Data Privacy & Cybersecurity

Overview

Our Data Privacy and Cybersecurity practice helps organisations across Delhi NCR and North India navigate India's rapidly evolving data protection landscape, anchored by the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and its rules, and the CERT-In Cyber Security Directions, 2022. We advise data fiduciaries on DPDP Act readiness, including lawful processing and consent frameworks, data principal rights, breach notification, and the obligations of significant data fiduciaries, as well as cross-border data transfer mechanisms. Our cybersecurity work covers CERT-In incident reporting within the six-hour timeline, data breach response and crisis management, intermediary liability and safe-harbour compliance under the IT Rules, 2021, and cyber-forensics and digital-evidence support. We serve technology companies, e-commerce and SaaS platforms, banks, and healthcare providers, helping them build privacy-by-design programmes and respond to regulatory scrutiny from the Data Protection Board of India and CERT-In.

1. 1

   Contain and assess the incident

   Activate the incident-response plan, isolate affected systems to contain the breach, and assess its nature, scope, the categories of personal data involved, and the number of affected data principals.

2. 2

   Report to CERT-In within 6 hours

   Report the cyber security incident to the Indian Computer Emergency Response Team (CERT-In) within 6 hours of noticing or being notified of it, in the prescribed format, as mandated by the CERT-In Directions of 28 April 2022 issued under Section 70B(6) of the Information Technology Act, 2000.

3. 3

   Notify the Data Protection Board and data principals

   Intimate the Data Protection Board of India and each affected data principal of the personal-data breach as required under Section 8(6) of the Digital Personal Data Protection Act, 2023, read with the prescribed rules, giving the nature and extent of the breach and the measures being taken.

4. 4

   Preserve logs and forensic evidence

   Preserve and securely retain all relevant ICT system logs for the rolling 180-day period mandated by the CERT-In Directions, along with forensic images and a chain-of-custody record, to support investigation and any regulatory inquiry.

5. 5

   Remediate and harden systems

   Eradicate the threat, patch the exploited vulnerabilities, rotate credentials and keys, restore from clean backups, and implement additional safeguards to prevent recurrence. Synchronise system clocks to the NIC/NPL NTP server as required.

6. 6

   Document the breach for the regulator

   Maintain a complete written record of the incident timeline, root-cause analysis, notifications issued, and remediation taken, so the organisation can demonstrate compliance with its reasonable-security-safeguards and accountability obligations if the Data Protection Board commences an inquiry.

This is a general guide. For advice on your specific matter, speak to our Data Privacy & Cybersecurity team.