Navigating Cyber Incident Reporting: India's Stance Amidst Global Frameworks

As of September 25, 2026, the landscape of cybersecurity incident reporting has matured significantly, with India’s frameworks serving as a robust anchor for businesses operating in the country. Indian entities, particularly those handling personal data or operating in critical sectors, must navigate a complex web of domestic regulations while also being mindful of global developments like the EU’s NIS2 Directive and the US SEC’s cyber rules. This analysis will compare these frameworks, highlighting where Indian law stands in relation to its international counterparts.

India’s Multi-Layered Reporting Mandate

India’s primary cybersecurity incident reporting framework is the CERT-In Directions issued in April 2022 under Section 70B(6) of the Information Technology Act, 2000. These directions mandate a broad range of entities—including data centres, cloud service providers, VPN providers, virtual asset service providers, ISPs, and any “body corporate”—to report all cyber incidents within six hours of detection (Rule 3(1)(a)). This extremely stringent timeline applies to a comprehensive list of incidents, from targeted scanning and compromise of critical systems to data breaches and ransomware attacks. Furthermore, these entities are required to maintain logs of all ICT systems for a rolling period of 180 days (Rule 3(1)(c)).

Complementing CERT-In’s broad mandate, the Digital Personal Data Protection Act (DPDPA) 2023 introduces specific obligations for Data Fiduciaries regarding personal data breaches. Section 17(1) of the DPDPA requires Data Fiduciaries to notify the Data Protection Board of India (DPBI) and affected Data Principals in the event of a personal data breach, though the specific timeframe for such notification is to be prescribed by future rules. While CERT-In’s Directions already cover data breaches under its broader incident categories, the DPDPA explicitly introduces the requirement for direct notification to individuals, aligning India with global personal data protection norms.

For the financial sector, the Reserve Bank of India’s Master Directions on IT Governance, Risk, Controls, and Assurance Practices (2023) reinforce and, in some cases, specify CERT-In’s requirements. Section 16.1.1 mandates regulated entities to report “all unusual and / or unauthorised digital / electronic transactions” to RBI and CERT-In within six hours of detection. Section 16.1.2 extends this six-hour window to “all other cyber incidents” to RBI, demonstrating a sector-specific reinforcement of the strict reporting timeline.

EU’s NIS2 Directive: A Phased Approach

The EU’s NIS2 Directive (Directive (EU) 2022/2555), which became effective in October 2024, significantly expands the scope of its predecessor, covering “essential” and “important” entities across a wide array of sectors, including energy, transport, health, digital infrastructure, manufacturing, and food production. Unlike India’s immediate six-hour window for all incidents, NIS2 adopts a phased reporting approach for “significant incidents” (Article 23). Entities must provide an “early warning” within 24 hours of becoming aware of a significant incident, followed by an incident notification within 72 hours (Article 23(3) and (4)). A final report is then required within one month (Article 23(5)). NIS2 also mandates notification to recipients of services if an incident is likely to adversely affect them (Article 23(6)).

Compared to India, NIS2 offers a more structured, albeit longer, reporting timeline for initial notifications. While India’s CERT-In covers a broad range of incidents, NIS2 focuses on “significant” incidents, introducing a materiality threshold that is absent from CERT-In’s general six-hour rule. However, NIS2’s explicit requirement for phased reporting and direct notification to affected service recipients for service-impacting incidents provides a clear framework.

US SEC Cyber Rules: Materiality for Investors

Across the Atlantic, the US Securities and Exchange Commission (SEC) Cyber Rules, effective December 2023 for large filers and June 2024 for smaller filers, target publicly traded companies. These rules, primarily found in Item 1.05 of Form 8-K and Item 106 of Regulation S-K, require disclosure of “material cybersecurity incidents.” A material incident, defined by its potential impact on investors, must be reported within four business days of the company determining its materiality. This determination process itself can take time. Additionally, companies must annually disclose their cybersecurity risk management and strategy in Form 10-K (Item 106 of Regulation S-K).

The SEC rules are notably looser on reporting timelines compared to both India and the EU, as the clock only starts ticking after a materiality determination has been made. Their scope is also narrower, focusing exclusively on publicly traded companies and investor protection, rather than broader cybersecurity resilience or individual data protection. Unlike DPDPA or NIS2, the SEC rules do not directly mandate notification to affected individuals; this is typically covered by other US state-level data breach notification laws.

Key Comparative Aspects

Indian law, particularly the CERT-In Directions and RBI mandates, stands out for its stricter timelines, requiring reporting within six hours of detection for a wide array of incidents, regardless of an explicit materiality threshold. This is significantly tighter than NIS2’s 24/72-hour phased approach for “significant” incidents and the SEC’s four-business-day window post-materiality determination. India’s scope of reportable incidents under CERT-In is also very broad, encompassing virtually any cyber incident, whereas NIS2 and SEC rules introduce thresholds of “significance” or “materiality.”

Regarding the scope of entities, CERT-In’s “body corporate” and DPDPA’s “Data Fiduciary” are broadly applicable, covering a vast range of organizations. NIS2 is sector-specific but covers many critical and important entities, while the SEC rules are narrowly focused on publicly traded companies. India’s DPDPA aligns with NIS2 in mandating notification to affected individuals for personal data breaches, a requirement not directly found in the SEC rules. Furthermore, CERT-In’s specific requirement for 180-day log retention (Rule 3(1)(c)) is a concrete operational mandate not explicitly detailed in the other frameworks.

Practical Takeaway

For Indian businesses, General Counsels, and Data Protection Officers, the primary directive is clear: prioritize rapid incident detection and response capabilities. The six-hour reporting window under CERT-In and RBI mandates is among the strictest globally, necessitating robust internal protocols, clear communication channels, and pre-defined incident response plans. While global frameworks like NIS2 and SEC rules offer insights into phased reporting or materiality thresholds, Indian entities must adhere to the immediate and broad reporting obligations of domestic law. Businesses with global operations must also reconcile these varying timelines and thresholds, potentially adopting the most stringent standard (India’s six hours) as their baseline for initial internal reporting to ensure compliance across jurisdictions. Investing in automation for incident detection and streamlined reporting workflows is no longer a luxury but a necessity for operating effectively in this evolving regulatory landscape.