Skip to content

Lost money to a cyber fraud? Call 1930 now and file at cybercrime.gov.in. The first hour matters.

What to do, step by step →
Cyber Crime Help Desk An initiative from Kramate for Society
Business security 6 min read

Data Breach Response Plan: Template for Indian Organisations

A data breach response plan template for Indian organisations: roles, the first six hours, CERT-In reporting, DPDP notification, evidence and recovery.

By Editorial team, Research and writing · Published
Colleagues around a meeting table reviewing documents and laptops together

In short

  • Two clocks start the moment you know: six hours to report to CERT-In, and the DPDP Act's duty to notify the Data Protection Board and affected individuals.
  • Name the incident response team now, with deputies and personal phone numbers; the plan fails if the first hour is spent finding people.
  • Contain before you investigate, but preserve before you contain: snapshot, log export and a timeline note come before the reset.
  • Decide in advance who speaks to customers, regulators, police and press, and in what order. Silence and over-promising both cost more than the breach.
  • Write the plan as a fill-in template with blanks, test it once a year with a tabletop, and keep a printed copy; the breach may take your email down.

Who this is for: Founders, CISOs, IT heads, compliance officers and legal counsel at Indian companies, hospitals, schools, NBFCs and startups that hold personal data and must comply with CERT-In directions and the DPDP Act.

A customer calls to say their details are being quoted back to them by a scammer. A developer notices a database export nobody ordered. A ransom note appears on a server. Whatever the first sign, the next six hours now carry a legal clock in India, and the organisations that come out of a breach intact are the ones that had written down, in advance, who does what.

This is a data breach response plan template for Indian organisations: the sections your plan needs, what goes in each, and the two regulatory clocks that make a generic international template insufficient here. Copy the headings, fill the blanks, print it.

Why an Indian data breach response plan has two clocks

The first clock is CERT-In's. Under the directions issued on 28 April 2022, listed incident types, which include data breaches and data leaks, must be reported to CERT-In within six hours of being noticed. The full detail of who must report and how is in our guide to CERT-In incident reporting.

The second clock is the DPDP Act's. Section 8(6) of the Digital Personal Data Protection Act 2023 requires a data fiduciary to notify the Data Protection Board and each affected individual of a personal data breach, in the manner the rules prescribe. The Act allows penalties of up to ₹200 crore for failing to notify and up to ₹250 crore for failing to maintain reasonable security safeguards. The DPDP compliance checklist covers the obligations that should already be in place.

A plan written for GDPR or a US state law will miss both. Write your own. Sector-specific starting points for hospitals, schools and NBFCs are in our three sector playbooks.

Section 1: the incident response team

This section is a table, filled in today, with personal mobile numbers, because a breach may take your corporate email and directory down.

RoleDecidesName / deputy
Incident leadDeclares an incident; can take any system offline; owns the timeline________ / ________
Technical leadContainment, evidence capture, eradication, recovery________ / ________
Legal and complianceCERT-In report, DPDP breach notification, police complaint, contracts________ / ________
CommunicationsCustomer notices, staff updates, press, social media________ / ________
HRInsider questions, staff welfare, access revocation________ / ________
External partnersIR firm, counsel, insurer, cloud provider contacts________

Add a line for who can authorise spending during an incident without a purchase order, and a line for who informs the board. If you have cyber insurance, the insurer's hotline belongs here, and many policies require you to call them before engaging outside help.

Section 2: the first six hours

Write this as a numbered checklist the incident lead reads aloud. The order matters: preserve, then contain, then report.

Hour 0 to 6

  • Open an incident log: a shared document or, if systems are down, a notebook. Every action, time-stamped, with who did it.
  • Preserve evidence before changing anything: snapshot affected virtual machines, export logs from the firewall, mail platform, cloud console and endpoint tools, photograph screens. Do not wipe, reinstall or "clean" yet. Our evidence preservation guide explains why this order matters for any later legal use.
  • Contain: isolate affected machines from the network, revoke exposed credentials and API keys, block the attacker's addresses, disable compromised accounts. Containment is reversible; wiping is not.
  • Assess what data is involved: which systems, which tables, which categories of personal data, how many individuals, roughly. "Unknown" is an acceptable interim answer; "nothing" rarely is.
  • File the CERT-In report within six hours of noticing. The form asks for what you know; it does not require a completed investigation. Note the acknowledgement.
  • Decide whether to call 1930 (money has moved) and whether a police complaint is needed now (extortion, ransomware, insider theft). Instructions for the complaint are in how to report cyber crime.
  • Brief the leadership and the communications owner. Nobody outside the team speaks publicly yet.

Section 3: the DPDP breach notification

Your plan should contain a draft notice to affected individuals and a draft submission to the Data Protection Board, with blanks for the facts. The notice to individuals should say plainly what happened, what data was involved, what you have done, what they should do (change passwords, watch for calls quoting their details, never share an OTP), and how to contact you. Avoid legal language; the people reading it are the customers whose trust you are trying to keep.

Check the DPDP Rules in force for the exact timelines and format at the time of the incident, and record in the log when each notification was sent. Keep a copy of every notice; the Board may ask for it.

Section 4: the communication plan

Decide the order of audiences in advance: regulators and police, then affected individuals, then staff, then partners and vendors, then the public if the breach is public. Draft three templates: a holding statement ("we are aware of an incident and investigating; we will update by [time]"), a customer notice, and a staff note that tells employees what to say if a customer calls. Nominate one spokesperson. Tell staff not to post about the incident on LinkedIn or WhatsApp.

Prepare for the follow-on scam: once a breach is public, fraudsters call affected customers posing as the company, the bank or the police. Your customer notice should warn about this explicitly and say that you will never ask for an OTP or payment by phone.

Section 5: eradication and recovery

With evidence preserved and the attacker locked out, rebuild from known-good backups, patch the entry point, rotate every credential that could have been exposed, and monitor for the attacker's return for at least 30 days. For ransomware specifically, the detailed sequence is in our ransomware playbook. For an insider, the legal and HR steps run in parallel and are covered in insider data theft: the legal and technical response.

Section 6: the post-incident review

Within two weeks of closure, the team meets for a no-blame review: what the timeline shows, what worked, what the plan got wrong, which controls would have prevented or shortened the incident. The output is a short written report and a dated list of changes with owners. CERT-In may request a follow-up report, and the review doubles as the material for it.

Update the plan the same week. A plan that is not revised after an incident is a plan that will fail the same way twice.

Testing the plan before you need it

Run a two-hour tabletop exercise every year: hand the team a scenario (a leaked customer database being sold online, say) and walk through the plan hour by hour. The gaps appear quickly: a deputy who left the company, a log that was never retained for the 180 days CERT-In expects, a backup nobody has restored. The incident response foundations programme includes a tabletop built for Indian regulatory timelines.

CERT-In's own advisories and incident reporting pages are the reference for the current form and contact details; store them in the plan, not in someone's browser bookmarks.

Next step: fill in Section 1 today. A team table with real names and mobile numbers, printed and pinned, is worth more than the rest of the document combined. If you want the full template reviewed against your sector's rules, or a tabletop run with your team, our incident response service does both.

Frequently asked questions

Does every data breach have to be reported to CERT-In?

The April 2022 CERT-In directions list the incident types that must be reported within six hours of noticing them, and data breaches and data leaks are on that list. The duty applies to service providers, intermediaries, data centres, body corporates and government organisations. When in doubt, report; under-reporting carries penalties and over-reporting does not.

What does the DPDP Act require after a breach?

Section 8(6) of the DPDP Act 2023 requires a data fiduciary to inform the Data Protection Board and each affected individual of a personal data breach, in the form and manner prescribed by the rules. The rules set the timelines and content; check the current rules text, because penalties for failing to notify can reach ₹200 crore.

Should we tell the police?

If the breach involves theft, extortion, ransomware or an insider, yes. File on cybercrime.gov.in or at the cyber police station, and call 1930 if money has moved. A police complaint also helps when you later need to show customers, insurers and the Board that you acted properly.

Who should be on the incident response team?

An incident lead with authority to take systems offline, a technical lead, a legal or compliance owner, a communications owner, and an HR representative if staff may be involved. Each needs a named deputy. For small organisations the same person may hold two roles, but no role may be unassigned.

Can we handle a breach without external help?

Small, contained incidents, yes. If data has left your network, if ransomware is involved, if the attacker may still have access, or if you cannot establish what was taken, bring in an incident response firm early. The cost of a wrong early decision, such as wiping the evidence or paying a ransom, usually exceeds the cost of advice.

If you want help with this

  • Incident response and digital forensics · Ransomware, a compromised mailbox, a data leak or an insider walking out with the database. We contain first, investigate properly, handle the CERT-In and DPDP reporting, and leave you with evidence that holds up.
  • DPDP Act 2023 compliance · A practical path to compliance with the Digital Personal Data Protection Act 2023 and its rules, from gap assessment and consent design to breach notification planning and a DPO you can call.
  • Incident response and SOC analyst foundations · training · A four-week part-time course for IT staff moving into security, covering log analysis, alert triage, phishing and malware investigation, incident handling, and CERT-In reporting, with a lab every week.
Talk to us
E

Written by

Editorial team

Research and writing

Keep reading