Security Engineering · Chapter 12 of 12
Security regulation in India
CERT-In, the DPDP Act and the sectoral regimes — what actually binds you today, what arrives in 2027, and what changed underneath the banks in July 2026.
A source note, because this chapter breaks the site's usual rule.
Every other chapter here is anchored to the job-posting corpus. These topics score zero in it — CERT-In, RBI cyber and SEBI CSCRF appear in none of 3,010 postings.
That is a fact about the sample, not the subject: the corpus contains no banks, the same limitation the banking book states about itself. So this chapter is written from the regulations and from practitioner sources, with no posting count claimed and none implied.
And one verification limit stated plainly: the Reserve Bank's own documents are behind a challenge page that automated fetching cannot pass, so the RBI material below is corroborated across independent professional write-ups rather than read from the primary text. Check instrument numbers against rbi.org.in before quoting them in anything formal.
The one that already binds you
The CERT-In Directions were issued on 28 April 2022 under the Information Technology Act and took effect that June. They apply extremely broadly — service providers, intermediaries, data centres, companies generally, and government bodies — and they are not a framework you adopt. They are law you are already subject to.
- Six hours to report. The clock runs from noticing an incident or being brought to notice of it — which means a customer emailing you about a leak starts it. Six hours is short enough that it must be a runbook with a named duty holder, not a decision made on the day. Compare the European breach clock at 72 hours, and note what that ratio implies about your on-call design.
- 180 days of logs, retained within India. This is a data-residency obligation as much as a retention one, and it interacts awkwardly with a global logging platform that ships everything to one region.
- Clock synchronisation to designated national time sources, so timelines across organisations can actually be reconciled. Unglamorous and genuinely sensible.
- Extended obligations for certain providers — cloud, virtual private server and VPN providers carry additional customer-record duties.
- Non-compliance is an offence under the IT Act, not a civil penalty regime.
What that means for an engineer, concretely: your incident process needs a documented six-hour path to a filed report, your log platform needs an Indian region for in-scope systems, and somebody must own the question ‘who files, and how, at 2am?’ before it is asked in anger.
The one arriving, and its actual timetable
The Digital Personal Data Protection Act passed in 2023, and its Rules were notified on 14 November 2025. It is India's general privacy law — consent, notice, data-principal rights, security safeguards, breach notification, and a penalty regime.
But it commences in three phases, and the part that matters is furthest away
November 2025 — machinery only. The Act exists; the Data Protection Board is constituted on paper.
November 2026 — consent-manager registration and some Board powers.
May 2027 — consent, notice, security safeguards, breach notification, data-principal rights and the penalties. The substance.
As of mid-2026, the Board had no chairperson or members appointed, recruitment having opened only that May, and no penalty orders or public enforcement actions had issued.
So the honest position: DPDP is a programme to build, not yet a risk to manage. Treating it as imminent enforcement is wrong; treating it as distant is also wrong, because the work — knowing what personal data you hold and where — takes longer than the runway.
And the provision that catches teams who assume it mirrors Europe: the Rules require notifying every affected individual of a personal-data breach regardless of impact or materiality, alongside a two-stage report to the Board. Europe's regime has a risk threshold — you notify individuals when the breach is likely to result in high risk to them. India's does not appear to. A GDPR playbook ported unchanged will under-notify.
The sectoral regimes, and a change most references have not caught up with
If you work in Indian banking, the single most important fact in this chapter:
On 31 July 2026 the Reserve Bank repealed its 2016 Cyber Security Framework — the circular that had been the reference for a decade — as part of a much larger consolidation of its rulebook into Directions organised by regulated-entity type.
Cybersecurity now sits in separate parallel instruments for commercial banks, small finance banks, payments banks, urban co-operative banks, NBFCs and credit information companies, with the commercial-bank one titled around Cybersecurity, Technology: Risk, Resilience and Assurance. Note ‘resilience’ in the title — the same posture as the European regime in the previous chapter.
The practical consequence: any material describing ‘the RBI cyber security framework’ as a single 2016 circular is now out of date, and a great deal of training content, vendor collateral and internal policy still does. Check what your own documents cite.
Six weeks old at the time of writing, corroborated across independent professional sources but not read from RBI's own site — verify before formal use.
For the securities market, SEBI's Cyber Security and Cyber Resilience Framework — circulated 20 August 2024, with compliance dates through 2025 and clarifications since — replaced a scatter of earlier circulars with one framework across exchanges, depositories, brokers and funds. Its concrete asks include a maturity index scoring entities into tiers, a security-operations-centre requirement that may be your own, a group's or a third party's, mandated vulnerability assessment and penetration testing, and ISO 27001 certification for larger entities. Notably, the exchanges were required to stand up a shared ‘Market SOC’ so smaller participants have a route to compliance they could not otherwise afford — a design choice worth noticing, because it acknowledges that a uniform obligation on unequal firms is a barrier rather than a standard.
How the four fit together
| Regime | Who it binds | Reaches technology because |
|---|---|---|
| CERT-In Directions | Almost anyone operating in India | Directly. It is about incidents and logs and nothing else. |
| DPDP | Anyone processing personal data of people in India | Through personal data — security is one obligation among many |
| RBI Directions | Banks, NBFCs and their kin | Directly, and now with resilience named explicitly |
| SEBI CSCRF | Securities-market entities | Directly, with a maturity index and prescribed capabilities |
The pattern worth carrying: older regimes reached technology sideways — through financial reporting, or through prudential risk. The Indian instruments, like the European ones, regulate technology resilience as a first-class object with its own title, its own clock and its own examiner. That is a genuine shift in posture, and it is the reason these obligations feel different from a SOX control walkthrough.
What to actually do
- Find out today whether you can file a CERT-In report within six hours, at 3am, on a weekend. That is the nearest live obligation and the cheapest thing on this list to fix.
- Check where your logs live and whether in-scope systems retain 180 days within India.
- Start the DPDP data mapping now, not in 2027. Knowing what personal data you hold, where, and why is the long pole — the same mapping problem as operational resilience, and doing it once serves both.
- Audit your own policy documents for the repealed RBI circular. A policy citing a repealed instrument is a finding waiting to be written.
- And treat every date in this chapter as needing re-checking. Two of the four regimes changed materially within the last twelve months.
Check yourself