A ransomware attack locks a hospital’s records. A fintech finds customer data on a leak site. A company website starts redirecting visitors to a gambling page. In India, each of these sets off the same clock: under CERT-In incident reporting rules, the organisation has six hours from noticing the incident to tell the national cyber agency.
The rule comes from directions issued by CERT-In on 28 April 2022 under section 70B(6) of the Information Technology Act, 2000. They took effect 60 days later, on 27 June 2022. This explainer covers who must report, what counts as an incident, what else the directions require, and what the rule does and does not mean for customers.
Who has to report
The directions apply to “service providers, intermediaries, data centres, body corporate and Government organisations”. In practice that covers almost any company or public body running computer systems in India, from banks and payment apps to e-commerce platforms, telecom operators and cloud providers.
CERT-In, the Indian Computer Emergency Response Team, is the national agency for cyber incidents under section 70B of the Act. The directions say they were issued because the information it needed to analyse incidents was often not available from the organisations involved.
The six-hour rule
Clause (ii) requires these entities to report the incidents listed in Annexure I “within 6 hours of noticing such incidents or being brought to notice about such incidents”. Reports go to incident@cert-in.org.in, by phone on 1800-11-4949 or by fax on 1800-11-6969, using the format CERT-In publishes on its website.
Two points from CERT-In’s FAQs on the directions, released on 18 May 2022, matter in practice:
- The clock starts when the organisation notices the incident or is told about it, not when the attack began. CERT-In expects organisations to have controls in place to detect incidents in the first place.
- An organisation does not need every detail within six hours. It can report what it knows and send the rest “later within reasonable time”.
The FAQs single out the incidents that must meet the six-hour deadline: severe incidents such as denial of service, intrusion or ransomware on public information infrastructure; data breaches and data leaks; large-scale or frequent intrusions into systems or websites; and incidents that affect people’s safety.
What counts as an incident
Annexure I lists 20 types. They include:
| Category | Examples from Annexure I |
|---|---|
| Access and compromise | Targeted scanning of critical networks, compromise of critical systems, unauthorised access to IT systems or data |
| Data | Data breach, data leak |
| Attacks on services | Denial of service and DDoS, attacks on servers, website defacement, attacks on e-governance and e-commerce applications |
| Malware and fraud | Ransomware, spyware, cryptominers, identity theft, spoofing and phishing |
| Payments and finance | Attacks or incidents affecting digital payment systems |
| Apps and accounts | Malicious or fake mobile apps, unauthorised access to social media accounts |
| Newer technology | Attacks on cloud systems, IoT devices, blockchain and virtual asset systems, and AI and machine learning systems |
Source: CERT-In directions of 28 April 2022, Annexure I.
The other duties in the directions
The six-hour rule is the best known, but the directions carry several other obligations:
- Clocks. All systems must synchronise time with the Network Time Protocol servers of the National Informatics Centre or the National Physical Laboratory, or servers traceable to them, so that logs from different systems can be matched.
- Logs. Logs of all ICT systems must be kept securely for a rolling 180 days, within India, and handed to CERT-In with an incident report or on demand. The FAQs give firewall, intrusion prevention, server, VPN and application logs as examples.
- Point of contact. Each organisation must name a person to deal with CERT-In and must comply with CERT-In orders for information within the time set.
- Customer records for hosting and VPNs. Data centres, virtual private server and cloud providers and VPN providers must keep validated customer names, addresses and contact numbers, IP addresses, hire periods and the purpose of hire for five years after the service ends.
- Crypto platforms. Virtual asset service providers, exchanges and custodian wallet providers must keep KYC information and transaction records for five years. Our guide to crypto KYC in India covers the separate anti-money laundering checks.
Failure to provide information or comply with the directions “may invite punitive action” under section 70B(7) of the Act and other applicable laws.
How it sits with the DPDP Act
A personal data breach can trigger two separate duties. The CERT-In report is due within six hours of noticing it. Under the Digital Personal Data Protection Rules, 2025, a data fiduciary must also inform the Data Protection Board and affected people, with detailed information to the Board within 72 hours, once those provisions take effect. Our explainer on the DPDP Act and AI at work sets out that breach timeline.
What it means for customers
The six-hour rule is a duty to inform the government, not the public. It does not require a company to tell you within six hours that your data was exposed, and CERT-In does not handle individual complaints about lost money.
If you are hit by fraud yourself, your own route is different:
- Money lost through a cyber fraud: call 1930 and file at cybercrime.gov.in, as our 1930 complaint guide explains.
- An unauthorised debit from your bank account: report it to the bank at once, because your liability depends on how quickly you report.
- A suspicious call or SMS before any money moves: report it on Chakshu.
Sources
Indian Computer Emergency Response Team (CERT-In), Ministry of Electronics and Information Technology, Directions No. 20(3)/2022-CERT-In under section 70B(6) of the Information Technology Act, 2000, 28 April 2022, including Annexure I. CERT-In, Frequently Asked Questions on the Cyber Security Directions of 28 April 2022, released 18 May 2022 (questions 24, 30 and 37). Effective date of 27 June 2022 as stated in official circulars forwarding the directions. Documents consulted on 15 October 2026.
