciary and must tell its own customers and the Board. Report to CERT-In within six hours if the incident is reportable. Give the client logs and facts quickly; do not contact the client's customers yourself unless the client asks.
What the law says
Section 8(6) puts the duty to tell people on the fiduciary. As processor, your contract decides your duty to the client. Section 8(6) · Rule 7 · Section 8(1)–(2)
Steps
Keep a list of client notice times.
Name who calls each client.
Prepare a client incident template.
File CERT-In if reportable.
Share logs and a written account.
Evidence to keep
Client notice list
Incident timeline
CERT-In record
Common mistakes
Waiting to finish the investigation before telling the client
Short answer: Six hours for CERT-In; without delay for people and the Board; 72 hours for the detailed report
Contain it, then tell people. A reportable cyber incident goes to CERT-In within six hours of being noticed. Under DPDP, each affected person and the Data Protection Board must be told without delay, and the Board needs a detailed report within 72 hours. Sector regulators may have their own clock too.
From your seat: Information security / SOC department. Start the CERT-In clock and tell the DPO at once.
Example in IT and ITeS
If client data is involved, the client contract sets your first deadline, often a few hours.
What the law says
Section 8(6) and Rule 7 set the DPDP steps. The CERT-In Directions of 28 April 2022 set the six-hour report. A breach includes accidental disclosure and loss of access, not only hacking. Section 8(6) · Rule 7 · Section 8(5) · Rule 6
Steps
Name one incident lead and a back-up, with phone numbers that work at night.
Write the first-hour steps: isolate, preserve logs, tell the DPO and the incident lead.
Keep ready-made drafts for CERT-In, the regulator, the Board and affected people.
Decide in advance who signs off each message.
Rehearse once a year with the people who would actually be called.
Evidence to keep
Incident plan with clocks
Rehearsal record
Incident log with times of each step
Common mistakes
Waiting to finish the investigation before telling anyone
Treating a wrong email or a lost laptop as 'not a breach'
Short answer: At least one year; 180 days of ICT logs in India
Keep logs that show who accessed personal data and what they did, for at least one year under the DPDP Rules. CERT-In separately asks for ICT system logs to be kept for 180 days within India. Logs must be protected so nobody can quietly change them.
From your seat: Information security / SOC department. One year of access logs, 180 days of ICT logs in India.
Example in IT and ITeS
Keep logs of access to client systems, as well as your own systems.
What the law says
Rule 6 lists logs and monitoring as a minimum safeguard. Rule 8(3) asks for logs to be kept for at least one year. The CERT-In Directions of 2022 ask for 180 days of ICT logs kept within India. Section 8(5) · Rule 6 · Section 8(7) · Rule 8
Steps
List systems holding personal data and what each logs today.
Turn on access logging where it is missing.
Send logs to one protected store, with at least one year of retention.
Keep a copy of ICT logs in India for at least 180 days.
Short answer: Only those who need it, reviewed every quarter
Only people who need it for their job, and only the part they need. Use named accounts, give access by role, review it every quarter and remove it on the day someone leaves. Watch privileged accounts closely.
From your seat: Information security / SOC department. Watch privileged and vendor accounts.
Example in IT and ITeS
Your own HRMS and payroll, as well as client systems.
What the law says
Rule 6 names access control as a minimum safeguard, along with logs and monitoring that can detect misuse. Section 8(5) · Rule 6
Steps
Write a role matrix for each key system.
Replace shared logins with named accounts.
Use multi-factor sign-in for admin and remote access.
Not by itself. A security dashboard shows alerts, patches and controls. It does not show whether notices were given, consent was recorded, requests were answered, vendors signed terms or data was deleted on time. Use it as evidence for the security duty only.
From your seat: Information security / SOC department. A green dashboard is not evidence of privacy readiness.
Short answer: Yes, through a written backup-expiry rule
Deletion should reach every copy you control. For backups, the usual practice is to let deleted records expire with the normal backup cycle, never restore them into live use, and write this down. Test and training copies should use masked data.
From your seat: Information security / SOC department. Test a full restore.
Example in IT and ITeS
Client backups held by managed service teams must follow client retention.
What the law says
Section 8(7) asks for erasure. Rule 6 asks for backups for continuity. The two meet in a backup retention rule that is short enough and written down. Section 8(7) · Rule 8 · Section 8(5) · Rule 6
Steps
List where copies live: backups, replicas, test, analytics, laptops, vendors.
Set backup retention to match the retention schedule.
Write a rule: deleted records are not restored into live systems.
Mask personal data in test and training copies.
Get deletion confirmations from vendors.
Evidence to keep
Backup retention settings
Written backup-expiry rule
Masking procedure for test data
Common mistakes
Ten-year backups for convenience
Live copies in test
Restoring old backups and bringing deleted records back
Short answer: Yes, every vendor that touches personal data
You stay responsible for what your vendors do with personal data. The contract should say what data they get, for what purpose, the security they must keep, how fast they must tell you about an incident, that sub-contractors need your approval, and how data is returned or deleted at the end.
From your seat: Information security / SOC department. Monitor vendor access.
Example in IT and ITeS
Sub-contractors working on client data need the same terms you signed with the client.
Short answer: Yes, this is a common breach; give staff a safer option
Sending personal data to the wrong chat or a personal account is one of the most common breaches. Banning messaging rarely works. Give staff an approved tool that is easy to use, set simple rules, and make it safe to report a wrong send at once.
From your seat: Information security / SOC department. Data-loss rules help; reporting routes matter more.
Example in IT and ITeS
Client credentials and customer screenshots in team chats are a common issue.
Short answer: They cover security, not the whole Act
They help a great deal with the security part. ISO/IEC 27001 and NIST CSF 2.0 are good evidence of reasonable security safeguards. They do not cover notice, consent, rights, complaints or children's data. ISO/IEC 27701 adds privacy controls, but no certificate replaces the Act.
From your seat: Information security / SOC department. Map controls once.
Example in IT and ITeS
ISO/IEC 27001 is common in the sector; ISO/IEC 27701 adds privacy controls clients ask for.
What the law says
Section 8(5) and Rule 6 ask for reasonable security safeguards. A recognised standard is strong evidence of that duty, and only of that duty. Section 8(5) · Rule 6
Steps
Map your current controls to Rule 6.
Add the DPDP-only items: notice, consent, rights, complaints, children, retention.
Use the same evidence for audits and for DPDP.
Include privacy in the scope of your next internal audit.
Consider ISO/IEC 27701 if clients ask for it.
Evidence to keep
Control map
Audit reports
Gap list for DPDP-only items
Common mistakes
Treating a certificate as DPDP compliance
Scope that leaves out the systems with the most personal data
No owner for the non-security duties
The sections you will use most
Section 8(5) · Rule 6: Security safeguards. Remote access to client systems, laptops and ticketing tools need control, monitoring and one-year logs.
Section 8(6) · Rule 7: Telling people about a breach. Clients' contracts often require notice within hours, because their own clock starts when you tell them.
Report specified cyber incidents within six hours. Keep ICT logs for 180 days within India. Sync clocks to NIC or NPL time servers. Data centres, VPS, cloud and VPN providers keep specified subscriber information for five years.
Breach handling must meet the six-hour CERT-In clock and the DPDP report to the Board. Subscriber records need DPDP-level protection.
CERT-In
DPDP Act, Section 17(1)(d)
Processing of data of people outside India, under a contract with a party outside India, is exempt from most of the Act.
Tag each data set by where the people live. The exemption does not cover Indian staff or Indian customers.
MeitY
IT Act, Section 43A and SPDI Rules, 2011
Reasonable security practices for sensitive personal data, until Section 43A is omitted on 13 May 2027.
Your current ISO 27001 practices meet these today; DPDP Rule 6 takes over from May 2027.
Commercial calls and SMS to Indian numbers must follow registration and preference rules.
Outbound campaigns for Indian clients need both DPDP consent and TRAI compliance.
TRAI
Labour Codes (in force from 21 November 2025)
The four labour codes replaced older labour laws, including registers and records employers must keep.
Set retention for staff records against the new codes and state rules.
Ministry of Labour
Client contracts and foreign laws (for example GDPR for EU clients)
Clients often bind you to their own country's law through contracts and standard clauses.
These are contract duties, not Indian law, but you must meet them alongside DPDP.
Contract
Explore our research-built assessment platformsDPDP Insights helps you understand the law. DPDPiq is where an organisation's evidence is assessed. Each platform comes out of the same Foundation Layer research. No AI, API or outside service is used when you use this site. Everything runs from InfraVeritas360's own server.
