Paragraph match score 89.4%
Page A-026
The 72-Hour Breach Clock: Incident Response Plan for DPDP
CERT-In’s requirement to report specified cyber incidents within six hours runs in parallel with DPDP, so a single event can trigger multiple regulatory clocks and sectoral notifications.
Page A-028
DPDP Act penalty: board-level view of fines and 72-hour breach timelines
DPDP penalties are capped per violation head, with the most serious failures exposing organisations to fines that may extend to ₹250 crore. The Data Protection Board of India (DPBI) has wide discretion: it looks at gravity, duration, harm, mitigation, and repeat offences, not just the size of the breach. Breach duties are two-stage: immediate intimation to the DPBI and affected individuals, followed by a more detailed report within 72 hours. CERT-In’s six-hour cyber-incident reporting rule can apply alongside DPDP, so escalation paths must support multiple regulators at once. Investments in governance, security, vendor contracts, and rehearsed incident response directly reduce penalty exposure, downtime, and reputational damage.