Short answer: Client first, within contract hours; CERT-In in six hours
Tell the client first, within the time your contract sets, because the client is the fiduciary and must tell its own customers and the Board. Report to CERT-In within six hours if the incident is reportable. Give the client logs and facts quickly; do not contact the client's customers yourself unless the client asks.
From your seat: Director. Ask for the fastest and slowest client notice in the last drill.
What the law says
Section 8(6) puts the duty to tell people on the fiduciary. As processor, your contract decides your duty to the client. Section 8(6) · Rule 7 · Section 8(1)–(2)
What a good answer from management sounds like: “We know each client's notice time, and in our last drill the client was told within two hours.” Effort and time: Light · 3 to 4 weeks.
Steps
Keep a list of client notice times.
Name who calls each client.
Prepare a client incident template.
File CERT-In if reportable.
Share logs and a written account.
Evidence to keep
Client notice list
Incident timeline
CERT-In record
Common mistakes
Waiting to finish the investigation before telling the client
Short answer: Mostly exempt for offshore data; security still applies
Mostly not. Section 17(1)(d) exempts processing of personal data of people outside India when you do it under a contract with a party outside India. Security safeguards and responsibility for your processors still apply. The exemption does not cover your Indian staff, Indian customers, or Indian data mixed into the same work.
What a good answer from management sounds like: “Every project is tagged. Mixed projects follow full DPDP for the Indian data, and security is the same everywhere.” Effort and time: Light · 2 to 4 weeks.
You are a Data Fiduciary when you decide why and how personal data is used, as you do for your own staff and customers. You are a Data Processor when you handle data only on another organisation's instructions. Many organisations are both, for different data sets.
In IT and ITeS
You are usually a processor for client data and a fiduciary for staff and candidates.
What the law says
Section 2(i) and 2(k) define the two roles. Section 8(1) puts the duties on the Data Fiduciary, which must use processors only under a valid contract. Section 8(1)–(2) · Section 17(1)(d)
What a good answer from management sounds like: “We know, for each data set, whether we decide or act for someone else, and our contracts say so.” Effort and time: Light · 2 to 4 weeks.
Steps
List each data set you handle.
For each, ask: who decides the purpose?
Mark yourself as fiduciary or processor, and name the other party.
Check that contracts match the role.
Route requests about processor data to the fiduciary.
Evidence to keep
Role register by data set
Contracts matching the role
Common mistakes
Calling yourself a processor for data you use for your own purposes
Short answer: Five plain questions, asked every quarter
Directors do not need technical detail. They need to know who is accountable, how the organisation would handle a breach, which outside parties hold data, and whether the plan to May 2027 is on track with evidence.
From your seat: Director. Ask the five questions every quarter, and record the answers in the minutes. The answers will improve when management knows the questions are coming.
In IT and ITeS
Ask about client incident terms and sub-contractor numbers.
What a good answer from management sounds like: “DPDP is a standing quarterly item. Management brings a short note with names, numbers and evidence.” Effort and time: Light · one agenda item every quarter.
Steps
Ask who is accountable for personal data, by name.
Ask when the breach plan was last rehearsed and what was learnt.
Ask for the list of vendors holding the most personal data.
Ask how many requests and complaints came in, and how fast they were answered.
Ask for the plan to May 2027 with evidence, not colours.
Short answer: Not required by law unless notified as an SDF, but name one person
Only a Significant Data Fiduciary must appoint a DPO, based in India. Every other organisation must publish the contact of a person who can answer questions about personal data. In practice, most organisations of any size name one accountable person anyway, because someone has to own requests, complaints and breaches.
From your seat: Director. Ask who the accountable person is, what authority they have, and when they last reported to the board or a committee.
In IT and ITeS
Large IT firms with big staff and candidate data are not automatically SDFs, but clients expect a named DPO.
What the law says
Section 8(9) and Rule 9 require a published contact person for every Data Fiduciary. Section 10 requires a DPO in India for Significant Data Fiduciaries. Section 8(9)–(10) · Rules 9, 14 · Section 10 · Rule 13
What a good answer from management sounds like: “We have named an accountable person with a deputy, published the contact, and that person reports to management every month.” Effort and time: Light · 2 to 4 weeks.
Steps
Name one accountable person, with a deputy.
Publish the contact on your website, app and notices.
Give the role time, a budget line and a route to management.
Set a short monthly report: requests, complaints, incidents, actions.
Short answer: Six hours for CERT-In; without delay for people and the Board; 72 hours for the detailed report
Contain it, then tell people. A reportable cyber incident goes to CERT-In within six hours of being noticed. Under DPDP, each affected person and the Data Protection Board must be told without delay, and the Board needs a detailed report within 72 hours. Sector regulators may have their own clock too.
From your seat: Director. Ask when the plan was last rehearsed, who took part, and what went wrong in the drill. A drill with no findings was probably too easy.
In IT and ITeS
If client data is involved, the client contract sets your first deadline, often a few hours.
What the law says
Section 8(6) and Rule 7 set the DPDP steps. The CERT-In Directions of 28 April 2022 set the six-hour report. A breach includes accidental disclosure and loss of access, not only hacking. Section 8(6) · Rule 7 · Section 8(5) · Rule 6
What a good answer from management sounds like: “We have one plan that meets every clock. It was rehearsed this year, and the next rehearsal date is fixed.” Effort and time: Medium · 4 to 8 weeks, then a yearly drill.
Steps
Name one incident lead and a back-up, with phone numbers that work at night.
Write the first-hour steps: isolate, preserve logs, tell the DPO and the incident lead.
Keep ready-made drafts for CERT-In, the regulator, the Board and affected people.
Decide in advance who signs off each message.
Rehearse once a year with the people who would actually be called.
Evidence to keep
Incident plan with clocks
Rehearsal record
Incident log with times of each step
Common mistakes
Waiting to finish the investigation before telling anyone
Treating a wrong email or a lost laptop as 'not a breach'
Short answer: Yes, every vendor that touches personal data
You stay responsible for what your vendors do with personal data. The contract should say what data they get, for what purpose, the security they must keep, how fast they must tell you about an incident, that sub-contractors need your approval, and how data is returned or deleted at the end.
From your seat: Director. Ask which three vendors hold the most personal data, and when their contracts were last reviewed.
In IT and ITeS
Sub-contractors working on client data need the same terms you signed with the client.
What a good answer from management sounds like: “Our top vendors have data terms with a short incident-notice time, and we review them every year.” Effort and time: Medium · 8 to 16 weeks for the top vendors.
Steps
List vendors who receive or can see personal data.
Rank them by how much and how sensitive.
Add a data-protection schedule to each contract, starting with the top ten.
Ask for evidence: certificates, test results, deletion confirmations.
Short answer: Only by notification; none notified yet
Only the government can notify an organisation or a class of organisations as a Significant Data Fiduciary, based on the volume and sensitivity of data and the risk to people or the State. None had been notified when this page was last reviewed. Large holders of sensitive data should plan as if it could happen.
From your seat: Director. Ask whether management has assessed the chance of notification. Large or sensitive data holders should have a view.
In IT and ITeS
Notification is more likely for consumer platforms than for IT services, but large SaaS players should watch.
What the law says
Section 10 and Rule 13 set the extra duties: a DPO in India, an independent data auditor, a yearly Data Protection Impact Assessment and audit, and checks on algorithms. Rule 13(4) allows the government to restrict some data from leaving India. Section 10 · Rule 13 · Section 16 · Rule 15
What a good answer from management sounds like: “We have estimated our exposure. If we are notified, we can appoint a DPO and an auditor within weeks, because the groundwork is done.” Effort and time: Medium if you are a likely candidate.
Steps
Estimate how many people's data you hold and how sensitive it is.
Note any public or security role your data plays.
If you are a likely candidate, run a trial impact assessment this year.
Short answer: Six to nine months of steady work for most
For most organisations it is a programme of six to nine months, not a single project. The heavy parts are the data inventory, vendor contracts, access control and the request process. Notices, the contact person and training are lighter. Starting now leaves time to fix what you find.
From your seat: Director. Ask for evidence against the plan, such as signed contracts, rehearsal reports and request logs, not just status colours.
In IT and ITeS
Staff data work is quick; client contract alignment takes longer.
What a good answer from management sounds like: “We have a dated plan with named owners. Each month we see evidence, not just colours, and we expect to finish before March 2027.” Effort and time: Programme · six to nine months.
Steps
Month 1: name the owner, set a budget line, start the inventory.
Section 8(1)–(2): Responsibility for vendors. You are usually the processor for client data and a fiduciary for your own staff. Your sub-contractors are your processors.
Section 8(6) · Rule 7: Telling people about a breach. Clients' contracts often require notice within hours, because their own clock starts when you tell them.
Report specified cyber incidents within six hours. Keep ICT logs for 180 days within India. Sync clocks to NIC or NPL time servers. Data centres, VPS, cloud and VPN providers keep specified subscriber information for five years.
Breach handling must meet the six-hour CERT-In clock and the DPDP report to the Board. Subscriber records need DPDP-level protection.
