A data breach is no longer just a cybersecurity issue. When personal or confidential information is compromised, a company may face immediate legal and regulatory obligations.

In India, these obligations arise under frameworks including the Information Technology Act, 2000, CERT-In Directions, and the Digital Personal Data Protection Act, 2023 (DPDP Act).

1. Contain and Investigate the Breach

The first step is to contain the breach, secure affected systems and determine what information has been compromised.

Companies should also preserve relevant logs and digital evidence, as these may be required for regulatory investigations or legal proceedings.

2. Report to CERT-In

Under the CERT-In Directions, specified cyber incidents, including data breaches and data leaks, must generally be reported to CERT-In within six hours of noticing the incident or being informed of it.

A company should therefore have an internal incident-response mechanism capable of escalating a breach quickly.

3. Notify Under the DPDP Framework

The DPDP Act requires Data Fiduciaries to take reasonable security safeguards to prevent personal data breaches.

Where a personal data breach occurs, the Data Fiduciary is required to notify the Data Protection Board and affected Data Principals in accordance with the prescribed procedure.

The DPDP Rules, 2025 further specify the manner and information required for such notifications.

4. Review Third-Party Responsibility

A breach may occur through a cloud provider, software platform or other Data Processor. However, outsourcing data processing does not automatically remove the company's compliance responsibilities.

Contracts with vendors should therefore clearly address data security, breach reporting, cooperation and liability.

5. Preventive Measures Matter

Legal compliance does not begin after a breach. Companies should maintain appropriate technical and organisational safeguards, including access controls, authentication, employee awareness, monitoring and incident-response procedures.

Conclusion

A data breach can trigger multiple legal and regulatory obligations simultaneously. Companies must therefore be prepared to respond quickly, preserve evidence, make the required notifications and take corrective measures.

The best legal response to a data breach begins well before the breach occurs.