Mandatory Cyber Security Incident Reporting in India

Indian law names the groups that must report cyber incidents. The reports go to one national agency, CERT-In. This section shows who is covered and which law says so.

1.1 Which law makes reporting mandatory?

The law is section 70B of the Information Technology Act, 2000. The Central Government appointed the Indian Computer Emergency Response Team (CERT-In) under this section. The notification is dated 27 October 2009.

CERT-In is the national agency for cyber incident response. Its jobs include these.

• Collecting, analysing and sharing information on cyber incidents.
• Giving forecasts and alerts of cyber security incidents.
• Taking emergency measures and coordinating the response.
• Issuing guidelines, advisories and white papers.

1.2 What power lets CERT-In give orders?

Section 70B(6) lets CERT-In call for information and give directions. It can do this to service providers, intermediaries, data centres, body corporate and any other person.

On 28 April 2022, CERT-In used this power. It issued Directions on security practices and the reporting of cyber incidents. The Directions took effect after 60 days from the date of issue.

1.3 Who has to follow the Directions?

The CERT-In FAQs list the groups covered.

• Service providers and intermediaries.
• Data centres.
• Body corporate.
• Virtual private server (VPS), cloud and VPN service providers.
• Virtual asset service providers, exchange providers and wallet custodians.
• Government organisations.

The FAQs add one clear exclusion. Individual citizens are not covered by the Directions.

The six-hour reporting duty itself names five groups. These are service providers, intermediaries, data centres, body corporate and Government organisations.

1.4 What does “body corporate” mean?

The FAQs point to section 43A of the IT Act. A body corporate means any company. It also includes a firm, a sole proprietorship or another association of individuals. The firm or association must be engaged in commercial or professional activities.

1.5 How was this tested in UPSC 2017?

UPSC asked about this in the Civil Services Prelims 2017 paper, GS Paper I, Q85. Here is the question as printed.

In India, it is legally mandatory for which of the following to report on cyber security incidents?
1. Service providers
2. Data centres
3. Body corporate
Select the correct answer using the code given below:
(a) 1 only
(b) 1 and 2 only
(c) 3 only
(d) 1, 2 and 3

All three groups are named in section 70B(6) and in the Directions. So the answer is (d) 1, 2 and 3.

The Directions set a clock and a list. The clock is six hours. The list has twenty types of incidents.

2.1 How fast must an incident be reported?

A covered entity must report within 6 hours of noticing the incident. The clock also starts when the entity is “brought to notice” about the incident.

CERT-In accepts reports by three routes.

• Email: incident@cert-in.org.in.
• Phone: 1800-11-4949.
• Fax: 1800-11-6969.

The FAQs say timely reporting helps CERT-In build awareness of cyber threats. It also helps CERT-In coordinate the response.

2.2 Which incidents are on the list?

Annexure I of the Directions lists 20 types of cyber security incidents. Here are some of them.

• Targeted scanning or probing of critical networks and systems.
• Unauthorised access of IT systems or data.
• Defacement of a website.
• Malicious code attacks such as virus, worm, Trojan, bots, spyware, ransomware and cryptominers.
• Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks.
• Identity theft, spoofing and phishing attacks.
• Data breach and data leak.
• Attacks on digital payment systems.
• Malicious mobile apps and fake mobile apps.
• Unauthorised access to social media accounts.

The list also covers attacks on cloud systems, Internet of Things devices, and systems related to artificial intelligence and machine learning.

2.3 What do these terms mean?

The FAQs explain some terms from the list.

• A data breach is a cyber incident where information is stolen or taken from a system without the owner’s knowledge or authorisation.
• A data leak is the release of sensitive or protected data to an untrusted environment. Accidental causes such as poor safeguards or wrong settings can cause it.
• Phishing is an attack aimed at stealing sensitive personal data.
• Ransomware blocks access to a computer system, often by encrypting files, until money is paid.

2.4 What if the details are not ready in six hours?

Entities may give the information that is available at the time. They can send more details later, within a reasonable time.

The FAQs say that incidents of the following kinds must meet the six-hour limit.

• Severe incidents such as DoS, DDoS, intrusion or ransomware on public information infrastructure, including backbone networks.
• Data breaches or data leaks.
• Large-scale or very frequent incidents.
• Incidents affecting the safety of human beings.

2.5 Can the duty be passed to someone else?

No. The FAQs say any entity that notices an incident shall report it. The duty to report is neither transferable nor indemnified. A confidentiality clause in a contract does not override it.

The FAQs also say the reporting duty is statutory. It overrides a confidentiality clause in a contract, because of section 81 of the IT Act.

Reporting is only one part. The Directions also tell entities to keep clocks in step, keep logs and keep records of customers.

3.1 Why must computer clocks be synchronised?

All covered entities must connect to the Network Time Protocol (NTP) server of the National Informatics Centre (NIC) or the National Physical Laboratory (NPL). They may also use a server traceable to these two.

The FAQs give the reason. A cyber incident often touches many systems. Without accurate time stamps, it is hard to rebuild the order of events.

3.2 How long must logs be kept?

Covered entities must enable logs of all their ICT systems. They must keep them securely for a rolling period of 180 days. They must give the logs to CERT-In when they report an incident or when CERT-In orders it.

The Directions say the logs must be kept “within the Indian jurisdiction”. The FAQs soften this. They say logs may be stored outside India if they can be produced to CERT-In in reasonable time. The FAQs state that they are not a legal document.

3.3 What records do data centres and VPN providers keep?

Data centres, VPS providers, cloud service providers and VPN service providers must register accurate customer details. They must keep them for 5 years after a registration is cancelled or withdrawn. The details include these.

• Validated names of customers.
• Period of hire, with dates.
• IP addresses allotted.
• Email address, IP address and time stamp at the time of registration.
• Purpose of hiring the service.
• Validated address and contact numbers.
• Ownership pattern of the customers.

The FAQs add that this rule does not cover enterprise or corporate VPNs. It covers providers of “Internet proxy like services” to the general public.

3.4 What about virtual asset providers and contact persons?

Virtual asset providers, exchange providers and custodian wallet providers must keep their Know Your Customer (KYC) information and records of financial transactions for five years.

Every covered entity must also name a Point of Contact to deal with CERT-In. All CERT-In communications go to that person.

Section 70B(7) of the IT Act sets the punishment. The fine limit changed in 2023, so many older notes are out of date.

4.1 What does section 70B(7) say?

A service provider, intermediary, data centre, body corporate or person may fail to give the information CERT-In asks for. It may also fail to follow a CERT-In direction. Such a failure is punishable with imprisonment up to one year, or a fine, or both.

The CERT-In FAQs of May 2022 quote the fine as up to one lakh rupees. The Directions themselves say that failure may invite punitive action under section 70B(7).

4.2 Did the fine limit change?

Yes. The Jan Vishwas (Amendment of Provisions) Act, 2023 changed the words “one lakh” to “one crore” in section 70B(7). The change came into force on 30 November 2023.

So the fine now may extend to one crore rupees. Older books and notes that say one lakh are out of date.

4.3 Is every lapse punished?

The FAQs say the power will be used reasonably. It will be used on occasions when the non-compliance is deliberate.

4.4 Do foreign firms also have to report?

The FAQs say the Directions apply to all entities when it comes to reporting a cyber incident. Service providers offering services to users in India must name a Point of Contact. This holds even if they have no physical presence in India.

CERT-In is not the only body that can receive a breach report. The Digital Personal Data Protection Act adds a second duty. Section 70A adds a second agency for critical infrastructure.

5.1 What does the DPDP Act say about a data breach?

Section 8(6) of the Digital Personal Data Protection Act, 2023 covers a personal data breach. The Data Fiduciary must tell the Data Protection Board and each affected Data Principal. The form and manner are set by rules.

The Act defines a personal data breach as unauthorised processing or accidental disclosure, loss or similar events. These events must compromise the confidentiality, integrity or availability of personal data.

5.2 What do the 2025 Rules add?

Rule 7 of the DPDP Rules, 2025 sets the timing. The Data Fiduciary must tell each affected person without delay. It must also tell the Board without delay, with a first description of the breach.

Then comes a second step. Within 72 hours, or a longer period the Board allows, it must send updated and detailed information to the Board.

The Rules were published in the Gazette dated 13 November 2025. PIB’s release says they were notified on 14 November 2025. Rule 7 comes into force eighteen months after the Gazette publication.

5.3 What is the penalty under the DPDP Act?

PIB states that failing to notify the Board or affected individuals of a breach can attract a penalty of up to ₹200 crore. The highest penalty, up to ₹250 crore, applies to failing to keep reasonable security safeguards.

5.4 Which body guards critical infrastructure?

Section 70A of the IT Act created the National Critical Information Infrastructure Protection Centre (NCIIPC). It protects critical information infrastructure.

Other bodies in the system, as listed by PIB, include these.

• The National Cyber Security Coordinator under the National Security Council Secretariat.
• The National Cyber Coordination Centre, run by CERT-In.
• The Indian Cybercrime Coordination Centre (I4C), set up by the Ministry of Home Affairs.

The number of incidents tracked by CERT-In has risen every year since 2022. Exams test the legal points more than the numbers.

6.1 How many incidents does CERT-In track?

PIB gives yearly totals “reported to and tracked by CERT-In”.

• 2022: 13,91,457 incidents.
• 2023: 15,92,917 incidents.
• 2024: 20,41,360 incidents.
• 2025: CERT-In handled over 29.44 lakh incidents, says a later PIB feature.

In 2025, CERT-In also issued 1,530 alerts, 390 vulnerability notes and 65 advisories.

6.2 Which traps do examiners set?

Watch for these points.

• All three groups in the 2017 question are covered, not one or two.
• The time limit is 6 hours for CERT-In. The 72 hours is the DPDP step for a detailed report to the Board.
• The agency for incident response is CERT-In (section 70B). The agency for critical infrastructure is NCIIPC (section 70A).
• Punishment is up to one year, or a fine up to one crore rupees, or both.
• Individual citizens are outside the reporting duty.