What the law actually requires
DPDP Act, 2023
Fines of up to ₹250 Crore per breach. Any company processing the personal data of Indian citizens is in scope — compliance is no longer discretionary.
CERT-In reporting mandate
A strict 6-hour incident reporting window, 180-day log retention and 5-year record keeping, with penalties for non-compliance.
A rising attack surface
CERT-In recorded roughly 13.91 lakh cybersecurity incidents in 2022 — up three-fold in three years. Every publicised breach is a live compliance test.
Download the playbooks
DPDP Compliance Guide
For IT/ITES — a working checklist against the Act’s core obligations.
CERT-In Reporting Checklist
What a CISO needs ready before the 6-hour clock starts.
Sector Risk Briefings
The current cyber-security directions from India’s financial regulators, by sector — straight from the official source.
Official sources: Reserve Bank of India, Insurance Regulatory and Development Authority of India, Securities and Exchange Board of India. Links open the regulator’s own PDF; check the regulator’s website for any later amendments.
DPDP and CERT-In, answered
Who does the DPDP Act apply to?
The Digital Personal Data Protection Act, 2023 applies to organisations that process digital personal data in India, and to processing outside India that is connected with offering goods or services to people in India.
What are the penalties under the DPDP Act?
Penalties go up to ₹250 crore per instance — for example, for failing to take reasonable security safeguards to prevent a personal data breach.
When do the DPDP Rules apply?
The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 and take effect in phases. Most obligations, including consent, breach notification and children’s data, apply from May 2027.
What must be reported to CERT-In, and how fast?
Under CERT-In’s Directions of 28 April 2022, specified cyber incidents — including ransomware, data breaches and unauthorised access — must be reported to CERT-In within 6 hours of noticing them.
Is cyber insurance mandatory in India?
There is no general legal requirement. The DPDP Act and CERT-In Directions set the baseline: reasonable security safeguards, breach notification and 6-hour incident reporting. A cyber risk plan builds on that with assessment, controls and incident response, and cyber insurance covers the financial impact of what remains.