Cyber-Attack Response: Legal Priorities in the First 24 Hours

The legal priorities arising in the first 24 hours of a cybersecurity incident: evidence preservation, internal escalation, the regulatory clocks that start, and continuity of operations.

In Short

A cyber-attack is not only an IT incident but also a legal and regulatory event. Where the incident falls within a category listed in the CERT-In Directions, it must be reported within six hours of being noticed. During the first 24 hours, organisations should preserve electronic evidence, establish incident governance, assess reporting obligations under the IT Act 2000 and the DPDP Act 2023, review contractual commitments and ensure that communications are legally coordinated.

A cyber-attack is no longer viewed solely as an information technology incident. For most organisations, it is simultaneously a legal, regulatory and governance event that may trigger obligations under multiple statutory frameworks, contractual arrangements and sector-specific regulations from the moment the incident is discovered. The decisions taken during the first twenty-four hours often determine not only how effectively the organisation contains the attack, but also how regulators, courts, insurers and commercial counterparties evaluate its response.

India’s cyber incident framework is built around the Information Technology Act, 2000, which establishes the statutory basis for cyber security governance and designates the Indian Computer Emergency Response Team (CERT-In) under Section 70B as the national agency responsible for coordinating cyber incident response. Acting under these statutory powers, CERT-In’s Directions under Section 70B prescribe mandatory requirements relating to the reporting of specified cyber incidents and other information security practices. (India Code)

The legal landscape has expanded further with the enactment of the Digital Personal Data Protection Act, 2023, (DPDP) Act, 2023, which establishes a dedicated framework governing the processing of digital personal data and introduces additional obligations where a cyber incident results in a personal data breach. Depending on the nature of the incident, organisations may therefore need to consider cybersecurity reporting obligations alongside data protection requirements, sector-specific regulatory frameworks, contractual notification clauses and, in appropriate cases, criminal law implications.

Importantly, Indian law does not prescribe a single incident response model applicable to every organisation. The legal obligations arising from a cyber-attack depend on factors including the type of incident, the systems affected, whether personal data has been compromised, the sector in which the organisation operates and the contractual commitments it has undertaken. Consequently, legal assessment should begin alongside, rather than after, the technical investigation.

This article examines the principal legal priorities organisations should address during the first twenty-four hours following the discovery of a cyber-attack. It focuses on the legal issues that most significantly influence regulatory compliance, evidentiary integrity, contractual rights and future dispute resolution under Indian law.

1. Why the First 24 Hours Matter

The first twenty-four hours following the discovery of a cyber incident are often the most legally significant. During this period, organisations must make critical decisions while operating with incomplete information. Delays in preserving evidence, identifying applicable reporting obligations or establishing appropriate governance may increase regulatory exposure even where the underlying cyber-attack could not reasonably have been prevented.

One of the most important legal considerations is that statutory obligations are not necessarily dependent upon completion of the forensic investigation. Under Section 70B of the Information Technology Act, CERT-In is empowered to issue directions requiring specified entities to report designated categories of cyber incidents and provide information necessary for cyber incident response. Where a reportable incident arises, those Directions require it to be notified within six hours of being noticed or brought to the organisation’s notice — a window that runs from awareness, not from confirmation of cause or scope, and one considerably shorter than the twenty-four hours this article addresses. These powers form the foundation of India’s national cyber incident reporting regime.

The first day should therefore be viewed as a period of legal assessment rather than merely technical containment. In practical terms, organisations should focus on five parallel objectives:

• preserving electronic evidence before it is altered or overwritten;
• establishing an incident governance structure involving legal, technical and management functions;
• determining whether statutory reporting obligations have been triggered;
• reviewing contractual and sector-specific obligations; and
• maintaining accurate documentation of significant decisions and communications.

These priorities are closely interconnected. For example, evidence preserved during the initial response may later support regulatory investigations, insurance claims, civil proceedings or criminal prosecutions. Similarly, the information gathered during the forensic investigation will inform decisions relating to CERT-In reporting, personal data breach assessments and communications with customers, regulators and commercial counterparties.

Equally important is recognising that cyber incidents rarely remain confined to information technology departments. Significant attacks may require coordinated action by legal advisers, compliance teams, senior management, information security personnel, privacy officers and external forensic specialists. A structured governance framework enables these functions to operate cohesively while ensuring that legal obligations are considered alongside operational recovery.

Ultimately, the first twenty-four hours establish the foundation for the organisation’s entire incident response. A disciplined approach that integrates legal assessment with technical investigation places the organisation in a stronger position to satisfy regulatory requirements, preserve evidentiary integrity and manage the broader legal consequences of the cyber-attack.

This blog is a part of our Dispute Resolution practice.

Priority 1 – Preserve Evidence and Establish Governance

The immediate objective following the discovery of a cyber-attack is often to contain the threat and restore business operations. While these operational priorities are important, organisations should ensure that containment measures do not compromise the legal position they may later need to defend before regulators, courts, insurers or law enforcement authorities. During the first twenty-four hours, preserving electronic evidence and establishing an appropriate governance framework are as important as technical remediation.

Preserve Electronic Evidence Before Remediation

Cyber incidents generate electronic records that may become central to regulatory investigations, civil proceedings and criminal prosecutions. System logs, firewall records, cloud audit trails, authentication logs, email communications, endpoint telemetry and forensic images frequently provide the evidence needed to reconstruct how the attack occurred, identify the affected systems and determine whether data was accessed or exfiltrated.

The evidentiary significance of these records is recognised under the Bharatiya Sakshya Adhiniyam, 2023, which governs the admissibility of electronic records in legal proceedings. Although questions of admissibility generally arise during litigation, organisations should begin preserving electronic evidence immediately after detecting an incident to maintain its integrity and authenticity.

In practice, this means avoiding actions that unnecessarily alter or overwrite affected systems before appropriate forensic preservation has taken place. Routine operational activities—including rebuilding servers, restoring backups or allowing automated log rotation—may permanently destroy evidence that later becomes relevant to determining regulatory obligations or pursuing legal remedies.

Equally important is maintaining a documented chain of custody. Organisations should record when evidence was collected, who handled it, where it has been stored and any subsequent transfers to forensic specialists or investigating authorities. Such documentation assists in demonstrating that electronic records have remained reliable throughout the investigation.

Activate Incident Governance

A cyber-attack should not be managed exclusively by the information technology function. It is a multidisciplinary incident requiring coordinated decision-making across legal, technical, compliance and business teams.

An effective governance structure should be established as soon as the incident is identified. Depending on the organisation’s size and regulatory profile, the incident response team should ordinarily include representatives from:

• information security and information technology;
• legal;
• compliance and risk management;
• privacy or data protection;
• senior management; and
• corporate communications.

Where the incident is significant, external legal counsel and digital forensic specialists may also need to be engaged at an early stage.

The purpose of this governance structure is to ensure that decisions relating to evidence preservation, regulatory reporting, contractual notifications and public communications are coordinated rather than taken independently by different functions.

Organisations should also begin maintaining a contemporaneous decision log recording the chronology of the incident, information available at each stage, key decisions taken, the reasons supporting those decisions and the individuals responsible. Such records frequently become important during regulatory enquiries and subsequent litigation because they demonstrate that the organisation responded in a structured and reasonable manner.

The first twenty-four hours rarely provide complete certainty regarding the scope of the attack. Effective governance therefore requires decisions to be reviewed as additional forensic findings emerge, while ensuring that the organisation’s legal obligations continue to be assessed alongside its operational response.

Priority 2 – Assess Regulatory Reporting Obligations (CERT-In and DPDP)

Once the incident has been stabilised and appropriate governance arrangements are in place, the organisation should assess whether the cyber-attack triggers any statutory reporting obligations. Reporting should not be viewed as a single compliance exercise. Depending on the nature of the incident and the organisation’s regulatory profile, obligations may arise under the Information Technology Act, the Digital Personal Data Protection framework and sector-specific regulations.

Reporting to CERT-In

India’s national cyber incident reporting regime is established under Section 70B of the Information Technology Act, 2000, which designates the Indian Computer Emergency Response Team (CERT-In) as the national agency responsible for responding to cybersecurity incidents. Exercising its statutory powers, CERT-In has issued binding Directions under Section 70B prescribing the categories of reportable cyber incidents and the obligations applicable to service providers, intermediaries, data centres, body corporates and government organisations.

The first legal question is therefore whether the incident falls within one of the reportable categories identified in the CERT-In Directions. Incidents such as ransomware attacks, unauthorised access, malware infections, website compromise, denial-of-service attacks and data breaches commonly require careful assessment against the reporting framework.

Importantly, organisations should not wait until the forensic investigation has concluded before considering their reporting obligations. Initial notifications should be based on the facts reasonably known at the time, with further updates provided if subsequent investigations materially alter the understanding of the incident.

In addition to incident reporting, the CERT-In Directions require organisations to preserve specified logs and technical information for prescribed periods. Evidence preservation should therefore be coordinated with regulatory compliance to ensure that information required by CERT-In remains available throughout the investigation.

Assessing Personal Data Breach Obligations

A separate assessment should be undertaken to determine whether the incident has resulted in a personal data breach. Not every cyber-attack compromises personal data. For example, a denial-of-service attack affecting system availability may not engage India’s data protection framework, whereas unauthorised access to customer or employee information may do so.

The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 establish the legal framework governing personal data breaches, including notification obligations to the Data Protection Board of India and affected Data Principals, where applicable. Organisations should therefore determine, at the earliest opportunity, whether personal data has been accessed, disclosed, altered, lost or otherwise processed without authorisation. (India Code)

This assessment should address:

• the categories of personal data involved;
• the approximate number of affected individuals;
• whether sensitive business information has also been compromised;
• the likely risks to affected Data Principals; and
• whether notification obligations have been triggered under the applicable legal framework.

Coordinating Multiple Reporting Obligations

Compliance with one reporting framework does not discharge obligations under another. An organisation may simultaneously need to consider:

• reporting to CERT-In;
• notification under the DPDP framework;
• sector-specific reporting requirements (for example, those issued by the RBI or SEBI);
• contractual notification obligations; and
• reporting requirements under cyber insurance policies.

Accordingly, regulatory reporting should be coordinated through the incident governance structure established during the initial response. Legal, technical and compliance teams should ensure that all notifications are factually consistent, distinguish confirmed findings from preliminary assessments and are updated as additional information becomes available.

A structured reporting process enables organisations to meet statutory obligations while reducing the risk of inconsistent communications or avoidable regulatory scrutiny.

Priority 3 – Review Sector-Specific and Contractual Obligations

Compliance with the general cyber incident reporting framework is only one aspect of an organisation’s legal response. Depending on the sector in which it operates and the contractual commitments it has undertaken, additional notification and governance obligations may arise independently of the Information Technology Act and the DPDP framework. These obligations should be identified during the first twenty-four hours to avoid missed deadlines and preserve contractual rights.

Assess Sector-Specific Regulatory Requirements

Organisations operating in regulated sectors should determine whether the cyber incident triggers reporting or supervisory obligations under the applicable regulatory framework.

For example:

• Banks, NBFCs, payment system operators and other RBI-regulated entities should review the applicable cybersecurity and operational resilience directions issued by the Reserve Bank of India.
• Listed entities, stock exchanges and securities market intermediaries should assess whether obligations arise under the Securities and Exchange Board of India cybersecurity framework or the SEBI (Listing Obligations and Disclosure Requirements) Regulations, where the incident constitutes a material event.
• Insurers and insurance intermediaries should consider applicable cybersecurity and governance requirements issued by the Insurance Regulatory and Development Authority of India.
• Entities operating within GIFT IFSC should review technology risk management and cybersecurity requirements issued by the International Financial Services Centres Authority.

The applicable obligations depend on the entity’s regulatory status rather than the cyber incident itself. Accordingly, organisations should identify every regulator exercising jurisdiction over their business before determining whether additional reporting or supervisory engagement is required.

Review Commercial Contracts

A cyber-attack may also activate obligations contained in customer agreements, outsourcing arrangements, cloud service contracts, confidentiality agreements and service level agreements. For foreign companies using an Indian IT or BPO vendor, the incident-notice and security terms that the outsourcing contract itself should contain are covered in what an outsourcing contract with an Indian vendor must cover.

Legal teams should review whether contracts require notification where the incident:

• affects service availability;
• compromises customer or confidential information;
• interrupts business operations;
• involves third-party infrastructure; or
• results in a breach of agreed security obligations.

These contractual obligations operate independently of statutory reporting requirements. A cyber incident that does not require notification to a regulator may nevertheless require disclosure to a customer under the terms of a commercial agreement.

Consider Cyber Insurance

Cyber insurance policies frequently impose procedural obligations that arise immediately after an incident is discovered. Policyholders may be required to notify the insurer within a specified timeframe, preserve evidence, cooperate with investigations or obtain approval before appointing external forensic experts or incurring certain response costs.

Failure to comply with policy conditions may affect coverage or complicate the claims process. Organisations should therefore review applicable policy wording as part of the initial legal assessment rather than after remediation has begun.

Adopt a Coordinated Approach

Regulatory obligations, contractual commitments and insurance requirements often overlap. Rather than managing each obligation independently, organisations should maintain a central register identifying:

• applicable notification requirements;
• responsible personnel;
• reporting deadlines;
• communications issued; and
• follow-up actions.

A coordinated approach reduces the risk of inconsistent communications and demonstrates a structured governance process if the organisation’s response is subsequently scrutinised.

Priority 4 – Manage Communications and Consider Law Enforcement Engagement

Once the organisation has identified its principal legal obligations, attention should turn to managing communications and determining whether engagement with law enforcement authorities is appropriate. Communications made during the first twenty-four hours frequently become part of the evidentiary record and may later be examined during regulatory investigations, litigation or insurance claims. They should therefore be accurate, consistent and based on verified information.

Coordinate Internal and External Communications

Information available immediately after a cyber-attack is often incomplete. Forensic investigations continue to evolve, systems may remain unavailable and the full extent of any data compromise may not yet be known. Organisations should therefore avoid making definitive public statements before the facts have been established.

All significant communications—including notifications to regulators, customers, insurers, business partners and employees—should be coordinated through the incident response team and reviewed by legal advisers where appropriate.

As a general principle, communications should:

• distinguish verified facts from preliminary findings;
• avoid attributing responsibility before investigations are complete;
• refrain from admitting liability unless legally advised;
• explain where investigations remain ongoing; and
• remain consistent across all stakeholders.

Maintaining copies of notifications, media statements, customer communications and internal announcements also assists in demonstrating transparency and supports future regulatory enquiries.

Consider Reporting to Law Enforcement

Many cyber-attacks involve conduct that may constitute criminal offences, including unauthorised access to computer systems, ransomware, financial fraud, identity theft or theft of confidential information.

Whether law enforcement should be involved depends on the circumstances of the incident. Factors that may support engagement include:

• significant financial loss;
• extortion or ransomware demands;
• theft of sensitive information;
• organised or repeated attacks;
• insider misconduct; or
• incidents affecting critical business operations.

Reporting to law enforcement is distinct from reporting to CERT-In or sector-specific regulators. Each serves a different legal purpose and should be assessed independently.

Where law enforcement is engaged, organisations should preserve relevant electronic evidence, maintain a documented chain of custody and coordinate requests for information through the incident response team. Internal investigations should continue in parallel so that regulatory, contractual and operational obligations are addressed alongside any criminal investigation.

Address Cross-Border Considerations Early

Many cyber incidents involve international cloud providers, overseas service providers or multinational operations. Organisations should therefore identify any cross-border elements during the initial response, including:

• overseas hosting environments;
• foreign customers or employees;
• international outsourcing arrangements;
• cross-border data processing; and
• operations within multiple jurisdictions.

For organisations operating across the India–UAE corridor, compliance with Indian law does not necessarily satisfy obligations arising under the applicable UAE legal framework. The UAE’s onshore, DIFC and ADGM regimes each maintain separate legislative and regulatory structures. Identifying the applicable jurisdiction early enables organisations to coordinate legal advice, preserve evidence across borders and avoid inconsistent regulatory reporting.

Ultimately, effective communications and timely legal coordination help organisations manage immediate operational challenges while protecting their position in future regulatory, contractual and judicial proceedings.

Common Legal Mistakes During the First 24 Hours

The legal consequences of a cyber-attack often depend as much on the organisation’s response as on the incident itself. Regulators, insurers and courts frequently examine whether the organisation acted promptly, preserved evidence, complied with reporting obligations and exercised appropriate governance during the initial response. The following mistakes are among the most common sources of avoidable legal exposure.

Delaying Legal Involvement

Organisations often treat cyber incidents as purely technical events, involving legal advisers only after systems have been restored or external communications have been issued. This approach increases the risk of missed reporting deadlines, inconsistent communications and inadequate evidence preservation. Legal assessment should begin alongside the technical investigation, not after it.

Failing to Preserve Electronic Evidence

Operational teams may prioritise restoring systems without first preserving logs, forensic images or other electronic records. Rebuilding servers, restoring backups or allowing automated log rotation to continue may permanently destroy evidence required for regulatory investigations, civil proceedings or criminal prosecutions. Preservation measures should therefore precede significant remediation wherever reasonably practicable.

Treating CERT-In Reporting as the Only Legal Obligation

Reporting an incident to CERT-In does not discharge obligations arising under the Digital Personal Data Protection Act, 2023, sector-specific regulatory frameworks, commercial contracts or cyber insurance policies. Each reporting regime should be assessed independently. Organisations should maintain a central register of applicable notification requirements and monitor compliance with each obligation.

Overlooking Contractual Commitments

Many organisations focus on statutory obligations while overlooking contractual notification clauses contained in customer agreements, outsourcing contracts, cloud service agreements and service level agreements. Missing contractual notification deadlines may affect indemnity rights, limitation of liability provisions or insurance coverage, even where statutory reporting obligations have been satisfied.

Making Premature Public Statements

In the immediate aftermath of a cyber-attack, the facts are rarely complete. Statements that “no data has been compromised” or “the attackers have been identified” may later prove inaccurate as the forensic investigation develops. External communications should therefore distinguish confirmed facts from preliminary findings and clearly indicate where investigations remain ongoing.

Poor Documentation

A well-documented response is often as important as the response itself. Organisations should maintain contemporaneous records of key decisions, evidence preservation measures, regulatory assessments, notifications and communications. Such documentation assists in demonstrating that the incident was managed in a structured and reasonable manner and may become valuable evidence during regulatory enquiries or litigation.

Viewing the Incident Solely as an IT Problem

A cyber-attack is not merely an information security issue. It may engage obligations under cyber security, data protection, corporate governance, commercial contracts, insurance arrangements and criminal law simultaneously. Organisations that adopt an integrated legal and technical response are generally better positioned to manage regulatory scrutiny and preserve their legal rights.

First 24-Hour Legal Response Checklist

The following checklist summarises the principal legal actions that organisations should consider immediately after discovering a cyber-attack.

This checklist is intended as a practical reference. It should be read alongside the organisation’s incident response plan, sector-specific regulatory requirements and applicable contractual obligations.

Conclusion

The first twenty-four hours following a cyber-attack are often the most consequential from a legal perspective. During this period, organisations must make critical decisions while operating with incomplete information and ongoing operational disruption. Although the technical investigation may continue for weeks or even months, statutory reporting obligations, evidence preservation requirements and contractual commitments may arise immediately.

An effective response requires organisations to recognise that a cyber-attack is not solely an information security incident. It may simultaneously engage the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023, sector-specific regulatory frameworks, commercial contracts and, where criminal conduct is suspected, the criminal justice system. Each of these frameworks serves a distinct purpose and should be assessed independently as part of a coordinated incident response.

A legally defensible response begins with preserving electronic evidence before remediation, establishing a governance structure that integrates legal and technical decision-making, assessing applicable reporting obligations and maintaining accurate records of significant decisions. Organisations should also review contractual notification requirements, coordinate communications with regulators and stakeholders, and identify any cross-border implications at an early stage. These measures not only facilitate regulatory compliance but also strengthen the organisation’s position in any subsequent litigation, insurance claim or regulatory investigation.

As cyber threats continue to evolve in sophistication and frequency, regulatory expectations are increasingly focused not simply on whether an organisation experienced a cyber-attack, but on how it responded. A structured, well-documented and legally informed incident response demonstrates sound governance and helps reduce avoidable legal exposure, even where the underlying attack could not reasonably have been prevented.

Ultimately, the first twenty-four hours should be viewed as the foundation of the organisation’s broader legal strategy. Decisions made during this period frequently determine the quality of evidence available, the effectiveness of regulatory engagement and the organisation’s ability to protect its legal and commercial interests throughout the remainder of the incident response.

Frequently Asked Questions

1. How quickly must a cyber-attack be reported to CERT-In in India?

Within six hours of the incident being noticed or brought to the organisation’s notice. The clock runs from the point of awareness, not from confirmation of the cause, scope or attribution, and it does not pause for the forensic investigation. The report is made on the information reasonably available within the window, with further detail supplied as the investigation develops or as CERT-In requests it. Waiting for certainty is the more common compliance failure of the two, since an incomplete report can be supplemented while a late one cannot be made timely.

2. Which cyber-attacks must be reported to CERT-In in India?

Only incidents falling within the categories annexed to the CERT-In Directions issued under section 70B of the Information Technology Act, 2000. Those categories extend well beyond personal data: ransomware, unauthorised access to IT systems, malicious code attacks, denial of service and distributed denial of service, data breaches and leaks, website defacement, attacks on servers and network infrastructure, identity theft and phishing, fake mobile applications, and attacks on cloud and IoT systems. An organisation that has lost no data may still hold a fully reportable incident. The assessment worth making first is which annexed category the incident falls into, because that determines whether the six-hour clock has already started.

3. Is every cyber-attack a personal data breach under India’s DPDP Act, 2023?

No. A cyber-attack and a personal data breach are distinct concepts. An incident may affect system availability — a denial-of-service attack, for instance — without compromising personal data. The DPDP assessment turns on whether the incident meets the Act’s definition of a personal data breach. Note the timing: the breach notification obligation under Section 8(6) does not commence until 13 May 2027. Organisations must nevertheless assess applicable CERT-In, sector-specific and other existing notification obligations.

4. Should systems be restored immediately after a cyber-attack in India?

Not before relevant electronic evidence has been preserved, wherever that is reasonably practicable. Reimaging a compromised server, restoring from backup or allowing logs to rotate destroys volatile memory, access records and attacker artefacts — usually before anyone has determined whether the incident is reportable, insurable or likely to be litigated. Because a forensic image can be taken and hash-verified in hours while the consequences of its absence run for years, the sequence matters more than the delay. The CERT-In Directions separately require ICT system logs to be enabled and retained for a rolling 180 days within Indian jurisdiction.

5. Does reporting to CERT-In satisfy an organisation’s other legal obligations in India?

No. CERT-In reporting discharges one obligation among several that a single incident can engage. Sector-regulated entities carry parallel duties to the RBI, SEBI, IRDAI or the IFSCA depending on their regulatory status. Commercial contracts frequently impose their own notification requirements with their own deadlines, and a cyber insurance policy may require notice within a specified period and before certain response costs are incurred. Each runs on its own trigger and timeline, and satisfying one says nothing about the others.

6. When should an Indian organisation report a cyber-attack to the police?

Where the incident involves suspected criminal conduct — ransomware or extortion, financial fraud, unauthorised access, identity theft, insider misconduct or theft of confidential information. Cyber-enabled financial fraud can be reported through the National Cyber Crime Reporting Portal or the 1930 helpline, and speed matters where funds may still be recoverable. A police complaint is separate from CERT-In reporting and does not discharge it; the two serve different purposes and run in parallel.

7. Is a forensic investigation report protected by legal privilege in India?

Not automatically. Privilege attaches to communications with a legal adviser, and a technical report commissioned directly by an internal IT function sits outside that. Whether privilege extends to a forensic report where counsel scoped and instructed the work is not settled in Indian law, and organisations should not assume protection. The practical implication is to decide at the point of commissioning which materials are intended to be privileged and which are being created for operational use, since a single report serving both purposes will usually be treated as neither.

Key Points at a Glance

• The first 24 hours often determine an organisation’s legal and regulatory position.
• Preserve electronic evidence before undertaking significant remediation.
• Activate an incident response team with legal, technical and compliance oversight.
• Assess reporting obligations under the Information Technology Act, 2000, the CERT-In Directions and the Digital Personal Data Protection framework.
• Review sector-specific regulatory, contractual and cyber insurance obligations.
• Coordinate communications with regulators, customers and other stakeholders.
• Consider whether the incident warrants engagement with law enforcement.
• Maintain a contemporaneous record of decisions throughout the response.