India: CERT-In and the legal landscape

What CERT-In is

CERT-In (the Indian Computer Emergency Response Team) is the national agency, under the Ministry of Electronics and Information Technology, that responds to cyber security incidents in India. It issues advisories, coordinates responses to large incidents, and sets rules that organisations must follow. It is a useful point of contact and a source of trustworthy guidance.

Incident reporting rules

In 2022, CERT-In issued directions requiring organisations to report certain cyber incidents to it within a short time (widely noted as six hours of noticing them), and to keep certain logs. The exact list of reportable incidents and the details can change, so an organisation should always check CERT-In's current directions. As a tester, you should know these rules exist, because they shape how your clients must respond to what you find.

The laws you already know

• IT Act, 2000: unauthorised access and damage are offences (sections 43 and 66) — permission is your defence.
• DPDP Act, 2023: handle any personal data you encounter with great care; do not copy, keep or share it beyond the engagement.
• Contracts and NDAs: real engagements come with agreements that bind you to confidentiality and scope.

Reporting responsibly in India

If you find a serious flaw in an Indian system and there is no bug-bounty programme, the responsible path is to contact the organisation's security team (or CERT-In if you cannot reach them) privately, and not to test further or go public. This protects users and keeps you on the right side of the law.