Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Sometimes—but the use of AI does not, by itself, decide whether a company must report a breach in India. As of 25 October 2026, assess the event under two separate frameworks: CERT-In’s directions, which require covered entities to report specified cyber incidents within six hours, and Rule 7 of the Digital Personal Data Protection (DPDP) Rules, 2025, which sets out notices for personal data breaches but is scheduled to commence on 13 May 2027. For a live incident, identify what happened, what data and systems were affected, and which reporting test applies; do not assume that one notification satisfies both frameworks.
What does “AI-related data breach” mean for reporting?
There is no single reporting deadline triggered simply because an incident involved an AI tool. The relevant questions are what happened, whether it fits a specified cyber-incident category or is a personal data breach, which entity is covered by the relevant rule, and when that entity noticed the incident or was informed of it.
“AI-related” can describe many different events: an AI service may have been accessed without authorization, an AI system may have exposed information, or personal data may have been lost or disclosed through a system that uses AI. Those descriptions are not interchangeable legal findings. The facts of the event, the affected data and system, and the applicable framework determine what to assess. The CERT-In directions use listed incident categories; Rule 7 concerns a personal data breach in respect of personal data covered by the Rules.
A useful first step is to separate the technology label from the incident facts. Record whether information was accessed, disclosed, altered, lost, or otherwise affected; whether personal data was involved; which services and systems were affected; and when the organization learned each material fact. These details help determine whether a reporting obligation may apply without assuming that every AI malfunction or security event is a reportable breach.
#1 Best Overall
Which reporting frameworks should a company check?
Check CERT-In and the DPDP Rules independently. They cover different reporting tests, recipients, and timing requirements, so a filing under one should not be treated as proof that obligations under the other have been met.
| Question | CERT-In directions | DPDP Rule 7 |
|---|---|---|
| What event is relevant? | Specified cyber incidents listed in Annexure I to the directions. | A personal data breach in respect of personal data covered by the Rules. |
| Who reports, and to whom? | Covered classes of entities report to CERT-In. | The Data Fiduciary gives notice to affected Data Principals and the Data Protection Board. |
| What timing is stated? | Within six hours of noticing a listed incident or being informed of it. | Initial intimations without delay; specified detailed and updated information within 72 hours, subject to a permitted extension. |
| Status as of 25 October 2026 | The 2022 directions are listed on CERT-In’s official directions page. | Rule 7 is scheduled to commence on 13 May 2027; that scheduled date is in the future. |
Sources: CERT-In directions index, CERT-In direction text, DPDP Rules, Rule 7, and the DPDP Rules commencement schedule.
When does a company have to report to CERT-In?
The 2022 CERT-In directions require covered service providers, intermediaries, data centres, body corporates, and government organisations to report specified Annexure I cyber incidents within six hours of noticing the incident or being informed of it. Whether a particular AI-related event falls within a listed category must be checked against the direction itself; “AI-related” alone is not the test.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Check both the entity and the incident
Do not start and stop with the fact that an organization uses an AI model or service. First determine whether the organization falls within a class covered by the directions. Then compare the known incident facts with the categories in Annexure I and consult CERT-In’s official direction and current guidance. The six-hour period is attached to noticing a listed incident or being informed of one—not to a general category of all events involving AI.
A practitioner summary has described Annexure I as including incidents affecting AI/ML systems. That description is a reason to inspect the official direction, not a complete legal test establishing that every incident affecting an AI/ML system is reportable. The application to a particular event depends on its facts and the wording of the applicable category. The CERT-In official directions page links to the directions, FAQs, and an extension notice; consult the current material when evaluating an actual incident.
Work from the awareness time, not an assumed investigation milestone
The stated CERT-In trigger is when a covered entity notices a listed incident or is informed of it. The directions’ six-hour clock should therefore be considered as soon as those facts may apply, rather than treated as a period that begins only after an internal investigation has established every detail. The source material does not resolve how every disputed awareness scenario should be handled, so keep a contemporaneous record of when information arrived and what was known at each point.
Rank #3
What does DPDP Rule 7 require, and when does it start?
Rule 7 of the DPDP Rules, 2025 describes breach notifications by a Data Fiduciary: affected Data Principals are to be informed without delay in clear and plain language; the Data Protection Board is to be intimated without delay; and specified detailed and updated information is to be provided within 72 hours, unless the Board allows a longer period following a written request. The Rule is scheduled to commence on 13 May 2027, so as of 25 October 2026 it is not an already operative notification duty.
Recommended Free Tools
The distinction between the rule’s content and its start date matters. The text tells organizations what Rule 7 is set to require when it commences; the commencement schedule places that obligation in the future. The Ministry of Electronics and Information Technology’s official Rules repository lists the 2025 Rules and an enforcement timeline published on 14 November 2025. Check for any later corrigendum, amendment, or commencement action before relying on the scheduled date for operational or legal decisions.
The Rule 7 process has distinct recipients and stages. An initial intimation without delay is not the same as the detailed and updated information due within 72 hours. A longer period is not automatic: the Rules describe it as something the Board may allow following a written request. Do not collapse those requirements into a single deadline or assume that an initial notice completes the later information step.
How should a company assess an AI-related incident?
Use a short fact-finding process to decide which framework may apply and to preserve the information needed for a timely response. This is practical incident-response guidance based on the reporting fields and deadlines in the cited instruments, not a separate statutory checklist.
- Describe the event without relying on the AI label. State what is known about access, disclosure, loss, malware, or other activity. Distinguish confirmed facts from possibilities that still need investigation.
- Map the affected systems and data. Identify the AI system or service involved, connected systems, and the types of information affected. Establish whether personal data may be involved and which people may be affected, without assuming that a suspected exposure is confirmed.
- Identify the organizations and their roles. Record which organization operates or provides the relevant service, which one controls or processes the data, and which entity became aware of the event. For Rule 7, the stated actor is the Data Fiduciary; for CERT-In, check whether the reporting entity falls within a covered class.
- Build a dated event timeline. Record when the incident may have occurred, when it was discovered, when the organization noticed it or was informed, and when containment and notices took place. Keep the source of each timestamp, such as an alert or an internal report.
- Test the two reporting routes separately. Compare the event with Annexure I and the CERT-In coverage requirements. Separately assess whether the facts amount to a personal data breach within Rule 7 and account for its scheduled commencement date.
- Preserve the reasoning and response record. Keep the factual basis for deciding whether a CERT-In category may apply, relevant incident updates, and the dates and recipients of any notices. Revisit the assessment if investigation changes what is known about the event.
What mistakes can lead to a wrong reporting decision?
Most avoidable mistakes come from treating “AI breach” as a legal category, overlooking the difference between the two frameworks, or acting on a future rule as though it were already in force.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →- Assuming every AI incident is reportable to CERT-In. The six-hour duty applies to covered entities and specified incident categories, not to every event involving AI.
- Assuming AI events are outside the directions. A system’s use of AI does not exempt an incident from the Annexure I assessment. Check the actual category and facts rather than relying on the technology label in either direction.
- Treating a CERT-In report as a DPDP notification, or vice versa. The frameworks name different tests and recipients. Track each applicable route independently.
- Presenting Rule 7’s 72-hour provision as current on 25 October 2026. The commencement schedule places Rule 7 on 13 May 2027. Its stated requirements should not be confused with an operative duty before that date.
- Using one timestamp for the whole investigation. Occurrence, discovery, awareness, containment, and notification are different events. Record them separately so the basis for a timing decision can be reviewed.
- Waiting for perfect certainty before making any assessment. The CERT-In period is tied to noticing a listed incident or being informed of it. Preserve and evaluate information as it arrives instead of assuming the clock starts only when an investigation is complete.
What should organizations verify before relying on these dates?
This answer reflects the legal materials available as of 25 October 2026, not a determination about a particular incident. The CERT-In directions were issued in 2022 under section 70B(6) of the Information Technology Act, 2000; Rule 7 and its commencement date come from the 2025 DPDP Rules and their schedule.
Best Value
For a real event, confirm the incident date, the entity’s covered status, the applicable Annexure I category, whether personal data was involved, and the relevant awareness timeline. Also check the official CERT-In material and the Ministry’s Rules repository for later changes. The available materials do not establish that every AI/ML incident fits a CERT-In category, nor do they settle every fact-specific question about how a particular event should be classified.
Frequently Asked Questions
Does a company have to report a data breach if no personal data was exposed?
That depends on the event and the framework being assessed. A CERT-In obligation can turn on a specified cyber-incident category, while DPDP Rule 7 concerns a personal data breach; absence of personal data does not by itself answer the CERT-In question.
Does reporting a breach mean the company has admitted fault?
The cited materials describe incident reporting and notification steps; they do not establish that making a report is an admission of fault. A company should keep its factual account precise and distinguish confirmed information from items still under investigation.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesDo the same breach rules apply to every company in India?
The CERT-In directions identify covered classes of entities, and Rule 7 identifies the Data Fiduciary as the actor for its notification duties. A company should establish its role and the relevant framework’s scope rather than assume that the same obligation applies identically to every organization.
Where can I check whether an AI/ML incident is listed by CERT-In?
Use the Annexure I text in the CERT-In directions and the current materials linked from CERT-In’s official directions page. A summary describing AI/ML incidents is not a substitute for checking the specific wording against the facts.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
