Introduction
The reality of today’s business environment is that no organisation, regardless of size or sector, can afford to treat cybersecurity as an afterthought. For companies operating in India, the risks related to data breaches, digital sabotage, and non-compliance with evolving regulatory frameworks are both immediate and escalating. While IT departments may handle firewalls and endpoints, the actual responsibility of staying compliant with Indian cyber laws rests equally on management, legal teams, and, at times, even the board.
What has fundamentally changed over the last few years is the lens through which cybersecurity is being viewed by Indian authorities. With data now treated as a national asset and cross-border digital flows under greater scrutiny, the compliance bar has been raised for all entities. The shift is particularly visible with the introduction of the Digital Personal Data Protection Act, 2023, and parallel enforcement under older frameworks like the Information Technology Act, 2000, and sector-specific circulars issued by regulators such as RBI, SEBI, and IRDAI.
Businesses that process user data, whether directly through mobile/web platforms or indirectly via backend service functions, are now expected to take reasonable and demonstrable measures to prevent, respond to, and report cybersecurity incidents. This includes keeping logs, appointing responsible officers, executing vendor diligence, and above all, adopting a documented cybersecurity compliance checklist that fits their operational realities.
While this may sound straightforward in theory, the actual obligations are scattered across multiple legal sources, each with its triggers, timelines, and reporting duties. To add further complexity, many businesses are unaware that even contractual obligations (with clients or vendors) can create liability exposures in case of a breach, even when the fault lies externally.
Why Cybersecurity is Now a Legal Compliance Issue, Not Just IT
Until recently, companies, especially startups and mid-sized businesses, were treating cybersecurity mainly as an internal best practice. That approach no longer works. The law in India today makes it clear that:
- Any business handling sensitive personal data has to follow reasonable security practices.
- Specific breach types must be reported within 6 hours to CERT-In.
- Logs and evidence trails must be preserved for a minimum period (180 days, at present); and
- Certain companies must appoint data officers and publish security policies, even if they’re not in the tech sector.
In short, cyber diligence is now a legal threshold issue. It directly affects the company’s standing with regulators, investors, enterprise clients, and even insurers. With penalties ranging from ₹5 crore to ₹250 crore under the DPDPA, and in some cases, even criminal prosecution under Sections 66 or 72A of the IT Act, the need for structured, verifiable compliance has become non-negotiable.
The Legal Patchwork: What Makes Cyber Law in India So Risky
One of the more difficult things about cybersecurity regulations for businesses in India is their fragmentation. A company may need to comply with:
- The IT Act (for offences and liabilities),
- The SPDI Rules (for handling of sensitive personal data),
- CERT-In Guidelines (for breach reporting and log retention),
- RBI/SEBI/IRDAI advisories (if operating in a regulated financial sector),
- And now, the DPDPA 2023 (for data protection by design and accountability mechanisms)
Each of these instruments imposes slightly different standards. For instance, under CERT-In guidelines, VPN providers must store customer data for 5 years. Under the SPDI Rules, consent must be obtained for sharing data with third parties. The DPDPA, on the other hand, may require a company to notify breaches within a “reasonable time”, a term which is yet to be fully interpreted, and will likely depend on case law or future Data Protection Board circulars.
The risk is that most Indian companies are only partially compliant. They may have antivirus software, a VPN, and some version of access control, but lack legal documentation, process audits, or incident response planning. This is where a proper cybersecurity compliance checklist becomes vital, not just to tick boxes, but to reduce risk on a day-to-day basis.
What This Guide Will Help You Do
This guide serves as a consolidated legal + operational roadmap. It’s not intended to be theoretical or overly technical; it outlines what companies in India need to do, based on the nature of their business, data flows, third-party arrangements, and existing regulatory obligations.
The purpose is threefold:
- To help companies reduce exposure to legal penalties, breaches, and reputational damage;
- To provide internal legal and compliance teams with a live checklist they can operationalise;
- To bridge the gap between what IT teams implement and what the law requires.
From log retention rules under CERT-In, to contractual provisions with vendors handling user data, to the real meaning of “reasonable security practices”, each section of this checklist connects the legal requirement with a suggested operational action. It is especially helpful for founders, legal heads, and compliance managers who don’t have the time (or clarity) to comb through every new circular and law.
Understanding Cybersecurity Obligations for Indian Businesses
Today, Indian businesses of all sizes, from fintechs and digital marketplaces to traditional manufacturing companies, are subject to a growing web of cybersecurity-related regulations. While IT teams often implement controls, the actual legal obligations stem from various statutes, rules, and sectoral guidelines. Unfortunately, these are not centralised under one code; instead, obligations emerge from multiple instruments such as the Information Technology Act, notifications by CERT-In, and most recently, the Digital Personal Data Protection Act, 2023.
Many organisations find themselves partially compliant, implementing firewalls, antivirus solutions, and access controls, but lacking awareness of mandatory legal duties that go beyond technical hygiene. This section breaks down the legal framework for cybersecurity regulations in India, how these differ from data protection requirements, and the serious legal consequences of non-compliance.
Key Statutory Framework Governing Cybersecurity in India
Legal obligations related to cybersecurity compliance arise from a patchwork of central legislation, delegated rules, notifications, and sector-specific circulars. The five most relevant components are:
1. Information Technology Act, 2000 (amended in 2008)
The foundational statute for electronic data, cyber offences, and digital governance in India. It penalises hacking, data theft, denial of service attacks, and unauthorised access. Relevant provisions include:
- Section 43A: Compensation for failure to protect sensitive personal data
- Section 66: Criminal penalties for dishonest or fraudulent cyber activity
- Section 72A: Disclosure of personal information without consent
It also gives the government the power to issue directions through agencies like CERT-In in the interest of cybersecurity.
2. SPDI Rules, 2011
Applicable to any company or body corporate that handles “sensitive personal data or information” (SPDI), such as financial data, passwords, health information, biometric data, etc.
Obligations under these rules include:
- Obtaining consent before collection and disclosure
- Publishing a privacy policy
- Ensuring data security via “reasonable security practices”
- Executing data protection contracts with third-party processors
These rules are especially important for service providers and digital businesses that collect data directly from users.
3. CERT-In Guidelines (April 2022)
CERT-In (Indian Computer Emergency Response Team), under the Ministry of Electronics and Information Technology, issued updated directions in 2022 to enhance cybersecurity readiness.
Key requirements include:
- Mandatory reporting of certain types of cyber incidents within 6 hours
- Log retention for all systems for 180 days, synchronised with Indian time servers
- Subscription to Indian IP-based infrastructure (especially for VPN and cloud providers)
- Timely response to CERT-In requisitions during breach investigations
These obligations form a central part of any cybersecurity audit, particularly for SaaS platforms, intermediaries, and payment gateway operators.
4. Digital Personal Data Protection Act, 2023 (DPDPA)
The most recent addition to India’s data governance regime. While it primarily focuses on data protection, many of its compliance requirements overlap with cybersecurity.
Key features include:
- Consent-based processing and data minimisation
- Requirement of security safeguards by “data fiduciaries”
- Mandatory breach notification to the Data Protection Board
- Penalties of up to ₹250 crore per instance of non-compliance
- Classification of certain organisations as “significant data fiduciaries” requiring DPO appointment, DPIAs, and grievance redressal officers
The DPDPA applies to all data collected in digital form and will impact businesses regardless of whether the processing occurs in India or abroad.
5. Sectoral Regulations (RBI, SEBI, IRDAI, etc.)
Beyond central statutes, businesses operating in regulated sectors must comply with additional cybersecurity frameworks:
- RBI’s Cyber Security Framework for banks and NBFCs (including regular audits, Board-approved policies, and real-time threat response)
- SEBI guidelines for stock exchanges and depositories
- IRDAI’s Information and Cybersecurity Guidelines for insurers
These frameworks typically mandate periodic vulnerability assessments, breach simulation exercises, internal audits, and independent assurance reports.
In regulated sectors, even lapses by vendors or cloud providers can trigger enforcement, making it critical for businesses to include cybersecurity controls in outsourcing agreements.
How Cybersecurity Compliance Differs from Data Protection Compliance
Many businesses mistakenly treat cybersecurity and data protection as interchangeable, but they involve different legal concepts and compliance duties:
Cybersecurity compliance is about securing systems, networks, and digital assets against unauthorized access, breaches, or disruption. It includes measures like endpoint protection, log retention, breach response, and network hardening. Legal sources include:
- CERT-In Guidelines
- IT Act provisions on offences and penalties
- Sectoral regulator mandates on IT systems
Data protection compliance, on the other hand, is about lawful collection, processing, and sharing of personal data, including ensuring consent, transparency, and privacy safeguards. It is governed by:
- SPDI Rules (for sensitive personal data)
- DPDPA 2023 (for all digital personal data)
- Contractual clauses in processor-controller relationships
While both intersect (e.g., a data breach may trigger both cybersecurity and data protection violations), companies must address both areas distinctly. For instance, breach reporting under CERT-In is within 6 hours, whereas DPDPA requires reporting a breach to the Data Protection Board of India (DPBI) without delay after becoming aware of it.
The Risk of Non-Compliance: Legal, Financial, and Reputational Fallout
Companies that do not proactively address the issues in their compliance face significant consequences. These include:
1. Regulatory Penalties
- Up to ₹5 crore per offence under the IT Act (Section 43A)
- Up to ₹250 crore under the DPDPA for serious contraventions
- SEBI/RBI/IRDAI may also impose fines or suspend licenses
2. Civil Liability
- Clients or users affected by a breach may initiate claims for damages
- Failure to implement “reasonable security practices” can constitute negligence
- Contractual claims can arise from a breach of data handling clauses
3. Criminal Exposure
- Directors and officers may face criminal charges under Section 66 (hacking) or 72A (wrongful disclosure) of the IT Act
- Non-cooperation with CERT-In directions can lead to prosecution
4. Reputational Harm
- Negative press around breaches can lead to investor backlash
- Customers may abandon platforms seen as insecure
- In some cases, vendors and partners may terminate contracts citing risk exposure
Legal compliance aside, the impact on long-term business trust and investor diligence processes is significant. Non-compliance today also affects insurance eligibility for cyber risk cover, especially under new underwriting standards.
Cybersecurity Compliance Checklist: Legal & Technical Steps
Across various stages of growth, most businesses, whether operating digitally or otherwise, eventually find themselves navigating the grey space between practical IT controls and what is legally mandated. In India, that line is no longer blurred; it’s codified. Regulators now expect companies to maintain clear internal protocols, adopt sector-appropriate security measures, and demonstrate good-faith compliance when required. This section outlines key steps every business should implement, aiming not for perfection, but for traceable and defensible compliance.
1. Appoint a Data Protection & IT Security Officer
Depending on the kind of business operations and the sectors being serviced, companies should formally designate personnel responsible for managing cybersecurity and data compliance. It’s important to separate roles. A Data Protection Officer (DPO) would typically look after user rights, consent frameworks, and regulatory queries under the Digital Personal Data Protection Act, 2023. On the other hand, a CISO or IT security officer may oversee firewalls, server configurations, and access controls.
In regulated sectors, like NBFCs or insurers, appointing such officers isn’t optional. Even otherwise, businesses are encouraged to establish an internal SPOC to handle day-to-day IT security issues. This step, in practice, forms the first layer of a working cybersecurity compliance checklist.
2. Conduct a Cybersecurity Risk Assessment
Many companies do not realise that regulators, particularly CERT-In and RBI, expect regular internal mapping of threats, especially for tech-driven platforms. This includes checking not only internal systems but also APIs, vendor access points, and cloud infrastructure.
What should ideally be included:
- Preparing a basic inventory of digital systems and endpoint devices.
- Running vulnerability assessments and documenting outcomes.
- Reviewing third-party exposure (logins, integration keys).
- Flagging risks by likelihood and business impact (not just IT severity).
3. Draft & Implement IT and Cybersecurity Policies
The following policies should be considered:
1. Acceptable Use Policy (employees and contractors).
2. Incident Response Plan (who does what if something goes wrong).
3. Password & Access Management (including MFA guidelines).
4. Device Use Policy (for laptops, BYOD, mobile access).
5. Vendor Access & Data Transfer Policies.
Every one of these documents should ideally be version-controlled, approved internally, and accessible to relevant teams. If data is being processed cross-border, additional safeguards may apply.
4. Ensure Regulatory Reporting Readiness
Under the CERT-In 2022 directions, certain types of incidents must be reported within 6 hours. These include unauthorised access, DDoS attacks, breaches affecting mobile applications, and so on. The timelines are strict and non-negotiable.
To avoid last-minute panic, businesses should do the following:
- Maintain a ready reckoner of notifiable events.
- Document internal reporting lines (who notifies whom).
- Keep logs of all incidents, even minor ones.
- Review system synchronisation with Indian NTP servers (this is required by law).
In the event of a breach, failure to notify on time could itself attract scrutiny. This is one of the most critical aspects of cybersecurity regulations.
5. Review and Secure Vendor & Outsourcing Arrangements
The DPDPA 2023 makes it abundantly clear that primary responsibility lies with the “data fiduciary,” i.e., the company that originally collected the data, even if processing was outsourced.
As a basic rule, companies should:
- Include breach notification timelines in vendor agreements.
- Request (and retain) copies of vendor audit reports;
- Define clear liability in the event of a security lapse;
- Ensure that the vendor maintains logs and adheres to CERT-In directions (where applicable).
6. Employee Training & Cyber Hygiene Programs
Human error accounts for the majority of successful cyber attacks. Regulators across sectors expect that employees handling sensitive data undergo periodic training, something that must be evidenced, not just claimed.
Checklist items here include:
- Sending out regular cyber hygiene bulletins (monthly or quarterly).
- Recording attendance in security awareness sessions.
- Conducting phishing simulation exercises and documenting results.
- Ensuring that exiting employees surrender all access credentials.
Auditors and regulators often ask for proof of these steps during inspections. If training is being outsourced, review what’s being taught and whether it aligns with your internal policies.
7. Encryption, Access Controls & Endpoint Security
This section concerns the actual technical safeguards that protect user data. If a business stores or transmits any form of sensitive personal data, encryption is non-negotiable.
Recommended practices:
- Encrypt data at rest and in transit using standard protocols (e.g., AES-256, TLS 1.2+).
- Enable role-based access and enforce multi-factor authentication (MFA).
- Lock down access to servers, admin panels, and data repositories.
- Maintain endpoint protection for employee devices.
Companies should also document who has access to what system. This is where logs come in, and they must be retained for 180 days under CERT-In.
8. Maintain a Cybersecurity Incident Response Plan
When a breach or suspicious activity is detected, every minute counts. A written incident response plan ensures that the concerned people are informed, the right steps are followed, and the situation is handled without guesswork.
The plan should include:
- Escalation tiers and contact matrix;
- Timeline for each step (detection, reporting, containment, recovery);
- Draft templates for regulatory and customer notifications;
- A logbook or digital system to document steps taken.
9. Prepare for a Data Breach Investigation
If a breach occurs, the priority is to contain the damage, but equally, to preserve evidence. This includes access logs, emails, internal chats, backups, and any notification triggers.
Companies should:
- Do not delete or alter affected systems until evidence is preserved.
- Coordinate with external experts (legal, forensic).
- Notify regulators in writing (not just email).
- Document user communications, timelines, and internal reviews.
10. Maintain Internal Audit and Compliance Reports
Lastly, internal accountability matters. Whether it’s an IT manager or an external consultant, regular review of controls is necessary to stay aligned with changing regulations. A well-structured cybersecurity audit checklist should ideally include:
- Log review and access control reports.
- VPN usage tracking and cloud storage audits.
- Policy review notes (especially for onboarding, exits, BYOD).
- Any changes to systems post-breach or after audit findings.
For businesses in regulated sectors, these reports should be approved by senior management and kept on record for 2–3 years.
Sector-Specific Cybersecurity Guidelines in India
While Indian businesses are generally expected to comply with central laws such as the Information Technology Act, 2000, and CERT-In guidelines, the situation becomes more layered when a business operates in a regulated sector. In such cases, additional frameworks issued by sectoral regulators, like the RBI, SEBI, and IRDAI, impose supplementary obligations that go beyond the default national framework.
Most regulated entities are expected not only to follow baseline security standards but to conduct sector-specific audits, submit periodic compliance reports, and in some cases, even maintain coordination with nodal cybersecurity officers. Below are key examples of how this plays out.
RBI Guidelines for Banks and NBFCs
Banks and non-banking financial companies (NBFCs) regulated by the Reserve Bank of India are required to comply with the “Cyber Security Framework in Banks” circular issued in 2016 and later updates issued through Master Directions.
Some key elements include:
- Maintenance of a Board-approved cybersecurity policy.
- Deployment of Security Operations Centre (SOC) either internally or through managed service providers.
- Regular cyber drills and table-top exercises.
- Real-time threat intelligence sharing with RBI and CERT-In.
- Reporting of unusual incidents or breaches within specified timelines.
The RBI framework forms one of the most detailed sector-specific extensions of the central cybersecurity regulations for businesses in India. Failure to comply has led to warnings, monetary penalties, and in some cases, restrictions on onboarding new customers.
SEBI Cybersecurity Framework for Market Intermediaries
The Securities and Exchange Board of India (SEBI) issued a comprehensive framework on “Cyber Security & Cyber Resilience” applicable to stock brokers, mutual fund platforms, and market infrastructure institutions (MIIs).
The core expectations include:
- Appointment of a Chief Information Security Officer (CISO).
- Classification of systems based on risk categories.
- Implementation of multi-factor authentication.
- Regular vulnerability assessment and patch management.
- Independent security audits every six months (minimum).
These requirements are over and above any obligations under the IT Act or SPDI Rules. The idea is to ensure that systemic risks to the financial market are not triggered due to a lapse at an intermediary level.
IRDAI Guidelines for Insurance Companies
The Insurance Regulatory and Development Authority of India (IRDAI) released its “Information and Cyber Security Guidelines” in 2017, which apply to all insurers and third-party administrators (TPAs).
Key mandates:
- Maintenance of an Information Security Committee chaired by the CEO or the senior-most IT officer.
- Implementation of layered security architecture.
- Annual third-party audit by CERT-In empanelled auditors.
- Data loss prevention controls, especially in customer-facing portals.
- Submission of breach reports and security audit findings to IRDAI.
Companies in the insurance sector must integrate these into their cybersecurity compliance checklist, especially in the context of health and financial data, which falls under sensitive personal data.
Healthcare Sector Obligations Under DISHA (Pending)
The Digital Information Security in Healthcare Act (DISHA), although not implemented, highlights the government’s intent to create a separate data protection framework for health records.
Key provisions included:
- Strict control over access to Electronic Health Records (EHR)
- Specific obligations on hospitals, clinics, and aggregators handling health data
- Patient consent protocols for data sharing
- Mandatory breach reporting to the National Digital Health Authority
E-Commerce and Telecom-Specific Security Expectations
Entities in the e-commerce, OTT, and telecom sectors are subject to platform-specific guidelines, some of which are issued by the Ministry of Electronics and IT (MeitY), Department of Telecommunications (DoT), and TRAI.
Examples:
- DoT guidelines mandate licensees to maintain logs of network activity for a minimum period.
- E-commerce platforms are expected to enable secure payments, maintain consent records, and encrypt customer data.
- OTT platforms may be asked to implement standardised data governance frameworks in alignment with the DPDPA 2023.
Businesses operating in these domains should ensure that their compliance requirements are not restricted to the IT Act alone. Failure to comply may impact licensing, data localisation obligations, and user trust.
UPCOMING TRENDS & EVOLVING LEGAL RISKS
Enforcement of DPDPA 2023: A New Era of Data Responsibility
The Digital Personal Data Protection Act, 2023 (DPDPA) has created a standalone compliance obligation for almost every Indian business handling digital personal data, whether collected directly from users or passed through vendors.
Key upcoming risks include:
- Enforcement actions from the new Data Protection Board of India
- Introduction of standard contractual clauses (SCCs) for data processors
- Heavy financial penalties (up to ₹250 crore per breach incident)
- Mandatory classification of certain businesses as “Significant Data Fiduciaries” based on volume and risk
- Sector-specific codes of practice to be notified by the Government
This is a major shift. For most companies, this means revisiting every policy to ensure that it now aligns with DPDPA obligations.
Cross-Border Data Transfer Restrictions
With the global debate on digital sovereignty escalating, the regulators are placing increased emphasis on the storage, processing, and transfer of personal data beyond national borders.
Implications include:
- Need for data localisation in certain sectors (e.g., banking, payments, telecom);
- DPDPA-based restrictions on cross-border transfers without a government whitelist;
- Contractual clauses for vendors based outside India;
- Potential exposure to dual enforcement (India and host jurisdiction).
Businesses working with global cloud providers or processing international customer data must adjust their data protection compliance in India accordingly, especially in finance and healthcare sectors.
Cybersecurity Challenges with AI and Autonomous Systems
AI-based tools are now being widely used in customer support, credit scoring, recruitment, and fraud detection. However, these bring their own set of risks, including:
- Black box vulnerabilities in algorithmic decision-making.
- Exposure to adversarial attacks.
- Risk of unauthorised training on personal data.
- Legal questions around liability for AI-driven actions.
Indian authorities are beginning to pay attention. Businesses that rely on AI must embed privacy-by-design into their tools and ensure internal alignment with Indian cybersecurity laws.
Privacy-by-Design and Security-by-Design Expectations
Going forward, the regulatory mood is moving away from reactive enforcement toward proactive design mandates.
This includes:
- Conducting Data Protection Impact Assessments (DPIAs).
- Embedding controls into product and application design.
- Using privacy-enhancing technologies (PETs).
- Setting internal design review checkpoints for new systems.
These concepts will become central to compliance strategy. Businesses should treat them as baseline components of a well-integrated cybersecurity compliance checklist.
Penalties for Non-Compliance: Legal & Financial Exposure
The cost of non-compliance in matters of cybersecurity has, over the past few years, shifted from reputational risk to full-fledged legal and financial exposure. Indian regulators no longer treat security lapses or delayed breach notifications as IT department failures; they are seen as lapses of governance and oversight. This is especially true for sectors where sensitive data is collected, processed, or transferred regularly.
From administrative fines under the Digital Personal Data Protection Act, 2023, to criminal prosecution under provisions of the Information Technology Act, 2000, businesses now face multi-layered risk. The exposure is not limited to fines; it includes loss of business, client claims, audit notices, and sometimes even Board scrutiny.
Fines under the Digital Personal Data Protection Act, 2023 (DPDPA)
The DPDPA introduces a separate chapter on penalties. It empowers the Data Protection Board of India to impose significant fines on data fiduciaries and processors.
Notable provisions include:
- A maximum penalty of ₹250 crore for failure to implement reasonable security safeguards;
- ₹200 crore for breach of children’s data processing obligations;
- ₹150 crore for non-fulfilment of data principal rights;
- “Per instance” penalty structure (meaning repeated failures can lead to cumulative fines).
Many businesses assume that unless a breach affects thousands of users, enforcement risk is low. That’s incorrect. The law is designed to penalise poor systems, not just large-scale loss. Every cybersecurity compliance checklist must now treat DPDPA as the central statute.
Liability under the Information Technology Act, 2000
While the DPDPA is forward-looking, the IT Act continues to be the primary law for penalising failures in cybersecurity.
Key provisions include:
- Section 43A: Compensation for failure to protect sensitive personal data.
- Section 66: Criminal liability for hacking or unauthorised access (up to 3 years’ imprisonment).
- Section 72A: Punishment for disclosure of personal data without consent.
These provisions have already been invoked in enforcement cases involving telecom companies, credit agencies, and BPOs. Courts have interpreted “reasonable security practices” under Section 43A to include audit logs, access controls, encryption, and documented internal protocols.
Contractual Liability and Indemnification Exposure
In businesses, especially where personal data is exchanged or accessed, a failure to implement proper cybersecurity controls can result in a breach of contract.
Scenarios include:
- Failure to notify a client within the agreed breach window.
- Processing of data without encryption or access controls.
- Non-compliance with contractual audit or reporting obligations.
- Lack of alignment with foreign laws when working with offshore clients.
The standard indemnity clause in most agreements today includes cybersecurity obligations. If breached, the business may be required to compensate not just for regulatory fines, but also for business disruption, brand damage, and client litigation.
In practice, these risks can surpass direct penalties under Indian law. Every business must include contract review as a parallel stream.
Criminal Exposure and Personal Liability
It is not widely known that cybersecurity lapses may result in personal liability, especially where data is handled recklessly or breach reports are deliberately suppressed.
The following apply:
- Section 66 (IT Act): Up to 3 years’ imprisonment for unauthorised access.
- Section 72A (IT Act): Up to 2 years’ imprisonment for wrongful disclosure.
- Directors can be held accountable under certain provisions of the Companies Act if lapses amount to negligence in governance.
In regulated sectors, enforcement may come in the form of show-cause notices, license suspensions, or even naming and shaming by regulatory orders. Legal teams must stay closely aligned with IT and compliance departments, particularly in crises.
Business Consequences Beyond Legal Fines
Apart from formal penalties, cybersecurity non-compliances often lead to longer-lasting consequences:
- Decline in client trust;
- Problems in investor due diligence rounds;
- Increase in cyber insurance premiums or denial of cover;
- Public scrutiny on social media or media leaks;
- Potential downgrading of vendor reliability rankings.
These consequences may not show up in legal notices, but they affect the business’s bottom line. Integrating such compliances into overall governance policy is now a commercial necessity, not a regulatory checkbox.
Checklist Summary Table: Cybersecurity Compliance Essentials
The following table summarises the core legal and operational items that businesses must track on an ongoing basis. This can serve as a live internal tool for audits and board reporting.
The business may update the frequency and documentation columns based on sector and team capacity.
| Compliance Area | Legal Source / Guideline | Recommended Action | Frequency / Documentation Required |
| Data Protection Officer Appointment | DPDPA 2023 | Appoint DPO if classified as Significant Data Fiduciary | At least annually, Board sign-off on action taken |
| Breach Notification Protocols | CERT-In Guidelines, DPDPA 2023 | Notify breaches within 6 hours (CERT-In); reasonable time (DPDPA) | Maintain incident response playbook, regulator email drafts |
| Cybersecurity Policies (IT, AUP, IRP) | IT Act, Sectoral Guidelines, DPDPA | Document and circulate formal policies to staff/vendors | Annual review; Store signed acceptance and version control |
| Vendor Contracts and Due Diligence | DPDPA, Contract Law | Add breach clauses, indemnity, and audit rights | Onboarding and annual review; Archive signed agreements |
| Risk Assessments & Vulnerability Scan | RBI/SEBI Circulars, CERT-In Guidelines | Run and record scans, remediate gaps | Quarterly or bi-annual; Preserve final reports and responses |
| Employee Training on Cyber Hygiene | Sectoral Guidelines, DPDPA 2023 | Phishing simulations, awareness sessions | Bi-annual minimum; Attendance logs and training material |
| Encryption & Access Controls | SPDI Rules, CERT-In, DPDPA | Encrypt PII, enforce MFA and RBAC | Ongoing; Record tech logs and internal IT reviews |
| Internal Cybersecurity Audit Reports | Sectoral Requirements (RBI, IRDAI, SEBI), Company Policy | Conduct internal or third-party audits | At least annually, the Board signs off on action taken |
Conclusion
In practice, many companies still tend to treat cybersecurity like a backend IT issue, until something breaks. But by the time there’s a breach, or worse, a regulatory notice, it’s already too late to build a compliance process from scratch. The environment today isn’t what it was a few years ago; regulators are more proactive, enforcement has picked up, and the general expectation is that companies should already have minimum safeguards in place.
What used to be good practice has now moved into the realm of legal obligation. And this applies across sectors, whether it’s a fintech firm onboarding users, a hospital digitising patient records, or a D2C platform managing order databases. Almost every business that deals with digital systems has to now build some kind of internal cybersecurity program that ticks off legal, technical, and operational boxes.
The Digital Personal Data Protection Act, 2023, has raised the stakes further. With a penalty structure that goes as high as ₹250 crore for non-compliance, companies can’t rely on informal IT setups or verbal assurances anymore. The regulator is not likely to be satisfied by intent; they will ask for documentation. Whether that means an audit trail, log preservation proof, or the actual version of the IT policy circulated to staff last year, the ability to show, not just say, is what will matter.
Some practical measures companies should consider, not as a checklist to keep on a shelf, but as a live framework:
- Start with a basic cybersecurity compliance checklist, preferably adapted to the company’s actual operations. Avoid templatised formats that don’t reflect the data flows or vendor ecosystem.
- Set up a calendar for quarterly internal reviews.
- Review existing contracts, especially vendor or client-facing, to identify what cybersecurity obligations have been signed up for, and whether they’re being met in practice.
- If the company has seen rapid growth in the past 12–18 months, take a fresh look at onboarding and offboarding processes, especially access to shared drives, cloud systems, and customer data.
- For cross-border data activities, check what logs, policies, or approvals are in place. A lot of companies use SaaS tools that store data overseas, and this will matter under DPDPA and even client due diligence.
At the end of the day, cybersecurity regulations for businesses in India aren’t just about preventing hacks. They’re about creating internal systems that work when things go wrong, and they will, eventually. Whether it’s an accidental leak, a malicious insider, or a zero-day exploit, the companies that survive and recover are the ready ones, even if not perfect.
So if there’s one practical takeaway from all of this, it’s simple: don’t wait for a breach to find out what your policy says. Build a framework that works even when you’re under pressure. That’s what real compliance looks like now.
Frequently Asked Questions (FAQs)
1. What laws govern cybersecurity in India?
The primary statutes are the Information Technology Act, 2000 (amended in 2008), the CERT-In Guidelines (April 2022), and the Digital Personal Data Protection Act, 2023. Depending on the sector, businesses may also have to comply with RBI, SEBI, or IRDAI circulars.
2. Is the DPDPA 2023 applicable to all businesses?
Yes. The DPDPA 2023 applies to any business processing digital personal data of individuals within India. This includes e-commerce platforms, financial apps, SaaS providers, service firms, and even non-tech organisations that collect employee or customer information. The law introduces a central set of data protection compliance applicable to both data fiduciaries and processors.
3. What is the CERT-In 6-hour breach rule?
CERT-In requires that certain types of cyber incidents (e.g., unauthorized access, system hacks, DDoS attacks) be reported within six hours of detection. This is one of the shortest breach notification windows in the world and is enforceable on VPN providers, data centres, cloud service providers, and other specified entities. This rule is a key inclusion in any cybersecurity compliance checklist.
4. What are the most common mistakes businesses make?
The most common compliance gaps include:
- Lack of written policies and procedures
- Incomplete or outdated vendor contracts
- Not training employees on cyber hygiene
- Failure to maintain audit logs or document access control
- Delays in notifying regulators or affected parties during breaches
5. Can directors be held personally liable for cybersecurity lapses?
Yes. If a company is found to have acted negligently or failed to implement “reasonable security practices”, directors may be exposed to penalties under the IT Act or other corporate governance laws. The Companies Act also allows regulatory authorities to hold directors accountable for failure in internal controls.
6. Does outsourcing IT or data processing remove liability?
No. Under the DPDPA 2023, the data fiduciary (i.e., the primary business collecting the data) remains responsible, even if processing is outsourced. This makes vendor due diligence, contract clauses, and ongoing monitoring critical. Any data protection framework must include third-party risk management.
7. Are small and medium businesses (SMBs) exempt from these laws?
There are no blanket exemptions for SMBs. While smaller companies may not be classified as “Significant Data Fiduciaries” under the DPDPA, they are still subject to core provisions related to consent, security, and breach notification. Many startups and mid-sized entities now serve regulated clients, so compliance is often contractually required even before statutory thresholds kick in.
8. How often should companies update their cybersecurity documentation?
At a minimum, all cybersecurity and data protection documents should be reviewed annually. However, any major system update, breach, regulatory notification, or business expansion should trigger an immediate review. This includes policies related to encryption, data access, breach reporting, and vendor engagement.
About Us
Corrida Legal is a boutique corporate & employment law firm serving as a strategic partner to businesses by helping them navigate transactions, fundraising-investor readiness, operational contracts, workforce management, data privacy, and disputes. The firm provides specialized and end-to-end corporate & employment law solutions, thereby eliminating the need for multiple law firm engagements. We are actively working on transactional drafting & advisory, operational & employment-related contracts, POSH, HR & data privacy-related compliances and audits, India-entry strategy & incorporation, statutory and labour law-related licenses, and registrations, and we defend our clients before all Indian courts to ensure seamless operations.
We keep our client’s future-ready by ensuring compliance with the upcoming Indian Labour codes on Wages, Industrial Relations, Social Security, Occupational Safety, Health, and Working Conditions – and the Digital Personal Data Protection Act, 2023. With offices across India including Gurgaon, Mumbai and Delhi coupled with global partnerships with international law firms in Dubai, Singapore, the United Kingdom, and the USA, we are the preferred law firm for India entry and international business setups. Reach out to us on LinkedIn or contact us at contact@corridalegal.com/+91-9211410147 in case you require any legal assistance. Visit our publications page for detailed articles on contemporary legal issues and updates.