MSRXFor people and businesses in India
India cyber incident guide
Who to tell, how fast, and what the law expects. Contact details and rules change, so confirm the current ones at the official sites linked here before relying on them.
Who to report to
| Who | When | How |
|---|---|---|
| National Cyber Crime Helpline 1930 | Online financial fraud: UPI, cards, net banking. Call within minutes. | Dial 1930 (24x7). Fast reporting lets banks freeze the money. |
| cybercrime.gov.in | Any cyber crime by or against an individual, including after the 1930 call. | File a complaint on the National Cyber Crime Reporting Portal; keep the acknowledgement number. |
| CERT-In | Cyber incidents affecting organisations, within 6 hours of noticing. | incident@cert-in.org.in or 1800-11-4949. See cert-in.org.in for the current form and details. |
| Sanchar Saathi (Chakshu) | Suspicious calls, SMS or WhatsApp messages, and lost or stolen phones. | sancharsaathi.gov.in |
| Your bank | Immediately for any unauthorised transaction. | Fraud line and branch; write to the nodal officer within 3 working days. Unresolved: RBI Ombudsman at cms.rbi.org.in. |
| Data Protection Board of India | Personal data breaches by organisations covered by the DPDP Act. | As prescribed in the DPDP Rules; check the Board's site for the current process. |
CERT-In: the 6-hour rule
- Under directions issued by CERT-In on 28 April 2022 (Information Technology Act, section 70B), service providers, intermediaries, data centres, body corporates and government organisations must report listed cyber incidents within 6 hours of noticing them.
- Listed incidents include data breaches and leaks, unauthorised access, website defacement, ransomware and other malicious code, phishing and spoofing, DDoS, and attacks on payment systems, cloud and IoT. The drafter below lists the categories.
- The same directions require keeping system logs for 180 days, stored within India, synchronising clocks to the NTP servers of NIC or NPL, and naming a point of contact for CERT-In.
- A first report need not be complete. Send what you know and follow up.
CERT-In incident report drafter
Fill what you know now. CERT-In asks for the report within 6 hours of noticing, and details can follow, so do not wait for a complete picture.
To: incident@cert-in.org.in
Subject: Cyber security incident report: Data breach
1. Reporting organisation / person: [name]
2. Contact (name, phone, e-mail): [details]
3. Date and time the incident was noticed (IST): [date and time]
4. Type of incident: Data breach
5. Affected systems, IP addresses, URLs and software: [list]
6. Impact (data affected, services down, users affected): [describe]
7. Actions taken so far: [describe]
8. Logs and evidence: [attach relevant logs, screenshots, headers]
Drafted in your browser. Nothing is sent until you send the e-mail yourself. This is a drafting aid, not legal advice; confirm the current requirements at cert-in.org.in.
The DPDP Act and a breach
- The Digital Personal Data Protection Act, 2023 applies to digital personal data processed in India, and to some processing outside India that offers goods or services to people in India.
- A “Data Fiduciary” must take reasonable security safeguards and, after a personal data breach, inform the Data Protection Board and each affected person. The Rules set the timelines and content, including a detailed report to the Board within a fixed number of hours; read the current Rules for the exact figure.
- Failing to take reasonable security safeguards carries the Act's highest penalty, up to ₹250 crore.
- Which duties apply to you, and from what date, depends on the commencement notifications under the Act. Ask a lawyer; the DPDP readiness checklist is a place to start.
General information, not legal advice. MSRX Security has no connection with CERT-In or any government body.