You work at an Indian SaaS company. A customer in Berlin uses your product. Their account contains their name, email, IP address, and usage telemetry. On a Tuesday morning your SOC finds a threat actor exfiltrating a slice of your customer database. Berlin is in that slice.
From that Tuesday morning, three regulatory clocks start running on three different desks, all measuring the same event. If you miss any one of the three, you convert a technical incident into a regulatory finding. Let me walk you through each clock the way I would if we were sitting together in your Incident Room at 07:30 on that Tuesday.
- CERT-In clock: six hours. Direction (ii) of the CERT-In Directions of 28 April 2022 requires you to report the incident to CERT-In within six hours of noticing it
[L1-C1]. You are a body corporate in India; the Direction applies regardless of who the affected data subjects are. This is the tightest of your three clocks and the one Indian practitioners most often miss because they are focused on the customer-facing regulator (DPDP or GDPR) and forget the sectoral one. The template is prescribed in Annexure I of the Directions; the primary channel is the CERT-In portal ([email protected] as a fallback). Filing an initial holding notice within six hours and refining it as facts settle is standard practice and CERT-In accepts amendments. - DPDP Board clock: 72 hours. DPDP Rules 2025 Rule 7 requires you to intimate the Data Protection Board of India of a personal data breach without delay, with the full report within 72 hours
[L1-C2]. It applies whenever you process the personal data of Data Principals within the territory of India; if your Berlin user also has an India-facing dimension in your product it is safer to file. MeitY finalised the DPDP Rules 2025 by Gazette Notification G.S.R. 846(E) dated 13 November 2025, and the substantive Data Fiduciary obligations (Rules 3, 5 to 16, 22, and 23) commence eighteen months after publication — that is, on 13 May 2027. Rule 4 (Consent Manager registration) commences 13 November 2026. Rules 1, 2, and 17 to 21 (Board and definitional provisions) commenced immediately on 14 November 2025. The readiness posture for Rule 7 breach reporting starts now; the enforcement teeth arrive on 13 May 2027. - GDPR clock: 72 hours. GDPR Article 33 requires the controller to notify the competent supervisory authority within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons
[L1-C3]. If you are a processor of an EU controller, Article 33(2) requires you to notify the controller without undue delay so it can meet its 72-hour clock. If you are the controller (you determined the purposes and means of processing the Berlin user's data), you notify the DPA yourself. Which DPA? Under the One-Stop-Shop mechanism it is the lead DPA of your main establishment in the Union; for a non-EU controller reached only through Article 3(2) it is the DPA of the Member State where your Article 27 Representative is located, or the DPA of any Member State where affected data subjects reside if you have no Representative.
Three regulators. Three clocks. One incident. This is what "dual regime" means in the ordinary week of an Indian privacy professional. And this is only the reporting overlay; the substantive obligations (lawful basis, retention, security, transfers) run in parallel every day, not just on Incident Day.
Why we teach GDPR alongside DPDP rather than separately
Almost every Indian privacy professional I meet either has DPDP knowledge and is picking up GDPR, or has GDPR knowledge (often from IAPP CIPP/E) and is picking up DPDP. Both learning paths lead to the same operating desk. If you learn GDPR without DPDP context you will keep making mistakes at the DPDP interface: the Consent Manager (a novel Indian instrument with no GDPR analogue), the algorithmic-fairness audit under Rule 12 for Significant Data Fiduciaries, the nomination right under DPDP Section 13 that lets a Data Principal nominate a person to exercise their rights on death or incapacity. If you learn DPDP without GDPR context you will keep making mistakes at the GDPR interface: the six-basis Article 6 architecture (much broader than DPDP's consent-plus-Legitimate-Uses), the Article 27 EU Representative appointment, the Schrems II Transfer Impact Assessment for every India-bound flow.
Teaching them together gives you one operating programme. One incident register. One consent design. One DPO office. One ROPA (Records of Processing Activities). One breach runbook. Where the two regimes align (breach reporting clock at 72 hours; principle of purpose limitation), teach the alignment. Where they diverge (GDPR's six lawful bases versus DPDP's consent-and-legitimate-uses; GDPR's Article 27 Representative versus DPDP's DPO trigger only for SDFs), teach the divergence and the stricter default. When in doubt, adopt the stricter regime as your operating floor. That way you are compliant with both, always.
The three-clock table you will keep on your desk
| Clock | Trigger | Deadline | Primary source |
|---|---|---|---|
| CERT-In | Any noticeable cyber incident (Annex I list, includes personal data breach) | Six hours from becoming aware | CERT-In Directions 28 Apr 2022, Direction (ii) |
| DPDP Board | Personal data breach affecting Data Principals | Without delay initial; full within 72 hours | DPDP Rules 2025 Rule 7 (effective 13 May 2027) |
| GDPR DPA | Personal data breach unless unlikely to result in risk | 72 hours from awareness | GDPR Article 33 (already in force) |
| Affected Data Principals (DPDP) | Same personal data breach | Same window as Board notification | DPDP Rules 2025 Rule 7(2) |
| Affected data subjects (GDPR) | High risk to rights and freedoms | Without undue delay | GDPR Article 34 |
What this course assumes about you
You have three or more years in a privacy or compliance role. You have working DPDP familiarity, either from dcomply Academy's free DPDP Act 2023 course, from our DPDP Rules 2025 Practitioner course, or from independent reading of the Act and the 13 November 2025 Rules. You are comfortable reading a Regulation article and an EDPB Guideline in original English text. You are not looking for an IAPP CIPP/E prep book; you are looking for the operational discipline to run the two regimes together on a working desk in an Indian office serving EU customers.
What this course does not do
It does not certify you as a globally recognised GDPR professional. IAPP CIPP/E does that, and it costs a lakh or more with membership renewal every year. If you need the CV signal for a role that specifically requires the CIPP/E badge, take IAPP CIPP/E. This course teaches you the operational job that CIPP/E does not teach at the depth of the primary sources, at a price point accessible to an individual Indian buyer paying out of pocket. Many practitioners hold both; they are complements, not substitutes.
The rest of the course builds this dual-regime operating programme, module by module, cited to primary sources throughout. Every claim carries a citation back to the eur-lex text, the EDPB Guidelines register, a CJEU case number, or a DPA press release. When a Guideline is revised, or an appeal is decided, we update the lesson and the citation register within our stated SLA. That is the operating discipline this course teaches you, applied to the course itself.