Incident governance for organisations
Data Breach Response Legal Services in Kolkata
A suspected breach requires technical containment and legal decision-making to run together. The organisation should identify the affected systems and information, preserve logs, control communications and map contractual or regulatory duties before sending broad statements that may later prove inaccurate.
Governance
Create a controlled incident record
Nominate an incident lead, a technical lead and an authorised communications contact. Record decisions, sources and times. Restrict unnecessary access to the investigation file, preserve relevant insurance and vendor notices, and avoid blaming an employee or supplier before the evidence is reviewed. Business continuity should be documented separately from forensic preservation.
Systems
Identify affected applications, endpoints, cloud services, backups, administrator accounts and connected vendors.
Information
Classify the fields involved, likely individuals, sensitivity, encryption state and known or suspected extraction.
Access path
Preserve authentication logs, privilege changes, malware alerts, remote sessions and relevant physical access records.
Operational impact
Track downtime, service interruption, ransom communication, customer effects and recovery actions.
Reporting map
Check duties against the incident and current law
The CERT-In cyber-security directions address specified cyber incidents, reporting and log-retention expectations under section 70B of the Information Technology Act, 2000. Applicability and timing must be checked against the entity and incident. The Digital Personal Data Protection Act, 2023 and its current rules should also be reviewed for commencement, scope and obligations before asserting that a particular notice is required. Contractual notice periods may be shorter than statutory ones.
Evidence and privilege
Preserve facts while separating workstreams
Retain forensic images, logs, alerts, tickets, vendor reports, access-control changes and communications in a controlled repository. The evidentiary route for electronic records should be considered under the Bharatiya Sakshya Adhiniyam, 2023. Technical remediation notes, business decisions, insurer communications and legal analysis should not be mixed into one uncontrolled chat thread.
- Document who collected each log or device and when.
- Record system time zones and known clock differences.
- Preserve originals before filtering or exporting subsets.
- Track every external disclosure and the evidence supporting it.
Connected disputes
Review contracts, employees and third parties
Cloud, processor, security, employment and confidentiality agreements may allocate investigation, notice, cooperation and indemnity duties. A suspected insider incident may require digital evidence planning and careful employment-law handling. If the event includes account takeover or false communications, use account hacking and impersonation assistance.
Consultation file
Bring the incident chronology and duty map
Share the incident timeline, system and data inventory, technical alerts, preserved logs, vendor contracts, insurance policy, internal policies, regulator or customer correspondence, remediation steps and the identity of each decision-maker. Mark any active threat, ransom demand or reporting deadline.
Last reviewed: 4 September 2026. This is general information. The correct complaint, forum, notice, limitation analysis and remedy depend on the records and facts; no result is guaranteed.
