Free tool
Breach clock
When a breach is confirmed at 11 at night, nobody wants to work out deadlines by hand. Enter the time you became aware, say whether the CERT-In directions may apply, and the clock shows each window with the work that belongs in it.
Free tool1 min
- Answers
- Enter when you became aware of a breach. See the 72 hour deadline for the detailed report to the Board, the CERT-In 6 hour window, and what to do in each.
- Based on
- The DPDP Act and Rules as notified
- Privacy
- Calculated in your browser. Nothing is sent unless you choose to send it
The 72 hour period runs from the moment you became aware of the breach. Times are in your device's time zone.
Your clock
Became aware: not set
Without delay
From the moment you became aware
Now
- Open an incident record and note the time you became aware, who told you and what you know.
- Contain the breach and preserve logs. Do not wipe the evidence while fixing the problem.
- Inform the Data Protection Board of the breach, with a short description, without delay.
- Inform each affected Data Principal without delay: what happened, the likely impact on them, what you are doing, what they can do, and who to contact.
CERT-In, within 6 hours
Enter the time above
Waiting
- Check quickly whether the incident is one of the types listed in the CERT-In directions of April 2022. Your security lead usually owns this call.
- Send what you know at that point. Later facts can follow; a late report cannot be undone.
- Check whether your sector regulator, such as the RBI, IRDAI or SEBI, expects its own report and on what timeline.
Detailed report to the Board, within 72 hours
Enter the time above
Waiting
- The facts and circumstances of the breach, and its nature and extent.
- Its likely cause, and what you have done or plan to do to reduce the harm.
- Any findings about the person responsible, and the steps taken to stop it happening again.
- A record of the intimations already sent to affected people. If you need longer, ask the Board before the 72 hours run out.
Indicative only and not legal advice. It is worked out from what you enter and the DPDP Act and Rules as notified. Rule 7 of the DPDP Rules sets the Board and Data Principal intimations; the breach duties apply from around 13 May 2027 as notified, unless amended. The CERT-In directions already apply where they cover the incident. Read the breach guide.
How this works
What the tool is based on
It starts from awareness
Under the DPDP Rules, the detailed report to the Board is due within 72 hours of becoming aware of the breach. The clock starts at awareness.
Two duties come first
The Board and each affected Data Principal are to be told without delay. There is no fixed hour count for these, which is why they sit at the start of the clock.
CERT-In runs alongside
The CERT-In directions of April 2022 ask for specified cyber incidents to be reported within 6 hours. They are a separate regime and may apply to the same event.
The breach clock
The clock starts when you become aware
Tell the Board and the people affected without delay. Where the CERT-In directions apply, report within 6 hours. Send the Board a detailed report within 72 hours, unless it allows longer. Not legal advice.
More tools
Other free tools
Tool
Penalty exposure and readiness score
Describe your organisation, your data and the controls that run today. See which heads of the DPDP Schedule apply, their ceilings in rupees, a readiness score and the gaps to close first.
Learn moreTool
Privacy notice checker
Tick what your privacy notice contains against what the Act and Rules ask. Get the gaps, each with the fix and the provision behind it.
Learn moreTool
Request deadline planner
Enter the date a request arrived and its type. See your own targets and the 90 day outer limit for grievances under Rule 14.
Learn moreTool
DPDP readiness score
Nine statements about how your DPDP work runs today. Get a score, a band and the gaps to look at first.
Learn moreSee it with your data
Show us where your personal data lives. We will show you TrustOS running on it.
A 30 minute walkthrough on Google Meet with someone who knows the Act and the product. You leave with a view of your first phase, the owners and the effort.
Or get a rollout proposal in two minutes- Step 1A 30 minute demo on Google MeetWith someone who knows the Act and the product.
- Step 2Your systems and purposesWe walk one product's personal data through TrustOS.
- Step 3A first phase you can planModules, owners and effort, written down for you to keep.