How to Decide Whether a Cyber Incident Must Be Disclosed Under Regulation 30 of the LODR
When personal data belonging to a listed company's customers turns up where it should not be, the first legal question is usually not a data protection question. It is whether the event has to be told to the stock exchanges, and how soon. Regulation 30 of the LODR answers that, and the answer turns on two things the company has to settle before the clock starts.
Step 1: Start With the Duty, Not With the Policy
Regulation 30 of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015 obliges a listed entity to disclose events or information that are material. Everything else in the regulation, including the materiality policy, exists to work out which events those are.
That order matters in an incident, because the instinct under pressure is to reach for the policy and read it as the source of the obligation. It is not. The policy is the instrument through which the entity applies a test the regulation imposes.
Step 2: Check Para A of Part A of Schedule III First
Events specified in Para A of Part A of Schedule III to the Regulations are deemed to be material. For those there is no materiality assessment to make, and the entity has no discretion about whether to disclose.
So the first task is to read the incident against that list rather than to debate its significance. If it falls inside Para A, the only live questions are what to say and by when, and the materiality discussion is beside the point.
Step 3: If It Is Not in Para A, Apply Para B
Events specified in Para B of Part A of Schedule III are disclosed only on applying the materiality guidelines in sub-regulation (4) of regulation 30. That is where judgement enters, and where the reasoning needs to be recorded as it is made.
Two routes can lead to the same disclosure, and they are not interchangeable in a later review. A disclosure made because an event was deemed material under Para A rests on the list; a disclosure made under Para B rests on an assessment that somebody made on identified facts at an identified time.
Step 4: Have the Materiality Policy Settled in Advance
Sub-regulation (4) requires the entity to frame a policy for determining materiality, approved by its board of directors. The guidelines in the sub-regulation are what that policy has to apply.
A policy drafted for routine corporate events will often say nothing useful about an information security incident. Reviewing it before an incident, so that the categories it uses can actually accommodate one, is the cheapest preparatory step available and the one most often skipped.
Step 5: Fix the Clock
Disclosure is to be made as soon as reasonably possible and in any event not later than the outer limits the regulation sets. Those limits are thirty minutes from the closure of the meeting of the board of directors where the event or information arises from a decision taken at that meeting, twelve hours from the occurrence of the event where it emanates from within the listed entity, and twenty four hours from the occurrence where it does not.
Three different periods therefore run from three different starting points. Working out which period applies is not an administrative detail: it is the difference between a timely disclosure and a late one, and it has to be decided while the facts are still incomplete.
Step 6: Decide Whether the Event Emanates From Within the Entity
The twelve hour and twenty four hour periods are divided by whether the event emanates from within the listed entity. For most corporate events that question answers itself. For an information security incident it frequently does not.
An incident detected because an outside body raised an alert is not for that reason an event emanating from outside the entity, and an incident whose origin is still unknown cannot be classified with confidence either way. Take the view that the facts support, record why it was taken, and treat the shorter period as the safer working assumption where the question is genuinely open.
Step 7: Identify When the Event Occurred
Both the twelve hour and the twenty four hour period run from the occurrence of the event, so the moment of occurrence is a question of fact that has to be answered before the deadline can be calculated at all.
In an incident that unfolds over days, the candidates are rarely in doubt but the choice between them is: the compromise itself, the alert, the internal confirmation. Record the date and time of each, because the reasoning about which one started the clock is only available afterwards if the underlying times were written down as they happened.
Step 8: If the Disclosure Is Late, Explain the Delay
Where a disclosure is made after the applicable period, it is to carry an explanation for the delay. The explanation is part of the disclosure rather than a separate submission.
A late disclosure with a candid and dated explanation is a materially better position than a late disclosure without one, and the material for that explanation is the record made in the preceding steps. That is the practical reason for keeping it.
Common Pitfalls to Avoid
Treating the materiality policy as the source of the duty: The duty is in regulation 30; the policy is how the entity applies the test.
Debating materiality before reading Para A: Events in Para A of Part A of Schedule III are deemed to be material.
Not recording which route the disclosure took: A Para A disclosure rests on the list and a Para B disclosure on an assessment.
Leaving the policy drafted for routine events only: Sub-regulation (4) requires a board approved policy, and it has to be capable of addressing the incident in front of it.
Assuming a single deadline: There are thirty minute, twelve hour and twenty four hour outer limits with different starting points.
Classifying the event by who raised the alert: The division is whether the event emanates from within the listed entity, not who noticed it.
Calculating the deadline before fixing the occurrence: Both the twelve hour and the twenty four hour period run from the occurrence of the event.
Filing late without an explanation: A delayed disclosure is to be accompanied by an explanation for the delay.
Key Statutory Provisions
Regulation 30 of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015: Disclosure of events or information. A listed entity is obliged to disclose events or information that are material, within the outer limits the regulation sets, with an explanation where a disclosure is delayed.
Sub-regulation (4) of regulation 30: The materiality guidelines, and the requirement that the listed entity frame a policy for determining materiality approved by its board of directors.
Part A of Schedule III to the Regulations: Para A specifies events deemed to be material, disclosed without applying the materiality test. Para B specifies events disclosed on applying the materiality guidelines.
Sources and References
Independent treatment of the same timelines and the within-and-outside distinction
Analysis of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015
SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, regulation 30 and Schedule III
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers should consult a qualified legal professional for advice specific to their circumstances.
Comments