In short
India has no single cyber security law. The rules come in layers: the IT Act and its 2011 rules, the CERT-In Directions, the DPDP Act, sector regulators, government project terms, and voluntary standards. Most businesses face the first three. Each layer below links to its own article. The common thread for software is the same: access control, logs you can trust, and a way to spot and report an incident fast.
Who it applies to
- Every business with computers or a website: the IT Act and SPDI Rules and the CERT-In Directions.
- Every business holding personal data, of customers, staff or supplier contacts: the DPDP Act.
- Banks, payment firms, brokers, fund managers and insurers: their regulator’s rules on top.
- Vendors to ministries and public bodies: audit and hosting conditions in the contract.
- Anyone selling to large or foreign buyers: the standards those buyers ask for.
What it means for your website
- Privacy policy and grievance contact. Required by the SPDI Rules if you collect sensitive data such as passwords or payment details. The DPDP Act adds a notice before collection and a published contact.
- Consent. Real consent before collecting personal data and before non-essential cookies, with an easy way to withdraw.
- Logs and monitoring. Web server and WAF logs count under the CERT-In Directions. Defacement and DDoS attacks are reportable incidents.
- Regulated sectors have extra website disclosures. See SEBI website requirements and RBI payments and e-commerce.
- Government websites follow the Guidelines for Indian Government Websites (GIGW). See Government projects.
What it means for your software
Layer 1: the IT Act and 2011 Rules
The Information Technology Act, 2000 makes unauthorised access, data theft and system damage civil wrongs and crimes. Section 43A makes a business pay compensation if it negligently fails to protect sensitive personal data. The 2011 SPDI Rules require consent, limits on sharing, and a documented security programme audited every year. Section 43A and the Rules are due to be replaced by the DPDP Act in May 2027. Read more: IT Act and SPDI Rules.
Layer 2: the CERT-In Directions
Since 27 June 2022, listed cyber incidents must be reported to CERT-In within 6 hours. Logs of all ICT systems must be kept for a rolling 180 days. Clocks must sync to NIC or NPL time servers, and a point of contact must be named. Hosting, cloud and VPN providers keep customer records for 5 years. Read more: CERT-In Directions.
Layer 3: the DPDP Act
The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 cover all digital personal data. Systems need consent records, rights requests, retention and erasure rules, security safeguards and logs kept for at least a year. Breaches go to the Data Protection Board, with a detailed report within 72 hours. Most duties apply from May 2027, and penalties go up to ₹250 crore. Read more: DPDP Act.
Layer 4: sector regulators
- RBI: payment system data must be stored only in India, and banks and regulated entities follow RBI’s IT governance and cyber security directions. See RBI IT governance and RBI payments and e-commerce.
- SEBI: the Cybersecurity and Cyber Resilience Framework (CSCRF) for regulated entities such as brokers and fund managers. See SEBI CSCRF.
- IRDAI: Information and Cyber Security Guidelines for insurers and intermediaries. See IRDAI cyber security.
If you build software for these businesses, their regulator’s rules flow down to you through the contract.
Layer 5: government projects
Ministries and public bodies usually require a security audit by a CERT-In empanelled auditor before a system goes live, and periodically after. CERT-In’s audit policy guidelines of July 2025 expect audits at least once a year. Defence and other sensitive projects add their own clearance and hosting conditions. Read more: Government projects.
Layer 6: voluntary standards
No Indian law requires these for every business, but buyers often do.
- ISO/IEC 27001: the international standard for an information security management system. The SPDI Rules name it as one way to show reasonable security. See ISO 27001.
- SOC 2: an audit report many US clients ask of software vendors. See SOC 2.
- VAPT: vulnerability assessment and penetration testing, often required from a CERT-In empanelled auditor. See VAPT.
- PCI DSS: the card industry’s security standard, for businesses that store, process or transmit card data. See PCI DSS.
Checklist
- Work out which layers apply: everyone has layers 1 to 3; add 4 to 6 by sector and buyer.
- Map where your systems hold personal and sensitive data.
- Turn on role-based access and encrypt sensitive fields.
- Enable logs on all systems, synced to one time source, and keep them for at least a year.
- Write an incident runbook that meets CERT-In’s 6-hour deadline and the DPDP breach rules.
- Name a CERT-In point of contact and a grievance officer, and publish the grievance contact.
- Publish a privacy policy and notices that match what your systems actually do.
- Check your sector regulator’s rules if you serve banks, brokers or insurers.
- Plan a VAPT before go-live and after major changes.
- Decide which standard, if any, your buyers need: ISO 27001, SOC 2 or PCI DSS.
How Kreon helps
We build ERP, CRM, warehouse, HR and AI systems with role-based access, logging and synced timestamps designed in, so the IT Act, CERT-In and DPDP layers are easier to meet. Kreon ERP keeps a full audit trail of every change, with the values before and after and the option to revert. We have deployed systems in the Indian defence sector and built systems that passed independent VAPT, and we will tell you plainly where you need an outside auditor.