According to the CERT-In FAQ, the 28 April 2022 directions apply to any entity in the matter of cyber incidents, so incident reporting reaches foreign companies too. Firms offering services to users in India are also asked to designate a Point of Contact. Individual citizens are not covered.
Who the directions name
The directions address service providers, intermediaries, data centres, body corporate and government organisations. Cloud providers, VPS providers, VPN providers and virtual asset service providers get extra record keeping duties. The FAQ states that individual citizens are not covered.
What the FAQ says about foreign firms
Question 26 asks whether the directions apply only to Indian companies. The answer points to the IT Act and says the directions apply to any entity whatsoever in the matter of cyber incidents and cyber security incidents. Questions 27 and 28 give the same reading for virtual asset firms and online gaming companies located abroad: they apply in so far as incident reporting is concerned.
Question 29 covers the Point of Contact. Service providers, intermediaries, data centres and body corporate offering services to users in India must designate one to liaise with CERT-In, even without a physical presence in India.
What that means for a foreign SaaS team
The FAQ wording is about incident reporting, so start there:
- Decide who in your company would send a report, and who is the Point of Contact.
- Add India to the jurisdiction list in your incident runbook, with the 6 hour window.
- Keep logs in a form you can produce on request. The FAQ says logs may sit outside India if you can supply them in reasonable time.
- Check clock sync and your log coverage.
- Ask counsel whether any of the other duties, such as the customer registration records for cloud providers, apply to what you sell.
This is a reading of the published text and FAQ, not a legal opinion. Enforcement practice can differ from how a firm reads the words.
Questions to ask your counsel
Bring three questions. Which of your entities counts as a body corporate or service provider for these purposes? Does any part of your product make you a cloud, VPS or VPN provider, which triggers the customer record keeping duties in direction (v)? And who signs off a report to an Indian authority on behalf of a company based elsewhere?
How it sits with other Indian rules
Sector regulators layer their own expectations on top. RBI and SEBI texts both refer back to CERT-In reporting, covered in other posts in this series. The DPDP Act is a separate regime with its own breach notice to the Data Protection Board.
Quick check
Do we need an office in India to name a Point of Contact?
The FAQ says firms offering services to users in the country should designate one, and that applies to those without a physical presence.
Does the 6 hour rule apply to an Indian customer's data held in our overseas cloud?
The FAQ says the directions apply to any entity in the matter of cyber incidents. Take advice on your specific case.
Sources
Last reviewed: 19 October 2026.
