If my business is affected by a cyber attack, what are my rights and obligations under the IT Act, specifically Section 70B?

Detailed Legal Analysis

If your business is affected by a cyber attack, you have specific rights and obligations under the Information Technology Act, 2000 (IT Act), particularly under Section 70B, which deals with the protection of critical information infrastructure.

Section 70B primarily aims to safeguard critical information infrastructure (CII) and outlines the responsibilities of the government and private entities in the event of cyber incidents. Here are the key points regarding your rights and obligations:

• Definition of Critical Information Infrastructure: Under Section 70B, CII is defined as any computer resource, the incapacitation or destruction of which, would have a debilitating impact on national security, economy, public health, or safety.
• Obligations of the Entity:
  • Entities identified as CII must adhere to the security requirements laid down by the government.
  • You are required to report any cyber attack or breach immediately to the designated authority or the Indian Computer Emergency Response Team (CERT-In).
  • Implement necessary security measures to protect your infrastructure against vulnerabilities.
• Rights of the Entity:
  • You have the right to be informed about the security measures that are applicable to your business concerning CII.
  • You can seek assistance from government bodies in mitigating the effects of a cyber attack.
  • You may also have the right to claim compensation for losses incurred due to the negligence of the authorities in fulfilling their obligations under the IT Act.
• Liability: Section 70B imposes penalties for non-compliance with the obligations outlined, which could include fines or imprisonment, depending on the severity of the breach.
• Cooperation with Authorities: In the event of a cyber attack, your cooperation with investigative authorities is crucial. This may include providing access to relevant data and systems for forensic investigation.

In conclusion, as a business affected by a cyber attack, understanding your rights and obligations under Section 70B of the IT Act is essential. Implementing robust security measures and promptly reporting incidents can help mitigate the repercussions of cyber threats.