Is this breach reportable, and by when?

For most regimes the deadline runs from when you become aware of the breach, not from when it first happened. That is why having detection and an escalation path in place matters — the time you spend deciding whether something counts is time on the clock.

You have to satisfy each one, and the shortest deadline governs your timeline. If a single incident triggers CERT-In, GDPR and HIPAA, the 6-hour CERT-In window sets the pace — you cannot wait the full 72 hours just because GDPR allows it.

Often yes. Several regimes require notification regardless of size, and thresholds tend to change what extra steps apply — for example, large HIPAA breaches add notice to HHS and the media — rather than whether you report at all. Treat scale as a factor in the response, not a reason to skip it.

No. This is general guidance to help you see which regimes are likely in scope and how tight the timing is. Your actual obligations depend on the facts of the incident, your contracts, and where you operate — confirm them with qualified counsel before you rely on them.