Cyber Crime Compliance for Companies in India: Legal Duties

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Cyber law

A company in India that handles customer data is not merely expected to be careful; it is legally required to be. Two statutes create the core duty. Section 43A of the Information Technology Act, 2000 makes a body corporate liable to pay compensation where it is negligent in implementing and maintaining reasonable security practices and procedures, and that negligence causes wrongful loss or wrongful gain. Section 8 of the Digital Personal Data Protection Act, 2023 adds positive duties: a Data Fiduciary must put in place technical and organisational measures, must keep personal data accurate and secure, and must notify a personal data breach both to the Data Protection Board and to each affected Data Principal.

The practical question directors ask, what must we do after a cyber incident, therefore has two answers running in parallel. One is an IT Act answer about compensation to the people who were harmed. The other is a DPDP Act answer about notification, accountability and regulatory penalty. Add the Companies Act, 2013, which makes a director answerable for the systems the company runs, and a cyber incident stops being an information technology problem and becomes a governance problem.

Who the law treats as responsible

Section 43A speaks of a body corporate, a wide expression covering companies, firms, sole proprietors and other associations engaged in commercial or professional activity. The DPDP Act speaks of the Data Fiduciary, meaning the person who alone or with others determines the purpose and means of processing personal data. Most companies are both at once. A startup processing customer records is a Data Fiduciary; the cloud vendor storing those records is a Data Processor, and the two carry different duties.

The distinction matters during a dispute, because a victim who sues the wrong party loses time. The processor answers to the fiduciary under contract; the fiduciary answers to the Data Principal and to the regulator. Where a company also hosts content uploaded by users, it may claim the safe harbour in section 79 of the IT Act, but only if it has complied with the IT Rules, 2021.

The duties, section by section

The starting point is section 43 of the IT Act, which covers unauthorised access, downloading, copying, introducing contaminants into, damaging or disrupting a computer resource. Where that is done dishonestly or fraudulently, section 66 makes it an offence. Where the company is the target and its data or systems are taken, the sections usually charged are 66 with 66B (dishonestly receiving a stolen computer resource), 66C (identity theft) and 66D (cheating by personation using a computer resource).

Section 65 punishes tampering with computer source documents, meaning the source code, or a program or command kept in a computer resource. It matters in an employment dispute where a departing engineer deletes or alters code, and in a vendor dispute where a supplier withholds access.

The company's own liability sits in section 43A. Its language is precise: the duty is to implement and maintain reasonable security practices and procedures, and the compensation follows negligence rather than the mere happening of a breach. A company that suffered a determined intrusion despite documented, industry-standard controls stands in a very different position from one that left a customer database exposed because nobody owned it.

Section 66E protects privacy by punishing the intentional capture, publication or transmission of the image of a private area of a person without consent, in circumstances violating privacy. Inside a workplace this arises from cameras placed in changing areas or the circulation of private images among staff. Section 72 is narrower but frequently cited: it punishes a breach of confidentiality by a person who obtained access under a power conferred by the Act, and it is aimed primarily at officials rather than at employees generally.

Section 67 punishes publishing obscene material in electronic form. In a company it appears when material is circulated internally or posted by an employee using company systems, and it can draw the employer into a complaint about the platforms and policies it maintains.

Section 79 gives an intermediary a safe harbour from third-party content liability, conditional on due diligence and on observing the IT Rules, 2021. A platform without a grievance officer, without the prescribed response timelines and without the required disclosures loses that shield.

Then there is the DPDP Act, 2023. Its obligations attach to lawful processing: notice, consent, purpose limitation, retention limits and security. Breach notification is mandatory. The penalties in the Schedule to the Act reach hundreds of crores of rupees for serious security failures, which is why boards now ask questions they did not ask a few years ago.

One point must be stated plainly because it is unsettled. The DPDP Act provides, in its Schedule, for the omission of section 43A of the IT Act. That amendment has not been brought into force. Until it is, section 43A remains the operative route to compensation after a data breach, and companies should not assume it has disappeared.

What good compliance looks like in practice

• A written security policy that names an owner, not a department.
• Access control and logging capable of producing a reliable audit trail.
• Encryption of personal data at rest and in transit.
• A tested incident response plan with a named decision-maker.
• A vendor and processor register, because liability travels with the data.
• Training records, because a court asks what you did, not what you intended.
• A grievance officer and a published contact point under the IT Rules, 2021.

Third parties, vendors and the cloud

Most breaches in India do not begin inside the company that is blamed for them. They begin in a vendor, a marketing agency, a call centre or a cloud configuration. The law, however, looks first at the fiduciary. A company that processes personal data in the cloud should be able to show a data processing agreement that defines purpose, security, retention and breach-notification duties, and that gives it a right to audit. It should also be able to identify, without research, every place personal data lives.

Where a vendor's negligence causes loss, the company's remedy against the vendor is contractual, while the Data Principal's remedy is against the company. That asymmetry is why indemnity clauses and security warranties belong in every technology contract, not only in the large ones.

Misuse by employees

Insider cases are the most common and the most damaging. An employee who copies a customer list and joins a competitor may be charged under section 43 read with section 66 of the IT Act, and under section 316 of the Bharatiya Nyaya Sanhita, 2023 for criminal breach of trust, which covers a person entrusted with property who dishonestly misappropriates it. An employee who takes money held for the company can face the aggravated form of that offence. Alongside the criminal complaint the company can seek an injunction and damages in a civil suit, and the two can run together.

Records you must be able to produce

The certificate under section 63(4) of the Bharatiya Sakshya Adhiniyam, 2023 is not a formality. Electronic records are admissible only when the statutory certificate is produced, and a company that cannot produce it will watch its own logs become unusable in court.

When the company is the victim: the complaint route

1. Contain the incident. Isolate affected systems and preserve a copy of logs before any remediation overwrites them.
2. Record the timeline: how the intrusion happened, what was taken, which systems were touched.
3. Report on the national cybercrime portal, cybercrime.gov.in, and dial 1930 if money has moved, so that a transaction can be flagged quickly.
4. Notify CERT-In. Specified cyber incidents must be reported to CERT-In within six hours under its directions, a timeline companies routinely miss.
5. Notify the Data Protection Board and affected Data Principals where the DPDP Act applies.
6. File a written complaint at the police station with jurisdiction. The first information is registered under section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023.
7. If the police refuse to register, approach the Magistrate under section 175(3) of the BNSS for a direction to investigate.
8. Preserve the evidence with a section 63(4) BSA certificate, and serve a notice under section 94 of the BNSS where records are held by a third party.

A company that has suffered loss can also pursue compensation in a civil claim and, where the wrong is a criminal offence such as cheating under section 318 of the Bharatiya Nyaya Sanhita, 2023, or forgery under section 336, it can pursue both tracks at once. The two are not alternatives, and recovery is often faster through a civil suit or the banking route than through a criminal trial.

When your company is the one being investigated

If a complaint alleges that your company's negligence caused loss, expect a notice to produce records, examination of officers, and possibly a provisional attachment of accounts. Cooperation is not an admission of guilt, but obstruction is treated as evidence of it. Directors should be briefed before, not after, the first summons. Where an officer faces arrest, the route is bail, and a considered application is prepared well before the police arrive rather than in a hurry afterwards.

What decides the outcome

For compensation under section 43A the deciding questions are whether reasonable security practices existed and whether they were maintained. A documented policy that was never enforced helps less than it appears to. For a criminal case against the intruder, the deciding question is attribution: can the investigating agency link a device, an account or a wallet to a person? For regulatory liability under the DPDP Act, the turning point is whether the company notified promptly and told the truth.

Factors that weigh heavily are the speed of response, the completeness of logs, whether the company warned its customers, and whether it repeated a known failure. Courts and regulators are far more forgiving of a company that discovered a breach, contained it and disclosed it than of one that concealed it.

What not to do

• Do not wipe and rebuild affected servers before imaging them.
• Do not communicate only orally with vendors or police; put everything in writing.
• Do not promise customers a recovery you cannot deliver.
• Do not let a single IT vendor be the sole custodian of your evidence.
• Do not assume the DPDP Act has replaced section 43A; it has not, yet.
• Do not treat a breach as a public relations problem before treating it as a legal one.

When to involve a lawyer

Bring in counsel at the moment of discovery, not after the first notice arrives. Early advice is cheap and shapes everything that follows: what to preserve, what to disclose, what to write in the breach notification, and how to respond to the investigating officer without creating a new problem. A cyber crime lawyer in Kolkata who handles corporate matters can run the defence and the recovery in parallel, and a firm that handles cyber crime matters in Kolkata will know both the police practice and the regulatory route. If a director is likely to be arrested, read the guide on bail before the police come, not after.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Cyber Security Legal Checklist for Startups in India
• Cyber Bullying and Schools: Duties and Liability in India
• Property Fraud Online: Duties of Real Estate Agents
• Patient Data Breach: Legal Duties of Hospitals in India
• E-Commerce Sellers: Fraud, Duties and Legal Remedies
• Data Breach Duties for CA Firms in India: What to Do

Cyber crime lawyer in your city · Bank account freeze help · Contact