India: the DPDP Act 2023 and CERT-In directions

Why every Indian security professional needs these

If you work in a SOC, in GRC or as a security engineer for an Indian company (or a foreign company with Indian operations), these two sets of rules decide what you must do when something goes wrong, and how fast. Interviewers ask about them.

Part 1: the DPDP Act, 2023

The Digital Personal Data Protection Act, 2023 received Presidential assent in August 2023. The DPDP Rules, 2025 were notified in November 2025, with most duties of businesses coming into force in phases over about 18 months.

Main duties of a Data Fiduciary:

• Give a clear notice saying what data is collected and why, in plain language (and on request in English or any language in the Eighth Schedule of the Constitution).
• Take consent that is free, specific, informed, unconditional and unambiguous, by a clear affirmative action, and let people withdraw it as easily as they gave it. Some "legitimate uses" do not need consent, such as data a person voluntarily gave for a specific purpose, or legal obligations.
• Use data only for the stated purpose and erase it when no longer needed (unless law requires keeping it).
• Take reasonable security safeguards to prevent personal data breaches, including making processors do the same.
• If a personal data breach happens, inform the Data Protection Board and each affected Data Principal. The DPDP Rules require prompt intimation and a detailed report to the Board within 72 hours.
• Children (under 18): verifiable consent of a parent or guardian, and no tracking, behavioural monitoring or targeted advertising directed at children.
• Publish contact details for questions and run a grievance redressal process.
• Significant Data Fiduciaries must also appoint a Data Protection Officer based in India, an independent data auditor, and carry out data protection impact assessments.

Rights of a Data Principal include: getting information about their data and processing, correction and erasure, grievance redressal, and nominating someone to act for them after death or incapacity. They also have duties, such as not giving false information.

Part 2: CERT-In directions of 28 April 2022

CERT-In (the Indian Computer Emergency Response Team) is the national agency for cyber incident response under Section 70B of the IT Act. Its directions of 28 April 2022 apply to service providers, intermediaries, data centres, body corporates and government organisations. Key points:

• Report listed types of cyber incidents (for example ransomware, data breaches, compromise of critical systems, attacks on servers and applications, unauthorised access to social media accounts) to CERT-In within 6 hours of noticing them or being told about them.
• Enable logs of all ICT systems and keep them for a rolling 180 days, maintained within Indian jurisdiction, and provide them to CERT-In when asked.
• Connect to and sync clocks with the NTP servers of the National Informatics Centre (NIC) or the National Physical Laboratory (NPL), or with sources traceable to them.
• Name a Point of Contact to deal with CERT-In.
• Data centres, cloud and VPS providers, and VPN service providers must keep certain subscriber records for 5 years; virtual asset providers must keep KYC and transaction records for 5 years.

Reports are made through the channels listed on the CERT-In website (such as its incident reporting email and form). The 6-hour clock starts when the incident is noticed, so SOC playbooks must name who decides "this is reportable" and who sends the report.

from datetime import datetime, timedelta

noticed = datetime(2026, 3, 14, 1, 40)
deadline = noticed + timedelta(hours=6)
print(deadline.strftime("%d %b %Y %H:%M IST"))

Common mistakes

• Waiting until the investigation is complete before reporting. Send an initial report within 6 hours and update later.
• Keeping only 30 days of logs, or storing them only outside India.
• Clocks not synced, making timelines and reports wrong.
• Treating DPDP as "just a privacy team problem". Security safeguards and breach detection are core security work.