Pillar guide

Cyber security compliance in India: which rules apply to you

India has no single cyber security law. Instead, several regimes overlap: a national incident-reporting direction, sector regulators, a new data protection law and the voluntary standards your customers ask for. This guide maps them so you can see what applies and where the same work can serve more than one.

6 hoursto report specified incidents to CERT-In

180 daysminimum retention of ICT logs, within India

2.04 mincidents tracked by CERT-In in 2024

4+regimes a regulated business may face at once

Executive summary

Cyber security compliance in India is a stack, not a statute. Most organisations answer to the same four layers.

National: CERT-In's 2022 directions require incident reporting within 6 hours and log retention.
Sectoral: RBI, SEBI and IRDAI add governance and resilience expectations for regulated entities.
Data: the DPDPA adds safeguards, a 72-hour detailed breach report and penalties up to ₹250 crore.
Assurance: ISO 27001 and SOC 2 are voluntary, but they are what customers and partners ask for.

01The four layers

Think of compliance as four layers. A national layer that applies to almost everyone, a sector layer if you are regulated, a data layer for personal information, and an assurance layer your customers choose for you.

Exhibit 1Cyber security regimes in India at a glanceWho each applies to and the headline duty

Regime	Applies to	Headline duty
CERT-In directions, 28 April 2022 (IT Act s.70B)	Service providers, intermediaries, data centres, body corporates, Government	Report specified cyber incidents within 6 hours of noticing; keep ICT logs for 180 days within India; synchronise system clocks.
DPDPA 2023 and Rules 2025	Anyone processing digital personal data in India	Notice and consent, reasonable security safeguards, breach reporting (detail within 72 hours), rights. Penalties to ₹250 crore. Main duties from 13 May 2027.
RBI IT governance, risk, controls and assurance directions	Banks and other regulated entities	Board-level governance of IT and cyber risk, controls, assurance and reporting.
SEBI Cybersecurity and Cyber Resilience Framework (CSCRF)	SEBI-regulated entities	A cyber security and resilience framework with defined controls and incident reporting.
IRDAI Information and Cyber Security Guidelines	Insurers and insurance intermediaries	Governance and controls for information and cyber security.
ISO/IEC 27001, SOC 2	Voluntary; requested by customers	An independent certificate or attestation that your controls exist and work.

Source: Requirements change; confirm the current circular for your sector before relying on this table.

02The reporting clocks

Of everything above, the reporting clocks are the part that trips teams up, because they run in parallel and start at the moment you notice an incident.

Exhibit 2The clocks that start when you notice an incidentWhat to tell whom, and by when

Hour 0You become aware6 hoursReport the incident to CERT-InWithout delayTell each affected person and the Board (DPDPA)72 hoursDetailed breach report to the Board (DPDPA Rules)

How to read it. These run in parallel, not one after another. Teams that rehearse the first six hours usually meet the 72-hour report without drama. Teams that start the conversation on day two do not. Sector regulators such as the RBI and SEBI add their own reporting rules; check the current circular for your sector.

Source: CERT-In directions of 28 April 2022 under section 70B of the IT Act (6-hour reporting); DPDPA Rules 2025 as summarised by S.S. Rana & Co..

03What the numbers say

Regulators write rules because the volume and cost of incidents keep rising.

Exhibit 3Cyber security incidents tracked by CERT-InIncidents reported to and tracked by CERT-In, India

1.40 m2021

1.39 m2022

1.59 m2023+14.5%

2.04 m2024+28.2%

How to read it. After a flat 2022, incidents rose 14% in 2023 and 28% in 2024. Over two years that is 46.7% more incidents. Part of that is better reporting, which is itself a sign that the CERT-In reporting rules are working.

Source: Ministry of Electronics & IT reply in the Rajya Sabha, via PIB, 28 March 2025 (2022–2024); CERT-In Annual Report 2022 (2021).

Exhibit 4What was actually reported to CERT-In in 2022Incidents by type, 1,391,457 in total

63%23%12%

Vulnerable services8,75,892 (62.9%)
Network scanning and probing3,24,620 (23.3%)
Virus or malicious code1,61,757 (11.6%)
Website defacement19,793 (1.4%)
Others (DDoS, data breaches, ransomware)5,517 (0.4%)
Website intrusion and malware spread2,164 (0.2%)
Phishing1,714 (0.1%)

How to read it. Most reported incidents are automated: exposed services and scanning. The costly breaches, the ones that start with a phishing email or a supplier, are a tiny fraction of the count but most of the loss. Counts and cost measure different things, and a risk register needs both.

Source: CERT-In Annual Report 2022, as reported by MediaNama. Categories sum to the stated total.

Exhibit 5Average cost of a data breach to an Indian organisation₹ million, IBM Cost of a Data Breach study, India

₹195 m2024

₹220 m2025+13%

₹289 mResearch sector, 2025

₹288 mTransport sector, 2025

How to read it. The national average rose 13% in a year to a record. Research and transport organisations paid roughly 30% more than average (₹289 m and ₹288 m against ₹220 m).

Source: IBM Cost of a Data Breach Report 2025, India edition (press release, 7 August 2025). ₹220 million = ₹22 crore.

Exhibit 6How long a breach lives before it is containedMean days to identify and contain, IBM 2025

India263 days

Global average241 days

How to read it. Indian organisations take about three weeks longer than the global average. In IBM's global data, organisations making extensive use of security AI and automation contained breaches 80 days faster and saved about US$1.9 million. The 72-hour reporting clock starts when you become aware, not when you finish investigating.

Source: IBM India 2025 (263 days); IBM global 2025 via Help Net Security (241 days; extensive use of security AI and automation shortened breaches by 80 days and cut costs by about US$1.9 million, compared with organisations using none).

04One control, many asks

The good news is that the regimes overlap heavily. Access control, logging and monitoring, vendor oversight, incident response, backups and encryption appear, in different words, in almost all of them. Done once and mapped properly, one piece of work and one piece of evidence can serve several.

Exhibit 7One control, many asksIllustrative: how one piece of work answers several regimes

One controlAccess to customer data is reviewed every quarterOwner: IT. Evidence: signed review and ticket trail.

SOC 2 logical access criteria
ISO 27001 access control
DPDPA reasonable security safeguards
Your regulator RBI, SEBI or IRDAI expectations

How to read it. Done once and mapped four ways, the evidence is collected once. Done in four spreadsheets, someone chases the same screenshot four times a year.

The practical consequence: do not build a separate programme per regulation. Build one control library and map it. That is the whole idea behind a connected approach to GRC, and it is why our GRC guide starts there.

Exhibit 8Four stages of GRC maturityIllustrative, so you can place yourself honestly

1. Ad hocSpreadsheets and email. Knowledge sits with a few people. Audit season is a scramble.
2. DocumentedPolicies and a risk register exist. Evidence is still collected by hand.
3. ManagedControls have owners and due dates. One source of truth for audits.
4. ContinuousControls are checked as work happens. Leadership sees live risk, not last quarter's.

05Where to start

List what applies to you. Use Exhibit 1 as a checklist. Many organisations are surprised by how many they answer to.
Fix the reporting clocks first. They are the clearest legal duty and the most embarrassing to miss.
Build one control library. Map it to each regime once.
Assign owners and dates. A control nobody owns is not a control.
Collect evidence as you go. It is far cheaper than reconstructing it before an audit.

The India Cyber Compliance Map is a printable version of this guide with a calendar of duties and an evidence checklist.

Want to see this in a real product?

We will walk you through CyberMetric GRC using your frameworks, not a canned demo.

Book a walkthrough

?Frequently asked questions

Is there a cyber security law in India?

There is no single cyber security statute. The Information Technology Act, 2000 and CERT-In's directions cover incident reporting, sector regulators set rules for their entities, and the DPDPA covers personal data.

How quickly must I report a cyber incident in India?

CERT-In's directions require specified incidents to be reported within 6 hours of noticing them. Under the DPDPA Rules, a personal data breach needs notice to the Board and affected people without delay, with a detailed report to the Board within 72 hours. Sector regulators may add their own timelines.

Is ISO 27001 mandatory in India?

No. It is voluntary, but some regulated sectors and many customers require or prefer it. SOC 2 is likewise a voluntary attestation.

What is the difference between ISO 27001 and SOC 2?

ISO 27001 is a certification of an information security management system against an international standard. SOC 2 is an attestation report from a CPA firm on controls against the AICPA Trust Services Criteria. Many organisations hold both.

How long must logs be kept?

CERT-In's directions require ICT system logs to be kept for 180 days within India. The DPDPA Rules separately require processing logs and related traffic data to be kept for at least one year.

§Sources

Figures are quoted from the sources above and were checked on 6 November 2026. Laws and rules change; confirm the current text before relying on any of it. This is general information, not legal advice. Illustrative exhibits are marked as such.

Keep reading