Cyber Incident Reporting: Navigating India's Evolving Landscape Against Global Benchmarks

The ever-present threat of cyber incidents necessitates robust and timely reporting frameworks. As of August 26, 2026, businesses, especially those operating across borders, face a complex web of obligations. India, with its Digital Personal Data Protection Act (DPDPA), 2023, and existing cybersecurity mandates, serves as a crucial anchor for understanding these requirements, which we will compare against the European Union’s NIS2 Directive and the U.S. SEC’s cyber rules.

India’s Multi-Layered Reporting Regime

India’s cybersecurity incident reporting landscape is primarily governed by the Indian Computer Emergency Response Team (CERT-In) Directions, issued under Section 70B of the Information Technology Act, 2000. These comprehensive directions, effective from April 2022, mandate that all service providers, data centres, body corporates, and government organisations report specific types of cyber incidents to CERT-In within six hours of noticing or becoming aware of them (Direction 3(1)). The scope of reportable incidents is broad, encompassing data breaches, system intrusions, denial-of-service attacks, and more. Furthermore, these directions impose a strict requirement for all entities to maintain logs of all Information and Communication Technology (ICT) systems for a rolling period of 180 days (Direction 3(5)). Non-compliance can lead to penalties under Section 70B(7) of the IT Act, 2000.

Adding another layer, the Digital Personal Data Protection Act (DPDPA), 2023, introduces obligations for Data Fiduciaries regarding personal data breaches. Section 20 of the DPDPA mandates that Data Fiduciaries notify the Data Protection Board of India (DPBI) and affected Data Principals in the event of a personal data breach. While the Act establishes this principle, the specific timelines, thresholds for notification (e.g., whether all breaches or only ‘significant’ ones), and the precise content of such notifications are still anticipated to be detailed in forthcoming rules. This represents a current area where Indian law is silent, awaiting further elaboration.

For regulated entities in the financial sector, the Reserve Bank of India (RBI) Master Directions on IT Governance, Risk, Controls and Operations (2023) impose even stricter requirements. These directions mandate reporting of cyber incidents to the RBI within six hours of detection, in addition to reporting to CERT-In (Para 16.2.2). This makes India’s financial sector one of the most rigorously monitored globally for cyber incidents.

European Union: NIS2 Directive

The EU’s NIS2 Directive (Directive (EU) 2022/2555), which came into force in January 2023 with transposition deadlines for Member States by October 2024, significantly expands and strengthens cybersecurity requirements across the Union. It applies to a wide range of “essential” and “important” entities across critical sectors (listed in Annexes I and II). For significant incidents, NIS2 establishes a multi-stage reporting timeline:

1. An early warning must be submitted to the relevant national CSIRT or competent authority within 24 hours of becoming aware of a significant incident (Article 23(3)). This initial notification should indicate if the incident is suspected to be unlawful or cross-border.
2. A full incident notification must follow within 72 hours of becoming aware, providing an initial assessment of the incident, its severity, and impact (Article 23(3)).
3. A final report is required within one month of the incident notification (Article 23(4)). NIS2 also mandates that entities may be required to inform recipients of their services about significant incidents (Article 23(6)). Penalties for non-compliance can be substantial, reaching up to €10 million or 2% of global annual turnover for essential entities (Article 34).

United States: SEC Cyber Rules

In the United States, the Securities and Exchange Commission (SEC) adopted new rules in July 2023 requiring public companies to disclose material cybersecurity incidents. These rules, primarily found in Item 1.05 of Form 8-K and Item 106 of Regulation S-K (17 CFR Part 229), focus on investor protection. Companies must disclose a material cybersecurity incident within four business days of determining that the incident is material (Item 1.05(a)(3) of Form 8-K). The disclosure must describe the nature, scope, timing, and material impact or reasonably likely material impact of the incident. Unlike CERT-In, the SEC rules are deliberately less prescriptive on technical details to avoid tipping off threat actors, focusing instead on the financial and operational materiality to investors. Companies are also required to disclose their cybersecurity risk management, strategy, and governance (Item 106 of Regulation S-K). The SEC rules do not explicitly mandate notification to affected individuals, leaving this to other state-specific breach notification laws.

Comparative Analysis: Stricter, Looser, or Silent

Comparing these frameworks reveals distinct approaches and priorities:

• Reporting Timeline: India’s CERT-In Directions and RBI Master Directions are demonstrably stricter, demanding incident reporting within a mere six hours of awareness. This contrasts sharply with NIS2’s 24-hour early warning and 72-hour full notification, and the SEC’s more lenient four business days after a materiality determination. The DPDPA, while mandating notification to the DPBI, is currently silent on specific timelines, pending rules.
• Scope and Trigger: CERT-In’s directions apply broadly to virtually all entities and for a wide range of specified incidents upon awareness, making it stricter in its universal applicability. NIS2 applies to “essential” and “important” entities for “significant” incidents, defined by impact criteria. The SEC rules are narrower, targeting publicly traded companies, and require a “materiality” assessment before reporting, which can introduce subjectivity and potentially delay public disclosure. The DPDPA’s trigger is a “personal data breach,” with the definition of ‘significant’ or ‘notifiable’ expected.
• Content of Report: CERT-In typically requires detailed technical information, including IPs, attack vectors, and system logs. NIS2 also seeks comprehensive details on the incident’s nature, severity, and impact. The SEC rules are looser on technical specifics, focusing on the material impact to the company and investors.
• Log Retention: India’s CERT-In Directions are stricter and explicit in mandating 180-day log retention (Direction 3(5)), a requirement not explicitly present in the reporting mandates of NIS2 or the SEC rules, though good practice might dictate it.
• Notification to Individuals: The DPDPA explicitly requires notification to affected Data Principals (Section 20), aligning with global data protection principles. NIS2 may require informing affected service recipients (Article 23(6)). The SEC rules do not have a direct equivalent, relying on other regulations.

Practical Takeaway

For Indian businesses, particularly those with global operations, navigating this landscape requires a sophisticated incident response strategy. The stringent six-hour reporting window to CERT-In (and RBI for financial entities) necessitates immediate detection capabilities and a well-rehearsed internal escalation process. Furthermore, the upcoming DPDPA rules will add another critical layer, requiring separate, potentially parallel, notifications to the DPBI and affected Data Principals for personal data breaches. Companies must develop robust materiality assessment frameworks to comply with SEC rules if publicly traded in the US, and understand the “significance” criteria under NIS2 for their EU operations. A unified, multi-jurisdictional incident response plan that reconciles these differing timelines, scopes, and content requirements is no longer a luxury but a fundamental necessity for effective compliance and risk management.