Breach Notification Requirements

2.1 The Multi-Regulator Notification Landscape

A single data breach in India can trigger notification obligations to multiple regulators simultaneously. Legal counsel must map all applicable requirements and create a coordinated notification strategy to avoid compliance failures.

Notification Timeline Overview

2.2 DPDPA Notification to Data Protection Board

Section 8(6) of DPDPA creates mandatory breach notification obligations for Data Fiduciaries, requiring notification to both the Data Protection Board and affected Data Principals.

Statutory Requirement

Section 8(6) states: "In the event of a personal data breach, the Data Fiduciary shall give the Board and each affected Data Principal, intimation of such breach in such form and manner as may be prescribed."

Expected Notification Content (Based on Global Standards)

• Nature of the Breach: Description of what happened, how data was compromised
• Categories of Data Affected: Types of personal data involved (financial, health, identity)
• Approximate Number Affected: Estimated count of Data Principals impacted
• Likely Consequences: Potential risks to affected individuals
• Remedial Measures Taken: Steps taken to address the breach and mitigate harm
• Contact Information: Data Protection Officer or designated contact details

Notification to Data Principals

Unlike regulatory notification, notification to affected individuals must be:

• Clear and Simple: Avoid legal jargon - Data Principals are laypeople
• Actionable: Specific steps they should take (change passwords, monitor accounts)
• Direct: Reach affected individuals through verified channels
• Prompt: Delays increase harm and regulatory scrutiny

2.3 CERT-In 6-Hour Reporting Rule

The CERT-In Directions 2022 mandate incident reporting within 6 hours - one of the strictest timelines globally. Understanding what triggers this obligation and how to comply is essential for incident response.

When Does the 6-Hour Clock Start?

The Directions state: "within 6 hours of noticing such incidents or being brought to notice about such incidents."

Reportable Incidents Under CERT-In Directions

1. Targeted scanning/probing of critical networks/systems
2. Compromise of critical systems/information
3. Unauthorised access to IT systems/data
4. Defacement of website or intrusion into website
5. Malicious code attacks such as spreading of virus/worm/Trojan/Bots/Spyware/Ransomware/Cryptominers
6. Attack on servers (Database, Mail and DNS) and Routers
7. Identity Theft, spoofing and phishing attacks
8. Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks
9. Attacks on Critical infrastructure, SCADA systems and Wireless networks
10. Attacks on Applications such as E-Governance, E-Commerce etc.
11. Data Breach
12. Data Leak
13. Attacks or incident affecting Digital Payment systems
14. Attacks through Malicious mobile Apps
15. Fake mobile Apps
16. Unauthorised access to social media accounts
17. Attacks or malicious/ suspicious activities affecting Cloud computing systems/servers/software/applications
18. Attacks or malicious/suspicious activities affecting systems/ servers/ networks/ software/ applications related to Big Data, Block chain, virtual assets, virtual asset exchanges, custodian wallets, Robotics, 3D and 4D Printing, additive manufacturing, Drones
19. Attacks or malicious/ suspicious activities affecting systems/ servers/ software/ applications related to Artificial Intelligence and Machine Learning

CERT-In Report Content Requirements

• Organization details: Name, GSTIN, sector, contact person
• Incident details: Type, description, affected systems
• Timeline: Date/time of occurrence and detection
• Impact assessment: Systems affected, data compromised
• Actions taken: Immediate containment and response measures
• Artifacts: Logs, indicators of compromise (as available)

2.4 Sector-Specific: RBI and SEBI Requirements

Financial sector entities face additional reporting obligations to RBI and/or SEBI depending on their regulatory status. These requirements operate alongside CERT-In and DPDPA obligations.

RBI Cyber Security Framework Requirements

RBI's Cyber Security Framework for Banks (2016) and subsequent circulars mandate:

RBI Report Must Include

• Incident classification: Category and severity assessment
• Customer impact: Number of customers affected, data types
• Financial impact: Actual or potential monetary loss
• Root cause (preliminary): Initial assessment of how breach occurred
• Containment status: Whether incident is contained
• Recovery timeline: Expected service restoration

SEBI Disclosure Requirements

For listed entities, SEBI's LODR Regulations require disclosure of material events:

SEBI Circular on Cyber Security (SECC/HO/CFD/CMD/CIR/P/2018/77)

• Immediate disclosure: Material cyber incidents to stock exchanges within 24 hours
• Board reporting: Quarterly report to Board on cyber incidents
• Annual disclosure: Cyber security posture in annual report
• Stock exchange notification: Per LODR Regulation 30

2.5 Developing a Notification Strategy

Effective breach notification requires pre-planned strategy, coordination across stakeholders, and clear decision-making protocols. Build your notification framework before an incident occurs.

Notification Decision Matrix

Key Principles for Notification Drafting

1. Accuracy over speed: Do not speculate. State what you know, what you are investigating, what is unknown.
2. Consistency across regulators: Facts must be consistent in all notifications - regulators compare notes.
3. Legal review mandatory: All notifications should be reviewed by legal counsel before submission.
4. Document everything: Maintain records of when notifications were sent, to whom, and their content.
5. Update obligations: Initial notification is not final - provide updates as investigation reveals more.

Part 2 Quiz: Test Your Knowledge