Your Business Was Hacked? Legal & Compliance Checklist For Indian Businesses

A cyberattack can expose businesses to financial losses, data breaches, and legal consequences. Understanding the immediate steps, reporting obligations, and legal remedies under Indian law can help businesses respond effectively and protect their operations.

What Should a Business Do Immediately After a Cyberattack?

• Secure affected systems: Isolate compromised devices and restrict suspicious access to prevent further damage or data loss.
• Contact cybersecurity experts: Inform the internal IT team, security professionals, and relevant service providers to investigate the attack.
• Preserve digital evidence: Save system logs, suspicious emails, access records, ransom messages and other potential evidence.
• Identify affected information: Check whether customer data, employee details, financial records, or confidential business documents were accessed.
• Inform management: Notify senior management and appoint a person to coordinate the technical, legal, and business response.
• Avoid destroying evidence: Do not delete logs, wipe affected systems, or make unverified public statements before assessing the incident.

What Legal Obligations Apply When a Business Is Hacked in India?

• IT Act, 2000: Addresses unauthorised access, system damage, and cyber offences under Sections 43 and 66.
• CERT-In Directions, 2022: Require covered entities to report specified cyber incidents within six hours.
• DPDP Act and Rules: Establish personal data protection, security and breach notification requirements, subject to phased commencement.
• Sector-specific obligations: Banking, insurance and telecom businesses may have additional reporting requirements.
• Contractual obligations: Customer, vendor and insurance agreements may impose incident reporting and cooperation duties.
• Incident-specific compliance: Legal obligations depend on the nature of the attack and applicable laws.

Also Read: DPDP Act Explained: A Complete Compliance Guide For Indian Businesses

Does a Business Need to Report a Cyberattack to CERT-In?

Yes, businesses covered by the CERT-In Directions, 2022, must report specified cyber incidents within the prescribed timeline. Reporting requirements depend on the nature of the incident and the applicable directions.

• Covered organisations: The directions apply to specified entities, including service providers, intermediaries, data centres, body corporates and government organisations.
• Six-hour reporting deadline: Reportable cyber incidents must be reported within six hours of noticing them or being informed about them.
• Reportable incidents: These may include ransomware, unauthorised access, website intrusions, data breaches and data leaks, depending on the incident and reporting criteria.
• Submit available information: Businesses should report the information available within the deadline and provide additional details later within a reasonable time, where necessary.
• Maintain system logs: Preserve relevant ICT system logs securely for a rolling period of 180 days within Indian jurisdiction, as required by the directions.
• Separate notification duties: CERT-In reporting does not replace other applicable obligations under data protection laws, sectoral regulations or business contracts.

What Should a Business Do If Customer or Employee Data Is Stolen?

• Identify affected information: Determine whether contact details, identity documents, financial information or account credentials were exposed.
• Investigate the breach: Establish whether personal data was accessed, copied, altered, deleted or published without authorisation.
• Assess notification requirements: Review applicable legal, contractual and regulatory duties before notifying affected individuals or authorities.
• Check DPDP requirements: Rule 7 of the DPDP Rules, 2025, provides for notifying affected individuals without delay and informing the Data Protection Board. However, this rule is scheduled to commence on 13 May 2027.
• Prepare clear communications: Where notification is required, explain the incident, potential consequences, and protective steps individuals can take.
• Avoid blanket assumptions: Not every data breach triggers identical notification requirements. The applicable duties depend on the information affected and the legal framework in force.

Should a Business Inform Its Customers, Employees, Vendors or Insurer?

Yes, businesses may need to notify affected parties depending on their contractual obligations, the nature of the incident, and applicable legal requirements. Communications should be coordinated and accurate.

• Review customer and vendor contracts: Check incident notification deadlines, cooperation clauses and responsibilities under existing agreements.
• Inform employees: Provide instructions about password changes, suspicious messages, and temporary restrictions on affected systems.
• Notify affected customers: Where appropriate or legally required, explain the potential impact and recommend steps to protect their accounts and information.
• Check insurance policies: Review notification deadlines, approved incident-response providers and insurer consent requirements before appointing specialists or incurring expenses.
• Coordinate communications: Ensure messages shared with customers, employees, and business partners are consistent and do not unnecessarily disclose sensitive information.
• Avoid unnecessary delays: Do not postpone legally required notifications simply because the investigation is still ongoing.

What Evidence Should a Business Preserve After Being Hacked?

• System and access logs: Preserve server logs, firewall alerts, email headers, and security monitoring records that may help identify the attack.
• Suspicious communications: Retain phishing emails, malicious links, ransom notes, screenshots and records of unauthorised transactions.
• Business documents: Keep affected contracts, invoices, customer communications and relevant vendor agreements for investigation.
• Incident timeline: Record when the attack was discovered, which systems were affected, who responded and what actions were taken.
• Secure evidence storage: Store evidence with restricted access and maintain records of how it was collected, transferred and handled.
• Forensic assistance: Engage cybersecurity forensic professionals where necessary, particularly when criminal proceedings or insurance claims may follow.

Can a Business File a Police Complaint or Take Legal Action After a Cyberattack?

Yes, businesses can report cyber offences and pursue legal remedies depending on the incident.

• Report cyber offences: Report hacking, fraud, extortion or unauthorised access to the appropriate authorities.
• Document financial losses: Preserve bank statements, transaction records and evidence of damage.
• Choose the reporting channel: Follow the appropriate police or cybercrime reporting procedure.
• Consider contractual remedies: Review vendor agreements for possible breaches or failures.
• Review insurance claims: Check cyber insurance coverage and claim requirements.
• Seek legal advice: Consult a lawyer to assess available remedies and legal options.

What Should a Business Do If Hackers Demand a Ransom?

• Preserve ransom evidence: Save ransom messages, payment instructions, cryptocurrency wallet details, and all communications received from attackers.
• Assess payment risks: Do not make payment decisions without evaluating legal, financial, and operational consequences.
• Seek professional advice: Consult cybersecurity experts and legal advisers to understand recovery options and potential risks.
• Check insurance obligations: Review cyber insurance conditions, notification deadlines, and approval requirements before taking action.
• Explore recovery options: Check whether secure backups can restore operations and whether stolen information remains exposed.
• Avoid payment guarantees: Paying a ransom does not guarantee system recovery or prevent hackers from publishing stolen information.

Who Is Legally Responsible for a Business Data Breach?

• Business responsibility: Liability depends on the organisation's role, applicable laws, security practices and contractual obligations.
• Identify the cause: Assess whether the breach resulted from employee misconduct, compromised credentials, a third-party vendor, or an external attacker.
• Review vendor agreements: Examine confidentiality clauses, data protection obligations and security commitments to identify possible contractual breaches.
• Assess negligence: A business being hacked does not automatically establish negligence or legal liability. The circumstances and security measures adopted must be examined.
• Identify potential claims: Regulators, customers, employees, insurers or contractual partners may raise concerns depending on the incident and applicable obligations.

Your Business Was Hacked: Legal and Compliance Checklist

What Mistakes Should Businesses Avoid After a Cyberattack?

• Deleting digital evidence: Avoid deleting logs or wiping affected systems before preserving relevant evidence for investigation.
• Ignoring reporting deadlines: Do not delay applicable regulatory reporting while waiting for the investigation to finish.
• Relying only on IT teams: Cyberattacks may involve legal, contractual, and regulatory issues requiring coordination with different professionals.
• Making unverified statements: Avoid making unsupported claims about stolen information, affected individuals, or the source of the attack.
• Paying ransom without assessment: Evaluate legal, financial, and operational risks before considering ransom payment.
• Overlooking contractual obligations: Review customer agreements, insurance policies and vendor contracts for notification requirements.
• Ignoring original vulnerabilities: Do not restore compromised systems without addressing the security weaknesses that caused the incident.
• Failing to document actions: Maintain records of decisions, financial losses, communications, and corrective measures taken after the attack.

How Can Businesses Reduce Legal and Cybersecurity Risks After Recovery?

• Conduct a post-incident review: Identify the root cause, affected systems, and security gaps to prevent similar incidents.
• Strengthen access controls: Reset compromised passwords, review permissions, and enable multi-factor authentication across critical accounts.
• Update vulnerable systems: Apply security patches and review website, cloud, and third-party configurations.
• Test recovery procedures: Verify backups and disaster recovery arrangements to ensure business operations can resume safely.
• Improve internal policies: Update incident-response procedures, employee training and vendor security requirements.
• Review legal compliance: Reassess applicable cybersecurity laws, reporting obligations, and contractual controls based on lessons from the incident.

Explore More Legal Guides

• Importance Of Cyber Law
• How to Prevent Cybercrime in India?
• Third-Party Data Sharing & Vendor Data Security Guide For Indian Businesses

Conclsuion

A business cyberattack can lead to financial losses, data exposure and legal consequences. By responding promptly, preserving evidence, meeting applicable reporting obligations and reviewing contractual responsibilities, businesses can manage the impact of an incident more effectively.

Regular security assessments, employee training and proper incident response planning can also help Indian businesses reduce cybersecurity risks and strengthen legal compliance.

Disclaimer: This blog is for general informational and educational purposes only and does not constitute legal or professional advice. Laws may change, so readers should consult a qualified Corporate Lawyer for advice specific to their business and circumstances.