Data Breach Evidence to Preserve in the First 48 Hours

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 3 Nov 2026 · Digital evidence

When a data breach exposes your personal or business information, the evidence you keep in the first forty-eight hours often decides whether anyone can be held responsible. Do not clean, patch, reset or reinstall the affected systems before the logs, messages and copies of the leaked data have been preserved. Under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023, an electronic record is admissible only where its integrity can be demonstrated, so a device that has been wiped proves nothing to a court.

The legal duties run in two directions. An organisation that suffers a breach must secure the data and may face action under Section 43A of the Information Technology Act, 2000 for failure to protect it, while the person who intruded faces Section 66, Section 66C and Section 66D of the same Act. For you as the victim, the practical question is not who was at fault but what you can still prove. Everything below is about protecting that proof before it disappears.

What the law says about a data breach

The Information Technology Act, 2000 is the primary criminal statute. Section 43A creates a civil liability on a body corporate that possesses, deals with or handles sensitive personal data and fails to implement reasonable security practices, allowing the affected person to claim compensation. Section 66 covers computer-related offences generally. Section 66B covers dishonestly receiving a stolen computer resource. Section 66C covers identity theft, meaning the fraudulent or dishonest use of another person's electronic signature, password or unique identification feature. Section 66D covers cheating by personation using a computer resource or communication device. Section 72 punishes a person who, having secured access under the Act, discloses information without the consent of the person concerned.

The Bharatiya Nyaya Sanhita, 2023 supplies the general criminal law that sits alongside these provisions. Where a breach is used to cheat you out of money, Section 318 applies. Where records are fabricated to conceal the intrusion, Section 336 on forgery may apply. Where the intruder was entrusted with your systems and abused that trust, Section 316 on criminal breach of trust can apply. Investigators routinely invoke the IT Act and the Sanhita together, because a single incident can be both an unauthorised access offence and a cheating offence.

Two newer frameworks matter for context. The Digital Personal Data Protection Act, 2023 imposes obligations on data fiduciaries regarding the security of personal data and the notification of breaches, but its enforcement machinery is still maturing, so a victim should not rely on it alone. Where a breach results in the publication of obscene or sexually explicit material, Section 67 or Section 67B of the IT Act may also become relevant. Where the law is genuinely unsettled, courts tend to apply the clearest available provision rather than a novel construction.

Why the first forty-eight hours change the case

Most breach evidence is volatile. Volatile memory is lost when a machine restarts, session and access logs rotate on their own schedules, cloud providers delete logs once a retention window closes, and an intruder who still holds access can erase traces faster than you can look for them. The first forty-eight hours are also the period in which platforms, banks and internet service providers are most responsive to a preservation request, and in which the trail is still technically recoverable.

Preservation is not the same as investigation. You are not being asked to find the attacker; you are being asked to stop the evidence from being lost while someone else finds the attacker. A phone that keeps syncing, a laptop that keeps rebooting, or a mailbox that keeps receiving mail is a system that is quietly overwriting its own history. The instinct to tidy up is the single most destructive instinct in a breach.

The order to preserve data breach evidence

1. Stop the change, not the system. Disconnect the affected device from the network, but do not power it off and do not run a factory reset. Preserve the state in which the breach was discovered.
2. Record what you saw, with a timestamp. Write down the date and time of discovery, what you observed and how. This becomes the anchor for every later claim.
3. Export logs before they rotate. Server, application, mail and access logs should be exported in their original format, together with the export time and the tool used.
4. Keep original messages and headers. Phishing emails, SMS threads and chat messages should be saved with full headers, not merely as screenshots.
5. Photograph and fingerprint. Photograph the screen state, and where possible record a checksum of exported files so their contents can later be shown to be unchanged.
6. Complain in writing. Report to the platform's security channel, to your bank if money moved, and log a complaint on cybercrime.gov.in or by calling 1930.
7. Send a preservation notice. Ask the platform or provider, in writing, to preserve relevant logs and records, and keep proof that you sent it.
8. Keep a decision log. Note who did what and when, so any later gap in the record can be explained rather than treated as suspicious.

Which records matter most

How a Section 63 certificate works in practice

A printout or a file copied from a computer is not, by itself, proof of what the computer contained. Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 requires that the electronic record be produced in a form that allows its authenticity and integrity to be examined, and it contemplates a certificate describing the device, the particulars of the record and the conditions of its production. In practice, that certificate is usually signed by the person in charge of the relevant device or by the person who made the export. Getting the certificate at the time of export is far easier than reconstructing it months later, when the original device may have been replaced or the person who made the copy has moved on.

This is why you preserve before you analyse. If you analyse first and export later, the chain from original to copy is broken, and the defence will argue that whatever you produced cannot be shown to be what the machine actually held. A byte-for-byte copy of the original, taken early and documented, is almost always more useful than a tidy summary prepared after a week of investigation, however carefully that summary is written.

Who you can notify, and what each can do

Different recipients have different powers. A platform can preserve account data and may lock a compromised account. A bank can freeze or reverse a transaction, and its nodal officer is the correct first point of contact for unauthorised electronic transactions. A police station can register a first information report for a cognizable offence, and under the Bharatiya Nagarik Suraksha Sanhita, 2023 an information relating to a cognizable offence can also be given electronically in certain circumstances. A magistrate can, if the police decline to act, direct investigation under the applicable provision. Each of these steps creates a written record that you should keep.

For a company that has suffered a data breach, there are parallel duties: to secure the system, to preserve records and, where a sectoral regulator is involved, to comply with that regulator's cyber security framework. The Reserve Bank of India's directions on cyber security and on customer protection create obligations for regulated entities, and those obligations are often the lever that moves a bank or an intermediary when a criminal complaint alone does not.

What "reasonable security practices" means under Section 43A

The standard is measured against any practice that has been prescribed, and conformity to it is generally a defence. In practice, the question a court or a bank weighs is whether the failure was a genuine gap or an avoidable carelessness: whether access controls existed, whether data was encrypted, whether access was logged, and whether staff were trained. For a victim, that means evidence of the organisation's security posture — its policies, its audit records, its incident notes — is as relevant as evidence of the intrusion itself.

Preserving evidence when the breach is at a third party

If the breach occurred on a platform, a bank's system or a vendor's infrastructure, the records you need are largely in someone else's control. Your leverage is a written preservation request, sent early and specifically, identifying the account, the date range and the categories of data. Providers often retain logs for a finite period and delete them on a rolling basis; a request that arrives after the window has closed cannot recover what is already gone.

What decides the outcome

In practice, three things carry the most weight. The first is continuity: whether the record from discovery to complaint is unbroken, without convenient gaps. The second is originality: whether the material produced is the original electronic record or merely a reproduction with no verifiable source. The third is connection: whether the harm, the access and the accused can be linked by something more than assumption.

Delay works against the complainant, because it both lets evidence degrade and invites the argument that the loss was noticed late or was not seriously pursued. Early, written, specific complaints are treated more seriously than a message sent weeks later, after hindsight has shaped the account.

Mistakes that destroy a good case

• Reinstalling the operating system or resetting the device to "clean it up".
• Deleting the phishing email or blocking the number before saving the full headers.
• Sending screenshots instead of original files when a platform asks for evidence.
• Reporting to only one channel and assuming it reached the others.
• Discussing the case publicly, which can alert the intruder to destroy remaining traces.
• Wiping a shared or company device without taking an image first.

When to involve a lawyer

A data breach that touches a business, a regulated entity or a financial loss is worth a legal assessment early, because the choice of forum and the drafting of the first complaint shape everything that follows. A cyber crime lawyer in Kolkata can help you serve preservation notices correctly, draft the complaint so the right sections are invoked, and decide whether the matter belongs before a police station, a magistrate or a civil forum. Where your organisation faces a breach claim or a regulator's query, the same counsel can assess exposure under Section 43A, and whether a civil claim for compensation should run alongside the criminal complaint. You will also want a view on whether the matter is better handled through the West Bengal cyber crime unit, given that jurisdiction follows the place of the offence and the location of the affected system.

A preserved record is worth more than a persuasive story.

You do not have to have everything worked out before you call. What matters is that you have not destroyed the record before you do.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Business email compromise: evidence to preserve in 48 hours
• Work from home scam evidence to preserve in first 48 hours
• UPI Fraud Evidence: What to Preserve in 48 Hours
• Trading app scam: the evidence to preserve in 48 hours
• Loan app harassment: evidence to preserve in 48 hours
• Electricity Bill Scam: Evidence to Preserve in 48 Hours

Cyber crime lawyer in your city · Bank account freeze help · Contact