Certain offences under the Privacy Act, and all offences under the IT Bill and the Social Media Bill, are state-party offences listed under Schedule-1 of the National Criminal Procedure Code, 2017 (“NCP”). Pursuant to Section 4 of the NCP, anyone aware of a Schedule-1 offence must file a First Information Report (FIR) which may be submitted in written, verbal, or electronic form and should include any available evidence, with the prescribed format under Schedule-5 of the NCP. The obligation to notify a breach is also mandated by Section 96 of the National Penal Code, 2017 which states that a person under the legal duty to provide information regarding an offence when aware that such an offence has been committed, shall provide the concerned authority with such information. 

The Data Center and Cloud Service Directives also requires service recipients to inform the data center and cloud service provider in case of an unauthorized access to their system, and to notify the National Cyber Security Center if a forensic investigation is deemed necessary for the same.