1. What Does Law Require?

Disaster Recovery (DR) and Business Continuity Plan (BCP) is mandatory for all regulated entities.

A. RBI Framework for Banks, NBFCs, Payment Systems:

• RBI IT Framework for Banks (2016), Cybersecurity Framework (2023), and Digital Payment Security Controls
• Master Direction on Outsourcing: Vendor shall develop, establish and immediately put in place a robust framework for documenting, maintaining and testing BCP and DRP commensurate with nature and scope of outsourced activity as per extant instructions
• Requirement: Half-yearly DR drills, RTO < 30 mins, RPO < 15 mins, Data Centre and DR must be in different seismic zones, auto failover for Critical Systems
• RBI TAT Circular 2019 (DPSS.CO.PD No.629/02.01.014/2019-20) - Harmonisation of Turn Around Time and customer compensation for failed transactions
  If transaction fails due to system outage, bank must auto-reverse within TAT (1 to 5 days) and pay Rs.100 per day penalty for delay beyond TAT

B. SEBI Framework for MIIs (Stock Exchanges, Clearing Corporations, Depositories):

• SEBI Circular dated March 22, 2021: In event of disruption in Critical Systems, MII shall within 30 mins declare disaster and move to DR site
• SEBI Cyber Security and Cyber Resilience Framework: DR must allow recovery of ALL transactions at time of disruption to allow MII to continue to operate with certainty and complete settlement

C. IT Act, 2000:

• Section 43A: Body corporate liable to pay compensation for failure to protect data due to negligence in maintaining reasonable security practices - includes DR.
• Section 66: Computer related offence if system disruption causes wrongful loss.

D. Contract Law:
Under Sections 73-74 of Indian Contract Act, failure to maintain DR is breach of implied term of service continuity. Customer is entitled to reasonable compensation even if no actual loss proved - M/s Construction and Design Services v. DDA (SC 2015)

2. What Constitutes Failure?

Failure is established when:

1. No DR site or DR site in same building / city as Primary
2. No periodic testing - IT auditor finding that BCP/DR plans established 10 years ago have not been updated
3. RTO/RPO not met, manual intervention required
4. Failure to monitor vendors in respect of core and critical activities
5. Data loss - unable to recover all transactions at time of disruption

Force Majeure does NOT cover this. In Sarawjeet Singh vs Asian Hotels (2023), Court held force majeure does not include negligence or predictable events. Power failure in primary data centre is predictable.

3. Legal Consequences

a) Regulatory Penalty:

• RBI under Sec 47A(1)(c) r/w Sec 46(4)(i) of Banking Regulation Act - penalty Rs.1 lakh to Rs.50 lakhs per incident + business restrictions
• SEBI - Settlement proceedings + disgorgement

b) Contractual Liability:

• Customer can claim refund + compensation + penalty
• Under Consumer Protection Act, it is deficiency in service

c) Third Party Liability:

• If payment aggregator fails, Originator Bank must pay penalty to originator if delay beyond TAT

4. Landmark Case Laws in India

Case Law 1: HDFC Bank DR Failure - RBI Enforcement Action 2020-21

Most cited regulatory precedent in India.

Facts: HDFC Bank faced repeated outages in internet banking/mobile banking/payment utilities over 2 years, including major outage on Nov 21, 2020 due to power failure in primary data centre.

RBI Order dated Dec 2, 2020: RBI directed it to temporarily halt sourcing of new credit card customers as well as launches of digital business generating activities planned under Digital 2.0.

Principle Laid: Power failure in Primary DC is not force majeure if DR does not take over. Bank must demonstrate readiness to move operations to Disaster Recovery Site. Failure to ensure DR readiness = violation of regulatory BCP norms.

Ban lifted only after audit by external IT auditor in Aug 2021. Bank later fined Rs.91 lakh to Rs.1.50 crore for non-compliance with cyber security and customer grievance norms.

Case Law 2: NSE Trading Halt Feb 24, 2021 - SEBI vs NSE & NCL

Facts: Trading halted at NSE for nearly 4 hours due to telecom links failure leading to unavailability of online risk management system of NCL.

SEBI Investigation Found:

• Failure to monitor services of vendors in respect of core activities
• Failure to ensure readiness to move operations to disaster recovery site (DRS)
• Failure to ensure orderly execution of trades

Outcome: NSE and NCL settled with SEBI after paying Rs.72.64 crore settlement amount. This is highest DR-related settlement in Indian capital markets.

SEBI thereafter issued circular: MIIs must within 30 mins of disruption of Critical Systems, declare incident and move to DR.

Case Law 3: NSE Data And Analytics Ltd - SEBI Adjudication 2023

SEBI conducted inspection of NSE Data And Analytics Ltd, a KRA. It noted that Noticee was required to have its own BCP and DR framework during inspection period, which it did not, relying instead on NSE's policy.

Held: Reliance on parent's DR is not compliance. Every regulated entity must have independent tested BCP/DR. Penalty imposed.

Case Law 4: Umashankar Sivasubramaniam v. ICICI Bank (2008) - Adjudicating Officer Maharashtra

Under Sec 43 of IT Act - Penalty for damage to computer system up to Rs.5 Cr. First banking case where bank held liable for system failure leading to fraudulent transactions due to lack of DR and monitoring.

Case Law 5: Bombay Stock Exchange Ltd. v. New India Assurance Co. Ltd - NCDRC

BSE claimed insurance for system failure. Insurer denied saying failure due to lack of DR maintenance was not covered. Commission held: Failure to maintain DR is gross negligence, not insurable risk.

Case Law 6: US Precedent Often Cited in India - Ajay Gaalla v. Citizens Medical Center (S.D. Tex 2011)

Court dismissed sanctions motion because there was no duty to preserve backup tapes but clarified if entity has declared BCP stating backups will be maintained, then failure to preserve = bad faith. Used in Indian outsourcing contracts to interpret backup management clauses.

5. How to Prove Breach in Court / Arbitration

You need to show:

1. Contract / Regulation mandated DR - cite RBI Master Direction Clause 38 on DR & BCP Requirements
2. RTO/RPO defined and breached
3. No evidence of DR drill - ask for DR drill reports for last 2 years
4. Transaction log gap - recover all transactions at time of disruption test failed
5. Customer loss due to failed transaction - TAT circular auto-reversal not done

Damages Formula under Indian Law:

• Direct: Transaction amount + Rs.100/day penalty after TAT
• Consequential: Loss of business opportunity if provable (Sec 73)
• Regulatory: RBI can levy penalty under Sec 47A

Drafting tip to protect yourself: In your Service Level Agreement, define:
"DR Failure means Primary DC down > 15 mins without auto-failover to DR. Penalty: 10% of monthly fees per hour of transaction discontinuity + customer compensation pass-through. Two DR failures in quarter = material breach."