Business
Move quickly on the evidence, carefully on the complaint.
When a departing employee walks off with the customer list, or a vendor's engineer deletes your database, the first days decide whether you have a case or a grievance. Evidence has to be preserved in a way a court accepts, the complaint has to cite the right provisions, and in many cases the DPDP Act and CERT-In directions impose duties on you at the same time. We work alongside your counsel on all three.
- Evidence preservation and forensic analysis with chain of custody from day one
- Complaint and FIR drafting under IT Act sections 43, 66, 66B, 66C, 72 and the BNS, with evidence annexed
- Your own duties mapped: DPDP breach notification, CERT-In reporting, regulator reporting, employee and customer communication
- Response to complaints and notices made against the company, with counsel
Fixed fee for case assessment and evidence work; ongoing matters on a project basis. Advocate fees, where counsel is engaged, are agreed directly with them.
Typical engagement
- Preserve first
- Assess
- Act
- Follow through
Who this is for
- Employers who suspect or have confirmed theft of data, source code or client lists by an employee or contractor
- Companies whose systems were sabotaged or accessed by a former staff member or vendor
- Businesses that have suffered a ransomware, BEC or data breach and need the police complaint done properly
- Companies that have received a police notice, a DPDP complaint or a customer's legal notice about a cyber incident
- HR and legal teams dealing with misuse of company systems, harassment through company accounts or data exfiltration
- Boards and in-house counsel who need a plain explanation of exposure and options
What is included
Case assessment
What happened, what evidence exists, which provisions of the IT Act, the BNS and the DPDP Act apply, what the realistic criminal, civil and employment routes are, and your own reporting duties, written for management and counsel.
Evidence preservation and forensics
Imaging and log collection with chain of custody, analysis of what was accessed, copied or deleted, by which account and when, and a report with exhibits that supports a complaint and withstands challenge.
Complaint and FIR
A complaint to the cyber cell or police citing IT Act sections 43 and 66 (unauthorised access and damage), 66B (stolen computer resource), 66C and 66D, 72 and 72A (breach of confidentiality) and BNS provisions on theft, criminal breach of trust and cheating, with evidence annexed, plus follow-up and escalation.
Civil and employment steps
Material for cease-and-desist notices, injunction applications and disciplinary proceedings, prepared with counsel, including preservation letters to the recipient company where data has moved to a competitor.
Your own duties
DPDP breach notification to the Board and affected persons, CERT-In reporting, RBI or SEBI reporting where regulated, and insurer notification, with drafts and timelines.
Responding to notices
When the company is on the receiving end of a police notice, a DPDP complaint or a customer's legal notice, a factual investigation and a response prepared with counsel.
How we work
Preserve first
Within hours of the call: accounts secured, devices and logs preserved, nobody confronts the suspect yet. A written preservation note records what was done.
Assess
Case assessment delivered to management and counsel within days, with options and your duties on a timeline.
Act
Forensic report, complaint, notifications and civil material prepared and filed in the agreed order.
Follow through
Police follow-up, support at statements and hearings as a witness where required, and a closure note.
What you walk away with
- Evidence that can be used, instead of a suspicion and a wiped laptop
- A complaint with the right provisions and annexures, filed and followed up
- Your own notification duties met on time, so the victim does not become the accused
- A clear view of what is worth pursuing and what is not
What we do not do
We would rather lose an enquiry than mislead you.
- We are not advocates and do not provide legal opinions or appear for you; we work with your counsel or refer you to one
- We do not access the suspect's personal devices or accounts; only company systems and lawfully obtained material
- We do not guarantee registration of an FIR, prosecution or recovery of data or damages
Frequently asked questions
An employee resigned last week and we think they took the client database. What do we do today?
Preserve first. Disable their access, image their laptop and preserve email, file-sharing and system logs before anything is reused or wiped, and do not confront them yet. Then call us or your counsel. The evidence of what was copied, when and to where is what makes the case; it is usually destroyed in the first week by well-meaning IT staff.
Is taking data a crime, or just a contract breach?
Both can apply. Unauthorised downloading or copying of data from a computer system is covered by IT Act section 43 with criminal liability under section 66, and dishonest use of a stolen computer resource under 66B; sections 72 and 72A cover breach of confidentiality. The BNS provisions on theft and criminal breach of trust may apply. Which to pursue depends on the evidence and what you want to achieve.
Do we have to notify anyone that the data was taken?
If personal data was involved, the DPDP Act requires notification to the Data Protection Board and affected individuals under the rules, and CERT-In directions require reporting of data breaches within six hours. Regulated entities have additional duties. We set out the timeline in the case assessment so this is not overlooked while the investigation runs.
Can we use what we find on the employee's company laptop and email?
Generally yes, where the company owns the systems and has a policy that staff were told about. The way evidence is collected matters for admissibility, which is why imaging and chain of custody come first. Where there is a question about personal data on company devices, we take a conservative approach with counsel.
The police are not registering our complaint. What next?
A written complaint with the evidence annexed and the provisions identified is much harder to refuse than a verbal one. If it is still refused, a representation to the Commissioner or SP and, if needed, an application to the magistrate under BNSS are the next steps. We prepare both with counsel.
Tell us what has happened and who knows
What was taken or attacked, when you found out, who has been told, and whether counsel is involved. We reply the same working day; call if it is still live.