Personal data breach notification for Indian hospitals: the 6-hour and 72-hour clocks

The short answer

Picture IT calling at 9 pm: a misconfigured AI tool may have exposed patient records. From that moment, more than one reporting clock can be running, and every affected patient may need to be told in plain words. Know the clocks and what each report must contain before the call comes.

When an Indian hospital learns of a personal data breach, the DPDP Rules ask it to tell each affected patient without delay and to tell the Data Protection Board without delay, followed by a detailed report within 72 hours.¹ If the incident is also a cyber incident on CERT-In’s list, such as unauthorised access or a data leak, CERT-In’s 2022 directions ask for a report within 6 hours of noticing it.³³ The two regimes run in parallel; one report doesn’t replace the other.

The DPDP breach duties are part of the rules that start eighteen months after the November 2025 publication, so around May 2027.¹ CERT-In’s directions have applied since 2022.³ This post summarises the texts; it isn’t legal advice.

What counts as a breach

The DPDP Act frames the duty around a “personal data breach” and asks the Data Fiduciary to inform the Board and each affected Data Principal in the manner the Rules prescribe.² In a hospital, common cases include:

• a misdirected discharge summary or lab report sent to the wrong patient;
• a staff account used to look up records it had no reason to see;
• a ransomware attack that encrypts or exfiltrates the EMR;
• a vendor’s system, such as a transcription or AI service, exposing patient data it processed for you.

That last case matters because the hospital remains responsible for processing a vendor does on its behalf.² The safeguards in Rule 6 cover processing by a Data Processor too.¹

Clock one: CERT-In, 6 hours

CERT-In’s directions apply to service providers, intermediaries, data centres, body corporates and government organisations, which plainly covers hospitals run by companies and government hospitals; whether a hospital run by a trust or society is covered is a question for counsel. They ask for listed incidents to be reported within 6 hours of noticing them, and for ICT system logs to be kept for a rolling 180 days within India.³ The list in Annexure I includes unauthorised access to IT systems or data, data breaches, data leaks, attacks on cloud systems and attacks on systems related to artificial intelligence and machine learning.³

Six hours is short. The report doesn’t need every answer; it needs to go in on time, with what you know.

Clock two: the DPDP Board, 72 hours

Rule 7(2) splits the Board report in two.¹

Without delay: a description of the breach, including its nature, extent, timing and location, and the likely impact.

Within 72 hours of becoming aware (or longer, if the Board agrees on a written request):

1. updated and detailed information on that description;
2. the broad facts about the events, circumstances and reasons that led to it;
3. measures taken or proposed to reduce the risk;
4. any findings about the person who caused it;
5. remedial measures to prevent it happening again;
6. a report on the notices given to affected patients.

Item 4 and item 5 both depend on records. You can only say who caused a breach, or what changed, if something outside the affected system recorded it.

The patient notice

Rule 7(1) asks the hospital to tell each affected patient, “to the best of its knowledge”, in a concise, clear and plain manner and without delay, through their account or a registered contact such as a phone number.¹ The notice must cover:

Write the template now, in the languages your patients read. A notice drafted for the first time during an incident is usually late and unclear.

A worked timeline

A hypothetical: at 09:00 on a Monday, the IT team sees that an integration account, used by an AI documentation tool, pulled 4,000 discharge summaries overnight instead of the usual few hundred.

The 72-hour report is due Thursday morning. Count from when you became aware, not from when you finished investigating.

What to prepare now

1. Name the decision-maker who says “this is a breach” at 2 a.m., and a deputy.
2. Keep logs that answer “who and what”, held outside the systems they describe, for at least the CERT-In 180 days³ and the DPDP one year.¹
3. Write the three templates: CERT-In report, Board report, patient notice.
4. Put notice duties in vendor contracts, so an AI or cloud vendor tells you within hours, not weeks.
5. Rehearse once with a scenario like the one above.

The DPDP Rules for hospitals overview lists the other duties that start in 2027, and CERT-In’s directions for hospitals covers the 180-day logs and clock sync. Our first-hour runbook for an agent that deleted data is the technical counterpart. For what Deedglass does around AI agent actions, see /healthcare.

To try the checks on synthetic data, open the playground in your browser. To see what an AI agent on your machine can change, run npx deedglass scan (what the grade means) or paste its MCP config into /check; neither uploads your data. Our AI agent permissions report shows what public agent setups commonly leave open.

Written with AI assistance and checked against our claims register.