IT Act, DPDP Act & CERT-In Rules

India's primary cyber security legal framework rests on the Information Technology Act 2000 (amended 2008), the Digital Personal Data Protection Act 2023, and the CERT-In Directions of 2022.

The IT Act creates criminal offences for hacking, data theft and identity fraud. Section 66A was struck down by the Supreme Court. Section 69 grants government interception powers. Section 43A mandates "reasonable security practices" for entities holding sensitive personal data.

The DPDP Act 2023 establishes a consent-first framework for personal data processing, creates the Data Protection Board, and introduces significant financial penalties. It places obligations on Data Fiduciaries — any entity that determines the purpose of processing.

CERT-In's 2022 Directions require organisations to report cyber incidents within six hours, maintain detailed logs for 180 days, and synchronise clocks to NTP. Non-compliance attracts prosecution. These obligations apply broadly, including to cloud and VPN providers operating in India.