CERT-In 6-Hour Breach Reporting & Ransomware Response
Crisis legal counsel on mandatory 6-hour CERT-In cybersecurity incident notifications, 180-day log preservation, Data Protection Board breach disclosures, ransomware extortion risk management, and board fiduciary defense.
Advocate Ritik Khurana
Authored and vetted by Advocate Ritik Khurana, LL.M. in Cyber Law & Digital Forensics (National Forensic Sciences University - NFSU), B.A. LL.B. (Hons.) (Kurukshetra University), ISO/IEC 42001 Lead Auditor, Counsel at LLM Advocates.
Statutory Architecture & Regulatory Landscape
When a cybersecurity breach or ransomware extortion event strikes an enterprise, response timelines are governed by strict, unforgiving statutory deadlines. Under the Cyber Security Directions issued on April 28, 2022, by the Indian Computer Emergency Response Team (CERT-In) under Section 70B(6) of the Information Technology Act, 2000, all service providers, intermediaries, data centers, body corporates, and government organizations are legally obligated to report cybersecurity incidents to CERT-In within six hours of noticing them or being brought to notice.
The scope of reportable incidents under Annexure I of the CERT-In Directions is exceptionally broad, encompassing ransomware attacks, unauthorized system access, data leaks, identity theft, targeted scanning, denial-of-service (DoS/DDoS) operations, and malicious code infections. Furthermore, organizations are statutorily required to maintain system logs within Indian jurisdiction for a rolling period of 180 consecutive days and synchronize their system clocks to the Network Time Protocol (NTP) servers of the National Physical Laboratory (NPL) or NIC. Failure to comply with CERT-In directions is punishable under Section 70B(7) of the IT Act with imprisonment up to one year and criminal fines.
Simultaneously, the Digital Personal Data Protection Act, 2023, introduces an overlapping statutory duty under Section 8(6): in the event of a personal data breach, the Data Fiduciary must give notice of the breach to the Data Protection Board of India (DPBI) and to each affected Data Principal in such form and manner as prescribed. Failure to report a personal data breach to the DPBI carries statutory penalties reaching up to ₹200 crore under the Schedule.
Statutory & Regulatory Framework Matrix
| Statute / Framework | Regulatory Authority | Mandatory Statutory Covenants | Litigation & Compliance Remedies |
|---|---|---|---|
| CERT-In Directions (April 2022) | Indian Computer Emergency Response Team (CERT-In) | Mandatory reporting of 20 types of cybersecurity incidents within 6 hours; retention of system logs for 180 days. | Incident classification, drafting and submitting CERT-In Incident Reporting Forms, and defending against Section 70B(7) criminal prosecution. |
| DPDP Act 2023 (Sec. 8(6)) | Data Protection Board of India (DPBI) | Mandatory dual-notification of personal data breaches to the DPBI and affected Data Principals without delay. | Drafting regulatory breach notices, structuring public communication, and mitigating multi-hundred crore penalties before the DPBI. |
| Companies Act, 2013 (Sec. 166) | Ministry of Corporate Affairs / NCLT | Directors' personal fiduciary liability to exercise due care and diligence in managing catastrophic cybersecurity and operational threats. | Advising the Board of Directors, crisis response committee structuring, and defense against shareholder derivative lawsuits. |
| Bharatiya Nyaya Sanhita (BNS) 2023 | State Cyber Crime Police / Special Cells | Criminal offenses of extortion (Sec. 308 BNS), cyber terrorism (Sec. 66F IT Act), and unauthorized computer damage (Sec. 43/66 IT Act). | Filing criminal FIRs with Cyber Crime Police Cells, securing preservation of forensic evidence, and coordination with law enforcement. |
Legal Deliverables & Representation Scope
Emergency 6-Hour CERT-In Incident Notification
Rapid legal assessment, classification, and drafting of official incident reports to CERT-In under strict statutory timelines.
- •Immediate legal triage determining whether the incident triggers Annexure I mandatory reporting
- •Drafting and filing the Initial Incident Reporting Form with CERT-In within the 6-hour window
- •Managing follow-up regulatory queries and technical root-cause analysis submissions
- •Ensuring 180-day log preservation compliance to insulate against Section 70B(7) prosecution
DPBI Personal Data Breach Regulatory Filings
Structuring legally compliant notifications to the Data Protection Board of India and affected Data Principals under Section 8(6) DPDP Act.
- •Assessing the nature, scope, and impact of exfiltrated personal data
- •Drafting regulatory notifications detailing remedial measures to the DPBI
- •Structuring clear, non-inflammatory notifications to affected Data Principals
- •Formulating legal defense strategies to prevent the imposition of maximum statutory penalties
Ransomware Crisis Management & Extortion Legal Advisory
Navigating the perilous legal landscape surrounding ransomware extortion, decryption negotiations, and cyber insurance claims.
- •Advising the Board on legal implications of ransomware payments under PMLA and sanctions laws
- •Engaging and managing specialized digital forensics incident response (DFIR) investigators
- •Reviewing and negotiating claims with Cyber Risk Insurers under enterprise policies
- •Coordinating formal criminal complaints with State Cyber Crime Police Stations
Post-Incident Litigation & Regulatory Defense
Representing corporations and executive leadership in aftermath litigation, regulatory inquiries, and commercial disputes.
- •Defending against class action damages lawsuits and commercial breach-of-contract claims
- •Representing corporate fiduciaries in DPBI formal inquiry proceedings
- •Advising on cross-border breach reporting (GDPR Article 33, US SEC cybersecurity disclosures)
- •Conducting post-mortem legal reviews to remediate organizational cybersecurity vulnerabilities
Landmark Precedents & Judicial Doctrines
In cybersecurity litigation, Indian High Courts have established that failure to implement basic security safeguards or deliberate concealment of data breaches strips an enterprise of commercial protections. In cases involving banking credential theft and cloud service disruptions, courts have held that intermediaries cannot shield themselves behind generic force majeure clauses when breaches result from unpatched vulnerabilities or unmonitored systems.
Furthermore, under Section 43A of the Information Technology Act, 2000, and evolving consumer jurisprudence, courts have awarded substantial compensation to victims of data breaches where body corporates failed to exercise reasonable statutory care in protecting sensitive financial and identification data.
Related Practice Sub-Pages & Statutory Treatises
DPDP Act Master Practice Hub
Master practice page for DPDP Act implementation, DPBI defense, and privacy governance.
Consent Architecture & Child Data Audits
Detailed statutory analysis of Section 6 itemized notices and Section 9 verifiable parental consent.
Ransomware & Fiduciary Duties: Board Liabilities
Comprehensive treatise on incident response, extortion dilemmas, and corporate governance in cyber attacks.
The Quantum Threshold: Encryption Law
Analysis of cryptographic defenses, HNDL threats, and post-quantum migration obligations.
Frequently Addressed Statutory Inquiries
Does every minor IT glitch require reporting to CERT-In within 6 hours? ↓
No. Mandatory reporting under the April 2022 Directions is triggered by specific, enumerated types of cybersecurity incidents listed in Annexure I—including targeted scanning, compromised critical systems, unauthorized access, defacement, malicious code (ransomware, trojans), DoS attacks, and identity theft. Routine spam or blocked firewall attempts do not trigger the 6-hour mandate.
Is it legal to pay a ransomware ransom demand in India? ↓
Indian law contains no explicit statutory statute making the payment of ransom per se illegal. However, paying a ransom creates severe indirect legal hazards: potential violation of the Prevention of Money Laundering Act, 2002 (PMLA) if funds reach sanctioned or terrorist organizations, foreign exchange violations under FEMA, and loss of insurance reimbursement. Boards must seek immediate counsel before initiating any extortion negotiations.
What constitutes a 'Personal Data Breach' under the DPDP Act 2023? ↓
Section 2(u) defines a personal data breach broadly as any unauthorized processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction, or loss of access to personal data, that compromises the confidentiality, integrity, or availability of personal data. Even temporary loss of access caused by ransomware encryption qualifies as a reportable breach.
What criminal penalties apply if an enterprise ignores CERT-In directions? ↓
Under Section 70B(7) of the Information Technology Act, 2000, any service provider, intermediary, data center, or body corporate that fails to comply with the directions issued by CERT-In (including the 6-hour reporting mandate and 180-day log preservation rule) is punishable with imprisonment for a term which may extend to one year, or with fine up to one lakh rupees, or both, applicable to responsible corporate officers.
Advocate Ritik Khurana | Chambers at LLM Advocates
This comprehensive statutory analysis reflects verified litigation procedures, current legislative amendments, and judicial precedents before Indian High Courts and regulatory boards.
Retain Counsel for CERT-In 6-Hour Breach Reporting & Ransomware Response
Advocate Ritik Khurana provides specialized trial litigation, High Court writ representation, regulatory audits, and commercial contract negotiations. Direct chambers at Chandigarh (Punjab & Haryana High Court) and New Delhi.