What Happens if a Company Fails to Report a Cybersecurity Incident in India?

A failure to report cyber incident in India can expose a company to regulatory action, financial penalties, criminal liability in certain circumstances and reputational damage. Businesses must understand their reporting obligations under the Information Technology Act, 2000, the CERT In Directions of 2022 and applicable data protection laws. The consequences depend on the type of incident, the information affected, the reporting deadline and the company’s response.

For businesses handling customer data, financial information or critical digital infrastructure, delayed reporting can create risks beyond the original cyberattack. A ransomware infection, data breach, phishing incident or unauthorised access may trigger specific reporting duties. Understanding these requirements helps organisations respond lawfully, preserve evidence and reduce further exposure.

This article explains the legal framework, potential consequences, reporting timelines and practical steps companies should take when a cybersecurity incident occurs.

Which Laws Govern Cyber Incident Reporting in India?

India’s cyber incident reporting framework involves several legal and regulatory requirements. The applicable rules depend on the incident, the organisation’s sector and the type of data or systems affected.

The Indian Computer Emergency Response Team, commonly known as CERT In, is the national agency responsible for coordinating responses to specified cybersecurity incidents. Under Section 70B of the Information Technology Act, 2000, CERT In has statutory powers to collect and analyse information on cyber incidents, issue alerts and guidelines, and coordinate responses.

The CERT In Directions issued on 28 April 2022 require specified entities, including service providers, intermediaries, data centres, body corporates and government organisations, to report listed cyber incidents within six hours of noticing them or being informed of them. The Directions also impose requirements concerning system logs, time synchronisation and the designation of a point of contact.

Relevant incidents include data breaches, data leaks, unauthorised access to systems, ransomware attacks, phishing, attacks on servers and certain incidents involving cloud computing or digital payment systems.

Companies must also consider the Digital Personal Data Protection Act, 2023, and its applicable rules and commencement provisions. Personal data breaches may trigger separate notification duties under the framework in force at the relevant time. Sector specific requirements may also apply to regulated entities, including banks, financial institutions and telecommunications businesses.

A company should therefore assess each incident against all applicable obligations rather than assuming a single report will satisfy every regulator.

What Is the Six Hour Reporting Requirement?

Under the CERT In Directions, covered organisations must report specified cybersecurity incidents within six hours of noticing the incident or being informed of it. The deadline is designed to enable a timely response to threats affecting computer systems and networks.

The requirement is not limited to incidents which cause a confirmed financial loss. Depending on the circumstances, a reportable event may include a ransomware attack, unauthorised access, data theft, a website defacement or a compromise involving critical systems.

For example, suppose a company discovers at 10 am that an attacker has accessed its business email server. If the incident falls within the categories covered by the Directions, the company should not wait until the investigation is complete or the full extent of the damage becomes clear. It should report within the prescribed period and provide the available information.

Organisations should also distinguish the CERT In deadline from other regulatory or contractual reporting periods. A bank, insurance company or other regulated business may have additional obligations under its sectoral framework.

The safest approach is to establish a clear incident escalation process, with defined responsibility for identifying reportable events and submitting notifications. Further guidance is available through the official CERT In directions and FAQs.

What Are the Legal Consequences of Failing to Report a Cyber Incident?

Penalties under Section 70B of the Information Technology Act

Section 70B(7) of the Information Technology Act, 2000, provides for consequences when a person fails to comply with CERT In directions issued under the relevant statutory framework.

The provision permits imprisonment for a term which may extend to one year, a fine which may extend to ₹1 lakh, or both. This is the statutory exposure associated with the relevant non compliance; it does not mean every delayed report automatically results in prosecution or a maximum penalty.

The circumstances of the alleged breach, the applicable legal requirements and the evidence will matter. An organisation should not assume it is exempt simply because the cyberattack was carried out by an external criminal or because no customer complained.

Regulatory scrutiny and additional compliance action

A missed reporting deadline can prompt questions about whether the company has adequate incident detection, escalation and reporting procedures. Authorities may seek information about when the organisation first became aware of the incident, what action it took and why a report was delayed.

Where separate sectoral rules apply, failure to notify the relevant regulator may lead to additional supervisory action. Financial institutions, for example, should assess applicable Reserve Bank of India requirements alongside CERT In obligations.

The consequences depend on the governing framework. A single incident may engage several legal duties, although each must be assessed separately.

Personal data protection consequences

A cyber incident involving personal information may also raise data protection issues. The Digital Personal Data Protection Act, 2023, and the Digital Personal Data Protection Rules, 2025, establish a framework for personal data protection and breach notifications.

However, the statutory framework has a phased commencement schedule. As of October 2026, the principal operational obligations under Rules 3 to 16, including the relevant breach notification provisions, are scheduled to commence 18 months after publication of the Rules in November 2025. Organisations should verify the commencement provisions and any subsequent amendments before relying on a particular notification deadline.

A company should not treat the phased commencement of the DPDP framework as a general exemption from existing cybersecurity, contractual or sectoral reporting duties.

Can Company Directors or Senior Management Be Held Liable?

A reporting failure may create legal risks for the company and, in certain circumstances, for individuals responsible for the relevant conduct.

The distinction between corporate liability and individual liability is important. A company’s failure to submit a report does not automatically establish personal criminal liability for every director or senior executive. The applicable law, the person’s role, the evidence and the circumstances of the alleged offence must be considered.

Section 85 of the Information Technology Act addresses offences committed by companies. It contains provisions concerning persons in charge of, and responsible to, the company for the conduct of its business, alongside circumstances involving consent, connivance or neglect by directors, managers, secretaries or other officers. The statutory conditions and available defences must be examined in each case.

For example, a compliance officer who escalates an incident promptly but is prevented from submitting a report may stand in a different position from an officer who knowingly conceals a reportable incident. The precise legal outcome will depend on the facts and applicable provisions.

Companies facing potential individual exposure may need advice from criminal lawyers for corporate liability, particularly where an investigation involves allegations of deliberate concealment, destruction of evidence or false statements.

Can a Company Face Civil Liability After a Reporting Failure?

A reporting failure can compound the consequences of the original cybersecurity incident, although civil liability does not arise automatically from every missed deadline.

Customers, business partners or other affected parties may raise claims if the incident causes loss and the relevant legal requirements for liability are satisfied. Contractual commitments, confidentiality clauses, data security obligations and applicable legislation may all be relevant.

For example, a company handling sensitive customer information may face questions about its security safeguards, contractual promises and response to the breach. If it also fails to comply with a mandatory reporting duty, this may become an additional compliance concern.

Historically, Section 43A of the Information Technology Act has provided a framework for compensation where a body corporate handling sensitive personal data or information is negligent in implementing and maintaining reasonable security practices and procedures, resulting in wrongful loss or wrongful gain. Its continuing application must be assessed against the relevant commencement provisions of the DPDP Act and any applicable amendments.

A business should therefore examine both the incident itself and any subsequent failures in its response. Evidence of reasonable security controls, prompt containment and appropriate escalation can be important when assessing the organisation’s position.

What Should a Company Do After Discovering a Cybersecurity Incident?

A company which discovers a potential reporting failure should act promptly. Delaying further can complicate containment, evidence preservation and regulatory communication.

The following steps provide a practical response framework.

Step 1: Contain the incident

Isolate affected systems where appropriate, secure compromised accounts and prevent further unauthorised access. Preserve relevant logs and forensic evidence before taking actions which may destroy important records.

Step 2: Establish the incident timeline

Record when the incident occurred, when it was detected, who was informed and when management became aware. These details help determine the applicable reporting deadline and explain any delay.

Step 3: Assess reporting obligations

Identify whether the event falls within CERT In’s reportable incident categories. Check applicable sectoral regulations, contractual notification duties and personal data protection requirements separately.

Step 4: Submit any outstanding report

If a report was required and the deadline has passed, assess the position urgently and make the required notification without avoidable further delay. Provide accurate information and document the reasons for the delay. Do not assume a late report eliminates the original breach.

Step 5: Document corrective action

Maintain an incident record covering containment, investigation, notifications, decisions and remediation. Review internal escalation procedures to reduce the risk of a repeat failure.

Businesses may also consult cybersecurity lawyers for incident reporting to assess reporting obligations, prepare regulatory communications and evaluate the legal implications of a delayed notification.

How Can Companies Prevent Future Reporting Failures?

Prevention requires more than a written cybersecurity policy. Organisations need procedures which connect technical incident detection with legal and management decision making.

Companies should establish an incident response plan identifying the employees responsible for detection, escalation, legal assessment and external reporting. A designated contact should be available to coordinate with CERT In and other relevant authorities.

The organisation should also maintain reliable system logs, synchronise system clocks as required, and implement a process for preserving evidence. Staff should understand how to escalate suspected phishing, ransomware, data theft and unauthorised access without waiting for management approval to raise an initial alert.

Periodic tabletop exercises can help test whether the legal and technical teams can identify a reportable incident and meet the applicable deadline. Businesses should also review vendor contracts to clarify incident notification obligations, particularly where cloud providers and outsourced IT teams manage critical systems.

Finally, senior management should periodically review incident response performance, unresolved compliance gaps and changes in applicable law. A documented and tested process is more effective than relying on individual employees to recognise every legal requirement during an emergency.

Conclusion

Failure to report a cybersecurity incident in India can expose a company to statutory penalties, regulatory scrutiny, contractual disputes and potential personal liability for responsible individuals in appropriate circumstances. The consequences depend on the reporting obligation involved, the incident’s nature and the organisation’s conduct.

The most effective response combines prompt incident detection, timely reporting, evidence preservation and a documented compliance process. Businesses should identify their reporting duties before an incident occurs and obtain appropriate legal advice when a deadline has been missed or the scope of an obligation is uncertain.