Cybersecurity law & regulation in India (2026)

Legal framework

Information Technology Act, 2000 (esp. ss. 70/70A/70B) with CERT-In and NCIIPC; CERT-In Directions of 28 April 2022; sector regulators (RBI, SEBI, IRDAI). No single NIS2-style comprehensive cybersecurity statute is in force; the National Cyber Security Strategy remains unfinalized.

Key points: cybersecurity in India

1. 01Statutory base (IT Act 2000)

   The Information Technology Act, 2000 is the core statute. Section 70B establishes CERT-In as the national nodal incident-response agency, while sections 70/70A empower the NCIIPC to protect Critical Information Infrastructure. There is no separate omnibus cybersecurity act.

   indiacode.nic.in pib.gov.in

2. 02Mandatory 6-hour incident reporting (CERT-In 2022)

   CERT-In's directions of 28 April 2022 (under s.70B(6) IT Act) require all service providers, intermediaries, data centres, bodies corporate and government bodies to report listed cyber incidents within 6 hours of becoming aware, and to retain ICT logs for 180 days.

   pib.gov.in internetsociety.org

3. 03Critical infrastructure (NCIIPC)

   The NCIIPC (under NTRO) is the nodal agency for Critical Information Infrastructure across banking, telecom, power, government and other sectors, and can call for information and issue directions to protect designated CII.

   drishtiias.com financialservices.gov.in

4. 04Financial-sector rules (RBI / SEBI)

   RBI's Cyber Security Framework for banks (2016) mandates incident response and audits, with significant incidents reported via the CIMS portal (initial report within 6 hours, root-cause analysis within 21 days). SEBI's CSCRF (Circular dated 20 Aug 2024) imposes a graded cyber-resilience framework on regulated entities.

   rbi.org.in sebi.gov.in

5. 05Data-breach notification (DPDP)

   The Digital Personal Data Protection Act, 2023 was operationalised when MeitY notified the DPDP Rules, 2025 on 13-14 November 2025. Breach provisions phase in ~18 months later (full compliance by mid-2027), requiring notice to affected individuals without delay and to the Data Protection Board.

   pib.gov.in en.wikipedia.org

6. 06No unified comprehensive law yet

   India relies on overlapping IT Act provisions, CERT-In directions and sectoral regulators rather than a single NIS2-style cybersecurity statute; a National Cyber Security Strategy has been drafted but remains unfinalized.

   cyberlawconsulting.com chase-advisors.com

Timeline of decisions

1. 20 Aug 2024Guidance · official
   SEBI issues Cybersecurity and Cyber Resilience Framework (CSCRF)

   SEBI consolidated all prior cyber circulars into a single graded framework for Regulated Entities (exchanges, brokers, AIFs, mutual funds), mandating SOCs, incident response, audits and resilience testing aligned to ISO 27000 and NIST. It standardised cyber obligations across India's securities market.

   SEBI

2. 23 Nov 2022Incident
   AIIMS Delhi ransomware attack

   A LockBit ransomware attack crippled the premier government hospital for nearly two weeks, encrypting over 100 servers and exposing up to ~40 million patient records. It became the defining case for protecting healthcare and other critical information infrastructure in India.

   NLIU CSIPR

3. 28 Apr 2022Guidance · official
   CERT-In Directions under Section 70B issued

   CERT-In mandated reporting of specified cyber incidents within 6 hours of detection, 180-day local log retention, time synchronisation to NIC/NPL clocks, and 5-year KYC retention by VPN, cloud and crypto providers. These directions created India's strictest incident-reporting regime.

   CERT-In

4. 2 Jun 2016Guidance · official
   RBI Cyber Security Framework for Banks

   The Reserve Bank required scheduled commercial banks to adopt board-approved cybersecurity policies, build Security Operations Centres, maintain Cyber Crisis Management Plans, and report incidents to RBI. It established sector-specific cyber obligations for India's banking system.

   Reserve Bank of India

5. 2 Jul 2013Guidance · official
   National Cyber Security Policy 2013 released

   MeitY published India's first comprehensive cybersecurity policy, setting 14 objectives including protecting critical infrastructure, creating a national nodal agency, and building a skilled cyber workforce. It framed the strategic direction for subsequent regulation.

   MeitY

6. 27 Oct 2009Law · official
   IT (Amendment) Act 2008 comes into force

   The amendment gave CERT-In statutory status as the national incident-response agency (Section 70B), added cyber-terrorism (Section 66F), Section 70 critical-infrastructure protection, and Section 43A data-security liability. It built the core cybersecurity architecture of Indian law.

   India Code (Government of India)

Sources

1. 1.indiacode.nic.in/show-data?actid=AC_CEN_45_76_00001_200021_1517807324077&sectionId=131
2. 2.pib.gov.in/PressReleasePage.aspx?PRID=1820904&reg=3&lang=2
3. 3.pib.gov.in/PressReleasePage.aspx?PRID=2116341&reg=3&lang=2
4. 4.pib.gov.in/PressReleasePage.aspx?PRID=2190655
5. 5.rbi.org.in/commonman/English/scripts/Notification.aspx?Id=1721
6. 6.sebi.gov.in/legal/circulars/aug-2024/cybersecurity-and-cyber-resilience-framework
7. 7.internetsociety.org/resources/doc/2022/internet-impact-brief-india-cert-in-cybersecurity-
8. 8.en.wikipedia.org/wiki/Digital_Personal_Data_Protection_Rules,_2025
9. 9.financialservices.gov.in/beta/en/page/cii
10. 10.drishtiias.com/daily-updates/daily-news-analysis/critical-information-infrastructure
11. 11.cyberlawconsulting.com/sectoral_cybersecurity_regulations_india.php
12. 12.chase-advisors.com/media/yw4pvnsy/future-proof-and-future-ready-framework-for-protecting