DPDP Act and CERT-In: a compliance checklist for data-centre tenants

A common assumption in Indian IT teams goes like this: our servers sit in a certified data centre, or in a major cloud region, so compliance is the provider's job. Under India's two main rules for digital data — the Digital Personal Data Protection Act, 2023 (DPDP) and CERT-In's cyber-security directions of 28 April 2022 — that assumption is wrong. The provider is responsible for its building and its platform. You remain responsible for the personal data you collect and for reporting incidents on your systems.

This checklist is written for tenants: banks, hospitals, retailers, SaaS companies and global capability centres that run workloads in someone else's facility. It is practical guidance, not legal advice; confirm specifics with your legal team.

Where the deadlines stand

The DPDP Rules were notified in November 2025 with an eighteen-month phased timeline, so most substantive obligations — security safeguards, breach notification, data-principal rights — come into force in May 2027. That sounds distant until you count the work: data mapping, contract changes, logging and incident drills each take months. CERT-In's directions, by contrast, have applied since 2022.

The stakes

According to the Government of India's own summary of the Act, the highest DPDP penalty — up to ₹250 crore — applies to failing to maintain reasonable security safeguards. Failing to notify the Data Protection Board or affected individuals of a personal data breach can attract up to ₹200 crore, as can breaching obligations relating to children. Other violations can attract up to ₹50 crore.

Your provider secures the building. You are accountable for the data inside it.

The checklist

1. Map your personal data. List every system that holds personal data, what it holds, why, and where it physically lives — which data centre, which cloud region. You cannot protect, report on or delete what you have not found.

2. Fix the contracts. Your colocation, cloud and managed-service providers are processing on your behalf. Their contracts should cover security controls, how fast they tell you about an incident (you have only hours, so they must have less), log access, data return and deletion at exit, and the right to see evidence.

3. Logs: keep them, keep them in India, keep them long enough. CERT-In requires logs of all ICT systems to be maintained securely for a rolling 180 days within Indian jurisdiction. Legal commentators note that the DPDP Rules also call for logs to be kept for at least a year; retaining a year of logs in India satisfies both.

4. Synchronise the clocks. CERT-In requires systems to synchronise time with the NTP servers of the National Informatics Centre or the National Physical Laboratory. Without consistent time, logs from different systems cannot be correlated — and an incident timeline cannot be proven.

5. Build the incident runbook around two clocks. CERT-In requires reportable cyber incidents to be reported within six hours of being noticed. Under DPDP, affected individuals must be told about a personal data breach without delay, in plain language, with what happened, its likely impact and the steps taken; the Board must be informed too, and commentary on Rule 7 describes a detailed report to the Board within 72 hours. Write down who decides, who reports and what evidence is collected — then rehearse it.

6. Reasonable security safeguards. Encryption of personal data, access controls, monitoring for unauthorised access, and backups that can actually be restored. This is the obligation with the largest penalty, and it is the one regulators will test first after an incident.

7. Answer data-principal requests on time. Requests to access, correct, update or erase personal data must be handled within ninety days. Publish a clear contact for privacy queries — a designated officer or a Data Protection Officer.

8. Delete what you no longer need. Personal data should be erased when its purpose is served or consent is withdrawn. Old backups and test copies are where forgotten personal data usually hides.

9. Keep the evidence. When something goes wrong, the question is not only what you did but what you can prove. Tamper-evident logs, records of drills, contract clauses and decisions made during an incident are what an auditor — or the Board — will ask for.

If you only do three things this quarter

Complete the data map. Turn on 180-day-plus log retention in India with synchronised clocks. Run one incident drill against the six-hour CERT-In clock. Those three steps close the biggest gaps fastest.

Where Zyvark fits

Praman, our compliance platform, is built around exactly these duties: tamper-evident, hash-chained logs, a breach workflow that tracks the CERT-In six-hour clock, and audit-ready evidence packs. Our Backup & DR readiness assessment includes a CERT-In log-retention check. Neither replaces legal advice; both make the evidence easier to produce.

Sources

Government of India (PIB), DPDP Rules, 2025 notified — overview of the Act and Rules, penalties, eighteen-month phasing, breach notification and ninety-day response (November 2025). CERT-In, Directions under section 70B(6) of the IT Act, 2000 (28 April 2022) — six-hour reporting, 180-day logs within India, NTP synchronisation. Commentary on DPDP Rule 7 (breach reporting) and Rule 6 (safeguards and log retention) from Indian law firms, including summaries published on Legal500. This article is general guidance, not legal advice.