Cyber Risks & Incident Response
For insurers, reinsurers and multinational companies, the firm handles cyber incidents and cyber insurance. It acts as breach response counsel while an incident is live, advises on coverage under cyber, crime and directors and officers liability policies, and represents clients in coverage disputes before courts and arbitral tribunals.
The legal framework
Incident work proceeds under the Information Technology Act 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 and the reporting directions issued by the Indian Computer Emergency Response Team in April 2022, which fix the six-hour window for reporting a cyber incident. The Digital Personal Data Protection Act 2023 adds notification of a personal data breach to the Data Protection Board of India and to affected individuals. Sectoral requirements sit above these: the Reserve Bank of India's cyber security framework for banks, the guidelines of the Insurance Regulatory and Development Authority of India for insurers, and the cyber security and cyber resilience framework of the Securities and Exchange Board of India for market intermediaries. Offences are prosecuted under the Information Technology Act 2000 and the Bharatiya Nyaya Sanhita 2023; coverage disputes under cyber policies proceed before the courts, consumer commissions and arbitral tribunals.
Scope
On-call breach response counsel for insurers and their policyholders during ransom, extortion and data breach incidents.
Coverage advice under cyber, crime and directors and officers liability policies, before and after an incident, and coverage disputes before courts and arbitral tribunals.
Cyber claims involving business interruption and consequential loss following disruption to operations.
Funds transfer fraud and social engineering claims, including vendor and CEO impersonation and business email compromise.
Subrogation and recovery in ransomware, phishing, social engineering and funds transfer fraud matters.
Defence of insureds against third-party claims under liability policies once coverage is confirmed.
Monitoring counsel work for reinsurers on cross-border cyber breach claims with layered insurance structures.
Reporting after a breach, including incident reporting to CERT-In and complaints on the National Cyber Crime Reporting Portal.
Structuring of cyber and digital business insurance products for the Indian market.
Where it applies