Under the DPDP Act, in the event of a personal data breach, a Data Fiduciary is required to inform each affected Data Principal and the Board. The Draft Rules prescribe the manner in which the notification is required to be made (including the time period and the details required to be contained).

Personal data breach is broadly defined under DPDP Act as any unauthorized processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction of or loss of access to personal data, that compromises the confidentiality, integrity, or availability of personal data.

Therefore, Data Fiduciaries are required to report all types of personal data breaches, regardless of the sensitivity of the breach or its impact on the Data Principal.  Under the DPDP Act, neither materiality thresholds nor express timelines have been prescribed for the reporting requirement.

The DPDP Act is not the sole regulation imposing reporting requirement for data breaches. The existing cybersecurity framework also mandates reporting of cybersecurity incidents, which may include personal data breaches, to the Cert-In. In the absence of any conflicting information, both sets of regulations will be applicable.

The Government of India has established and authorized the Cert-In to collect, analyze and disseminate information on cyber incidents, provide forecasts and alerts of cybersecurity incidents, provide emergency measures for handling cybersecurity incidents and coordinate cyber incident response activities. The Information Technology (the Indian Computer Emergency Response Team and Manner of Performing Functions and Duties) Rules, 2013 (Cert-In Rules) along with the Cyber Security Directions impose mandatory notification requirements on service providers, intermediaries, data centers and corporate entities, upon the occurrence of certain cybersecurity incidents.

Cyber security incidents have been defined to mean any real or suspected adverse events, in relation to cybersecurity, that violate any explicitly or implicitly applicable security policy, resulting in:

• unauthorized access, denial or disruption of service;
• unauthorized use of a computer resource for processing or storage of information;
• changes to data or information without authorization.

Under the Cyber Security Directions, the occurrence of the following types of cybersecurity incidents are to be reported:

• targeted scanning / probing of critical networks / systems;
• compromise of critical systems / information;
• unauthorized access of IT systems / data;
• defacement of website or intrusion into a website and unauthorized changes such as inserting malicious code, links to external websites, etc;
• malicious code attacks such as spreading virus / worm / trojan / bots / spyware / ransomware / cryptominers;
• attack on servers such as databased, Mail and DNS and network devices such as routers;
• identity theft, spoofing and phishing attacks;
• denial of service and distributed denial of service attacks;
• attacks on critical infrastructure, SCADA and operation technology systems and wireless networks;
• attacks on applications such as e-governance, e-commerce, etc;
• data breach;
• data leak;
• attacks on internet of things devices and associated systems, networks, software and servers;
• attacks or incident affects digital payment systems;
• attacks through malicious mobile applications;
• fake mobile applications;
• unauthorized access to social media accounts;
• attacks or malicious / suspicious activities affecting cloud computing systems / servers / software / applications;
• attacks or malicious / suspicious activities affecting systems / servers  / networks / software / applications related to Big Data, block chain, virtual assets, virtual asset exchanges, custodian wallets, robotics, 3D and 4D printing, additive manufacturing, drones;
• attacks or malicious / suspicious activities affecting systems / servers / software / applications related to artificial intelligence and machine learning.

These incidents can be reported to Cert-In via (i) email ([email protected]), (ii) phone (1800-11-4949), or (iii) fax (1800-11-6969). The reporting methods and formats are available at www.cert-in.org.in and will be updated from time to time. The compliance obligations under the Cyber Security Directions extend to all entities which have computer systems, networks and / or resources in India, irrespective of whether the entity is incorporated in or outside India.

Data Fiduciaries may review their data breach reporting protocols and assess each incident in accordance with the guidelines outlined in the DPDP Act and the Cert-In Rules to ascertain whether it necessitates reporting under either or both regulatory frameworks.