Indian IT law is built on the Information Technology Act 2000 and the rules and directions made under it, with the Digital Personal Data Protection Act 2023 now adding a full privacy regime. CERT-In directions set incident reporting and log duties for almost every IT company, and RBI and SEBI add sector rules for firms that serve banks, NBFCs and the securities market.
6 items in this category
Oct 30, 2026 statuses last checked
At a glance
Indian IT laws and regulations compliance compared
How the items in this category differ on the question that matters first: do you have to, or do you choose to?
India, plus processing abroad for offering goods or services to people in India
Rules notified in November 2025. Board provisions apply now, consent manager rules from about 13 November 2026, and the main duties from about 13 May 2027. A proposal to shorten the 18 months to 12 had not been notified as of our last check.
IT Act 2000
Law
Mandatory by law for organizations in scope
India
As amended by the IT (Amendment) Act 2008. Section 43A and the SPDI Rules 2011 fall away once the DPDP Act fully commences.
CERT-In Directions
Regulation
Mandatory for regulated organizations in scope
India
Directions dated 28 April 2022, in force since June 2022, with FAQs. CERT-In issued Comprehensive Cyber Security Audit Policy Guidelines in July 2025.
IT Rules 2021
Regulation
Mandatory for regulated organizations in scope
India
Amended in 2022, 2023 and again in 2026 with duties to label synthetically generated (AI) content and shorter takedown timelines.
RBI IT and cyber directions
Regulation
Mandatory for regulated organizations in scope
India (RBI-regulated entities)
The 2023 Master Direction on IT governance (effective 1 April 2024) set the current rules. In late 2025 RBI began consolidating its instructions into entity-wise directions (for NBFCs, a 2026 cybersecurity and technology risk direction), so the guide cites the direction that applies to each entity type.
SEBI CSCRF
Regulation
Mandatory for regulated organizations in scope
India (SEBI-regulated entities)
Circular of 20 August 2024, with compliance deadlines extended into 2025 and later clarifications.
Directory
What each one covers and who needs it
Law India, plus processing abroad for offering goods or services to people in India
Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (India)
The DPDP Act is India's first comprehensive data protection law. Data fiduciaries must give clear notice, get free, specific and informed consent or rely on a listed legitimate use, protect data with reasonable security safeguards, report breaches to the Data Protection Board and affected people, erase data when the purpose ends, and honor data principals' rights. Significant data fiduciaries have extra duties such as a data protection officer, impact assessments and audits. Penalties reach 250 crore rupees.
What it covers, who needs it and why
What it covers
Digital personal data processed in India, and processing outside India connected to offering goods or services to people in India.
Who needs it
Every company that processes digital personal data of people in India, including Indian IT and SaaS companies and the processors they use.
Why it matters
It is binding law with large penalties and a fixed timeline, and Indian enterprise buyers are already asking vendors for DPDP readiness.
Key objectives
Lawful processing with consent or a legitimate use
Reasonable security and breach reporting
Rights for data principals
Accountability for data fiduciaries
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
Ministry of Electronics and Information Technology (MeitY); Data Protection Board of India
Current version
Rules notified in November 2025. Board provisions apply now, consent manager rules from about 13 November 2026, and the main duties from about 13 May 2027. A proposal to shorten the 18 months to 12 had not been notified as of our last check.
Information Technology Act, 2000 (India), as amended in 2008, with the SPDI Rules 2011
The IT Act 2000 is India's core law on electronic records, digital signatures, cybercrime and intermediaries. It gives legal recognition to electronic records and signatures, defines offences such as hacking, identity theft and data theft, gives CERT-In its powers under Section 70B, and sets the safe harbor and due diligence conditions for intermediaries under Section 79. Until the DPDP Act fully commences, Section 43A and the SPDI Rules 2011 require reasonable security practices for sensitive personal data.
What it covers, who needs it and why
What it covers
Electronic records and signatures, cyber offences and penalties, intermediary liability, government powers to block, intercept and direct, and (for now) sensitive personal data security.
Who needs it
Every IT company, platform and intermediary operating in India.
Why it matters
It is the base under CERT-In directions, the IT Rules 2021 and many sector rules.
Key objectives
Legal validity for electronic commerce
Define and punish cyber offences
Set intermediary duties and protections
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
Parliament of India; MeitY
Current version
As amended by the IT (Amendment) Act 2008. Section 43A and the SPDI Rules 2011 fall away once the DPDP Act fully commences.
Directions under Section 70B(6) of the IT Act relating to information security practices, procedure, prevention, response and reporting of cyber incidents (28 April 2022)
The CERT-In Directions apply to service providers, intermediaries, data centers, body corporates and government bodies. They require reporting of listed cyber incidents to CERT-In within 6 hours of noticing them, keeping ICT system logs for a rolling 180 days within India, synchronizing clocks to national NTP servers, and naming a point of contact. Data centers, VPS, cloud and VPN providers must also keep subscriber records for five years. They are among the strictest incident reporting timelines anywhere.
What it covers, who needs it and why
What it covers
Cyber incident reporting, log retention, time synchronization, points of contact and subscriber records for certain providers.
Who needs it
Practically every company with IT systems in India, including SaaS companies, data centers, cloud and hosting providers.
Why it matters
Non-compliance is punishable under Section 70B(7), and the 6-hour clock needs a tested process.
Key objectives
Fast national visibility of cyber incidents
Logs available for investigation
A named contact in every organization
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
Indian Computer Emergency Response Team (CERT-In), MeitY
Current version
Directions dated 28 April 2022, in force since June 2022, with FAQs. CERT-In issued Comprehensive Cyber Security Audit Policy Guidelines in July 2025.
IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021
Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (India)
The IT Rules 2021 set due diligence duties that intermediaries must meet to keep safe harbor under Section 79 of the IT Act: publish rules and a privacy policy, act on takedown orders, appoint a grievance officer and resolve complaints within set times. Significant social media intermediaries have extra duties, including a chief compliance officer based in India. Amendments in 2026 require platforms to label AI-generated synthetic content and remove certain unlawful content much faster.
What it covers, who needs it and why
What it covers
Platforms, hosting providers, marketplaces, messaging and social media services, online gaming and digital news publishers.
Who needs it
Intermediaries serving users in India, from small hosting providers to large platforms, and companies offering generative AI features to Indian users.
Why it matters
Losing safe harbor makes the platform liable for its users' content.
Key objectives
Accountable intermediaries
Fast grievance redress
Transparency about synthetic content
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
MeitY (Part II) and the Ministry of Information and Broadcasting (Part III)
Current version
Amended in 2022, 2023 and again in 2026 with duties to label synthetically generated (AI) content and shorter takedown timelines.
Reserve Bank of India directions on IT governance, cyber security, technology risk and IT outsourcing for regulated entities
RBI requires banks, NBFCs, payment system operators and other regulated entities to govern IT and cyber risk at board level: an IT strategy and IT risk committees, information security and cyber resilience programs, business continuity and disaster recovery, IS audit, and controlled outsourcing of IT services and cloud, with audit and access rights for RBI. IT vendors serving Indian banks and NBFCs inherit many of these duties through contracts. RBI consolidated its instructions into entity-wise directions from late 2025, so the exact source depends on the type of entity.
What it covers, who needs it and why
What it covers
IT governance, information and cyber security, technology risk, BCP and DR, IS audit, and outsourcing of IT services for RBI-regulated entities.
Who needs it
Indian banks, NBFCs and payment entities, and the IT, cloud and SaaS vendors that serve them.
Why it matters
RBI supervises compliance closely, and vendor contracts must carry its audit and access rights.
Key objectives
Board-level IT governance
Managed IT and cyber risk
Controlled outsourcing
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
Reserve Bank of India (RBI)
Current version
The 2023 Master Direction on IT governance (effective 1 April 2024) set the current rules. In late 2025 RBI began consolidating its instructions into entity-wise directions (for NBFCs, a 2026 cybersecurity and technology risk direction), so the guide cites the direction that applies to each entity type.
Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities
SEBI's CSCRF replaces earlier cybersecurity circulars with one framework for stock exchanges, depositories, brokers, mutual funds, portfolio managers and other regulated entities. It sorts entities into categories by size and importance and sets standards across the governance, identify, protect, detect, respond and recover functions, including a security operations center, periodic VAPT, cyber audits and incident reporting. Third-party service providers, including IT vendors, must meet requirements passed down through contracts.
What it covers, who needs it and why
What it covers
Cyber governance, risk, security controls, monitoring, incident response and recovery for SEBI-regulated entities and their technology providers.
Who needs it
Indian securities market entities and the software, cloud and managed security providers that serve them.
Why it matters
It is mandatory for regulated entities and audited, and vendors must support evidence requests.
Key objectives
Cyber resilience across the securities market
Proportional controls by category
Regular testing and audit
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
Securities and Exchange Board of India (SEBI)
Current version
Circular of 20 August 2024, with compliance deadlines extended into 2025 and later clarifications.
Train your team on indian it laws and regulations requirements
Most of these frameworks expect trained staff and records to prove it. LMS Advisor assigns the right courses by role, sends reminders, renews certificates on schedule and keeps an audit trail you can export.
Due dates, reminders and overdue reports for mandatory courses
Certificates that expire and renew on your retraining cycle
CSV, Excel and PDF exports of who completed what, and when
LMS Advisor is our product. It runs your training and keeps the records. It does not certify you against any standard.
Book a demo before Dec 1, 2026 and your quote comes with 30% off your first year of LMS Advisor: courses, proctored exams, certificates and AI authoring in one platform, in our cloud or on your own server.
Offer ends Dec 1, 2026, 11:59 PM ET
Cloud or self-hosted, proctoring included
The discount is applied in your written quote
We use cookies to see how visitors use this site and to measure our ads. Choose Continue to allow them, or Reject to browse without them. Privacy policy
LMS Advisor AI
AI product consultant
You're chatting with an AI. Answers can be wrong, so please don't type personal data here. Privacy ·
