India. Cybersecurity. Directions
CERT-In Directions 2022CERT-In Directions under section 70B(6) of the IT Act, 2000 relating to information security practices, procedure, prevention, response and reporting of cyber incidents
§1Summary
- Synopsis
Binding directions requiring service providers, intermediaries, data centres, body corporates and government bodies to report specified cyber incidents to CERT-In within six hours of noticing them. They also mandate NTP clock sync, a CERT-In point of contact, 180-day log retention in India, and five-year retention of subscriber records by cloud, VPS, data-centre and VPN providers.
- Key themes
- Unique features
Among the world's shortest incident-reporting windows (6 hours) and covers a broad incident list beyond personal data breaches.
- SaaS relevance
Applies to SaaS and cloud providers serving Indian users regardless of incorporation; logs must be kept within Indian jurisdiction (CERT-In FAQs allow foreign providers to store abroad if produced on demand) and cloud providers must keep validated customer records for 5 years.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- CERT-In within 6 hours of noticing listed cyber incidents
- DPO
- No
- Cross-border transfers
- Logs to be maintained in Indian jurisdiction for 180 days
- Maximum penalty
- IT Act s70B(7): up to 1 year imprisonment and/or fine up to INR 1 lakh
§3Dates
- Key dates
- Adopted
- In force
- Issued 2022-04-28; effective 60 days later; 2022-06-27 extension for MSMEs and for subscriber-validation by data centres, VPS, cloud and VPN providers (to 2022-09-25).
§4Text and authority
- Text
- Authoritative text cert-in.org.in
- Authority
- Indian Computer Emergency Response Team (CERT-In)
§5Where it applies
- Domestic law of
- India
§6Sources and verification
- Sources consulted
- Verification
High confidence.
s70B(7) penalty amount and FAQ position on foreign log storage from general knowledge, not re-verified this session.