The rules your software has to follow.
Plain-language guides to Indian laws, regulators and security standards, and what each one changes in your website and your systems. Every guide ends with the questions people ask most.
NewCompliance updates: 60 recent changes in GST, income tax, TDS, payroll and regulationThe DPDP Act and your software
Any organisation processing digital personal data in India, or abroad when offering goods or services to people in India
Read the guide Ministry of Electronics and ITThe IT Act, the SPDI Rules and your software
Every body corporate in India that holds sensitive personal data in a computer resource, and anyone who uses computer systems
Read the guideCyber security laws in India: a map for software teams
Every business in India that runs a website, app or business software, with extra layers for regulated sectors and government vendors
Read the guide Indian Computer Emergency Response TeamThe CERT-In Directions and your software
Service providers, intermediaries, data centres, body corporates and government organisations using ICT systems in India
Read the guideWhat SEBI requires on your website and app
SEBI-registered intermediaries, market infrastructure institutions and listed companies that run a website or app for investors
Read the guide Securities and Exchange Board of IndiaSEBI's cyber security framework (CSCRF) and your software
SEBI-regulated entities, from stock exchanges and large brokers to mid-size and small intermediaries, scaled by category
Read the guide Reserve Bank of IndiaRBI IT rules for banks and NBFCs, and what they mean for software
Banks, NBFCs, co-operative banks, credit information companies and all-India financial institutions, and the software and cloud vendors they rely on
Read the guide Insurance Regulatory and Development Authority of IndiaIRDAI cyber security rules for insurers and intermediaries
Insurers, foreign reinsurance branches, insurance intermediaries such as brokers, corporate agents, web aggregators and TPAs, and the Insurance Information Bureau
Read the guideRBI payment rules and your online store
Payment aggregators, banks and card networks directly; online merchants, marketplaces and subscription businesses through their payment provider agreements
Read the guide Department of Consumer Affairs and the Central Consumer Protection AuthorityConsumer protection rules and your online store
Marketplace and inventory e-commerce entities, sellers on marketplaces, and foreign platforms that systematically offer goods or services to consumers in India
Read the guide Central Board of Indirect Taxes and CustomsGST e-invoicing and your billing software
GST-registered businesses whose aggregate turnover exceeded ₹5 crore in any financial year from 2017-18, unless in an exempt category
Read the guideVAPT and your software
Government websites and apps, banks and NBFCs, SEBI- and IRDAI-regulated entities, and any business whose clients or contracts ask for an independent security test
Read the guide ISO and IECISO 27001 and your software
Voluntary; any organisation that wants certified information security, often asked for by clients, tenders and regulated customers
Read the guide American Institute of Certified Public AccountantsSOC 2 and your software
Voluntary; service organisations such as SaaS, hosting and IT service vendors whose clients ask for assurance over their controls
Read the guide PCI Security Standards CouncilPCI DSS and your software
Merchants and service providers that store, process or transmit payment card data, or whose systems can affect its security
Read the guideNo guide matches that search. Try a regulator or a law’s short name.
Questions, answered.
What is the Kreon knowledge base?
A free set of plain-language guides on how Indian laws, regulations and security standards affect business websites and software: the DPDP Act, IT Act, CERT-In, SEBI, RBI, IRDAI, GST e-invoicing, consumer protection, government projects, VAPT, ISO 27001, SOC 2 and PCI DSS.
Is this legal advice?
No. Each guide is general information checked against official and expert sources on the date shown. Laws change, so confirm with a lawyer or your auditor before acting.
Which laws affect business software in India?
For most businesses: the Digital Personal Data Protection Act 2023, the Information Technology Act 2000 and its 2011 security rules, the CERT-In Directions of 2022, and GST e-invoicing. Banks, brokers, insurers, e-commerce sellers and government suppliers have further sector rules.
Not sure which rules apply to you?
Tell us your industry and what your systems do. We will tell you which of these apply, and what they mean for your software.