Cyber Security Advisory

A professional service that helps a business identify and reduce legal, regulatory, operational and technical risk connected with cyber threats, data breaches and information security. It sits between the IT function and the legal function, which is exactly where most gaps live.

No. It is not a licence or a registration. It is advisory and compliance support. That said, the underlying obligations — incident reporting, log retention, security safeguards — can themselves be mandatory depending on the entity and sector.

The Information Technology Act, 2000 and the CERT-In Directions of 28 April 2022 are the operative baseline today. The SPDI Rules, 2011 still govern sensitive personal data. The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 layer on top, with most substantive obligations commencing 13 May 2027.

Not in full. The DPDP Rules, 2025 were notified on 13 November 2025 with a phased commencement. The Data Protection Board provisions came into force at once and consent-manager registration opened after twelve months, but the operative obligations — notice, security safeguards, breach intimation, retention limits, children’s data, Significant Data Fiduciary duties and Data Principal rights — commence on 13 May 2027.

That would be a mistake. The 13 May 2027 date is the deadline to be compliant, not the date to begin. Data inventories, consent re-papering, vendor contract amendments and retention controls take months, and the IT Act, SPDI Rules and CERT-In obligations already apply today regardless.

Yes. Section 43A and the SPDI Rules, 2011 remain in force and are omitted only with effect from 13 May 2027, when the corresponding DPDP provisions commence. Treating them as already repealed is a live compliance risk.

The Indian Computer Emergency Response Team, the national nodal agency for cyber incident response under Section 70B of the IT Act.

For specified cyber incidents, yes. The CERT-In Directions require covered entities to report specified incidents within six hours of noticing them or being made aware of them.

Report what you have. The Directions contemplate providing available information within the window and supplementing it afterwards. A late complete report is worse than a prompt partial one.

The CERT-In Directions require ICT system logs to be maintained securely for a rolling period of 180 days, within Indian jurisdiction. Log retention is the single most commonly failed item we see.

Vulnerability Assessment and Penetration Testing — technical testing that identifies weaknesses in systems, applications and networks.

It depends on the entity, regulator, certification and customer contracts. For regulated entities, system audits and security testing are commonly expected. For everyone else, it is usually a contractual rather than statutory requirement.

When the relevant rules commence, a Data Fiduciary must intimate the Data Protection Board without delay with an initial description, followed by a detailed report within seventy-two hours, unless the Board allows longer on written request. Affected Data Principals must also be informed.

No. They are separate obligations with separate recipients, thresholds and timelines. A personal data breach at a covered entity can trigger both, and the six-hour clock is the tighter one.

A step-wise plan for identifying, containing, reporting, investigating and recovering from a cyber incident, with named owners and an escalation matrix. Written before the incident, not during it.

Isolate affected systems, preserve evidence, convene the response team, assess reporting obligations against the clock and coordinate technical support. Do not delete logs, do not wipe devices and do not have anyone improvise a customer statement.

Because a breach is usually followed by a regulator, an insurer, a customer or a litigant asking what happened. Electronic records are governed by the Bharatiya Sakshya Adhiniyam, 2023, and evidence that was not preserved properly is hard to rely on later.

The risk arising when cloud providers, SaaS platforms, IT vendors or consultants can access your systems or data. A vendor breach is still your regulatory and customer problem, which is why contract clauses and access controls matter.

A contract defining how a vendor processes data on your behalf, what it must protect, how quickly it must report a breach to you, and where liability sits.

Yes, proportionately. A small business still holds customer data, payment records and employee information, and attackers do not filter by turnover. The controls should be scaled, not skipped.

Data inventory, policies, VAPT reports and remediation status, incident history, vendor contracts, DPDP readiness and board oversight. Cyber gaps surface in diligence and affect terms.

Treating cyber security as purely an IT problem. The technical controls are only half of it; the other half is documentation, contracts, reporting readiness, evidence and board accountability.

Cyber security policy, privacy notice, access control register, incident register, VAPT reports with a remediation tracker, vendor contracts and DPAs, data inventory, backup policy and a breach response SOP.

Periodically, and on every trigger — a new product or app, a new vendor, a new data flow, a regulatory change, an incident, or an investor process starting.

Yes. We support legal response, reporting readiness against the six-hour and seventy-two-hour clocks, evidence preservation, breach communication review and corrective-action tracking. Forensic and remediation work is done with technical partners.