1 November 2026 • 6 min read
Most SaaS founders have heard that India has a six-hour rule for cyber incidents. Fewer have read what it asks for. This page walks through the directions the Indian Computer Emergency Response Team (CERT-In) issued on 28 April 2022 and the FAQs it published in May 2022, with a focus on what a small software company needs in place: a reporting path, a contact person, synchronised clocks and a log archive.
CERT-In is the national agency for cyber incident response under the Information Technology Act, 2000. On 28 April 2022 it issued directions under section 70B(6) of that Act. They apply to "service providers, intermediaries, data centres, body corporate and Government organisations". A SaaS company incorporated in India is a body corporate. The directions said they would take effect 60 days after issue.
CERT-In's FAQs address foreign companies too. They say the directions are "applicable to any entity whatsoever, in the matter of cyber incidents and cyber security incidents". A foreign SaaS vendor with Indian users should assume the reporting duty can reach it. The FAQs also say that service providers without a physical presence in India, if they offer services to users in the country, need to name a point of contact.
The core duty is one sentence: report the incidents listed in the directions' Annexure I to CERT-In "within 6 hours of noticing such incidents or being brought to notice about such incidents". The report can go by email, phone or fax; the directions give an incident reporting mailbox, incident@cert-in.org.in.
The clock does not wait for you to know the cause. CERT-In's FAQ says that if you do not yet have everything the reporting form asks for, you give what is available at the time and send more later within a reasonable time.
The Annexure lists twenty types of incident. The ones a SaaS business is most likely to meet are:
The FAQ narrows the six-hour clock to the cases that matter most. An Annexure I incident must be reported within six hours when it meets one of these tests: a severe incident on public information infrastructure, a data breach or data leak, a large-scale or frequent incident such as intrusion into a computer resource or website, or an incident affecting the safety of human beings. Treat any data breach or leak as inside the six-hour window.
Three further duties come with the reporting rule.
Clocks. All ICT system clocks must be synchronised to the Network Time Protocol servers of the National Informatics Centre or the National Physical Laboratory, or to servers traceable to them. Companies with infrastructure in several countries may use another accurate standard time source, provided it does not deviate from those two.
Logs. The directions require entities to "mandatorily enable logs of all their ICT systems and maintain them securely for a rolling period of 180 days" within Indian jurisdiction, and to hand them to CERT-In with an incident report or when ordered. The FAQ is looser on location: it says logs may be stored outside India as long as the entity can produce them to CERT-In in a reasonable time. It also says a service provider offering services to users in India needs to maintain logs and records of financial transactions in Indian jurisdiction. The two answers do not fit neatly; ask a lawyer how they apply to your hosting setup.
Point of contact. Name a person to deal with CERT-In and send the details to CERT-In in its format (name, designation, organisation, address, email, phone). CERT-In's requests then go to that person, so use a role mailbox that someone watches at night.
If you are a data centre, a virtual private server provider or a cloud service provider, you must also register accurate subscriber details: validated names of customers, period of hire, IP addresses used, the email and IP address and time stamp at onboarding, purpose of hire, validated address and contact numbers, and ownership pattern. These must be kept for 5 years or longer after the registration is cancelled or withdrawn. A SaaS company that sells hosting or sandbox environments to customers should check whether it falls in that group.
The DPDP Rules 2025 add a second breach duty, to the Data Protection Board, from 13 May 2027. The CERT-In rule is already in force, goes to a different agency and has a shorter first clock. One incident may need two reports from you. Plan one internal log of "time we became aware" and send each report from it.
CERT-In says that failing to give the information it asks for, or not complying with the directions, may invite punitive action under section 70B(7) of the IT Act and other laws as applicable. Check with a lawyer how the directions apply to your company before you rely on this page.
No. They start when you notice the incident or are told about it. The FAQ also says organisations must follow reasonable security practices to detect incidents; it does not excuse an incident that sat undetected.
CERT-In's FAQ says the directions apply to any entity whatsoever in the matter of cyber incidents. Foreign providers serving Indian users also need a point of contact. Ask a lawyer how enforcement would work for you.
Yes. The directions allow email, phone and fax, and CERT-In publishes the reporting form and method on its website.
Yes. The FAQ says the directions apply to all entities for reporting a cyber incident, including one that affected data stored in a third party's systems.
Related on this site: incident management for Indian teams.
Nine stories, every morning at 09:15 IST.
Get the brief free →