Indian statutes, rules and regulator directions for IT and technology companies: the IT Act 2000, DPDP Act, CERT-In Directions, intermediary rules, and RBI, SEBI and IRDAI cyber rules.
India's IT laws rest on one statute, the Information Technology Act, 2000, and the rules and directions made under it. Personal data now has its own law, the Digital Personal Data Protection Act, 2023, with its Rules being brought into force in phases. Sector regulators add their own cyber security requirements for the banks, market participants and insurers they supervise, and those requirements flow down to IT vendors through outsourcing contracts and audits.
Laws and rules for every company
The IT Act gives legal recognition to electronic records and signatures, defines cyber offences, and contains the provisions on compensation for failure to protect data (section 43A) and on disclosure of information in breach of a contract (section 72A). The CERT-In Directions of April 2022, issued under section 70B, require incidents to be reported within six hours of being noticed and logs to be kept for 180 days, among other duties. The 2011 SPDI Rules set reasonable security practices for sensitive personal data and remain relevant while the DPDP Act phases in. The IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 apply to platforms that host user content.
Sector regulators
The Reserve Bank of India's 2026 cybersecurity and technology risk directions and its payment data storage directive apply to regulated financial entities and payment operators. SEBI's Cybersecurity and Cyber Resilience Framework applies to regulated market entities, and IRDAI has its own information and cyber security guidelines for insurers. MeitY empanels cloud services for government use.
Why this matters for IT exporters too
Indian IT companies serving only foreign clients still operate under Indian law for their own systems, staff data and incident reporting. The guides explain each requirement with a reference to the official notification.
At a glance
Mandatory or voluntary: indian it laws & regulations
India. Applies to intermediaries offering services to users in India, including foreign platforms, and to digital news publishers and online curated content providers.
Ministry of Electronics and Information Technology (MeitY), with Part III administered by the Ministry of Information and Broadcasting
India. Applies to RBI-regulated entities, with separate entity-wise directions for commercial banks, small finance banks, NBFCs, credit information companies, all-India financial institutions and others.
India. Applies to payment system operators authorised by RBI and to the banks, gateways, intermediaries and vendors in their payment chains, including foreign card networks.
Reserve Bank of India, Department of Payment and Settlement Systems
India. Applies to body corporates handling sensitive personal data or information in computer resources, until section 43A of the IT Act is omitted by the DPDP Act.
Ministry of Electronics and Information Technology (then the Department of Information Technology), under section 43A and section 87 of the IT Act, 2000
India. Applies to hospitals, clinics, labs, pharmacies, health apps and software vendors that choose to integrate with ABDM, and to government health programmes that require it.
National Health Authority (NHA), Ministry of Health and Family Welfare
CERT-In Cyber Security Directions No. 20(3)/2022-CERT-In of 28 April 2022 under section 70B(6) of the IT Act, 2000
The CERT-In Directions of 28 April 2022 are binding cyber security directions issued by India's national computer emergency response team under section 70B(6) of the IT Act. They require service providers, intermediaries, data centres, body corporates and government organisations to report 20 types of cyber incidents to CERT-In within six hours of noticing them, keep logs of all ICT systems for 180 days within Indian jurisdiction, synchronise clocks to national time servers, and name a point of contact. Cloud, data centre and VPN providers have extra customer record duties.
Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025
The Digital Personal Data Protection Act, 2023 is India's first general law on personal data. It regulates the processing of digital personal data by data fiduciaries, gives people rights over their data, requires consent or a listed legitimate use, sets security and breach reporting duties, and creates the Data Protection Board of India. Its Rules were notified in November 2025 and are coming into force in phases through May 2027. Penalties reach 250 crore rupees per instance.
The Information Technology Act, 2000 (Act No. 21 of 2000), as amended by the Information Technology (Amendment) Act, 2008
The Information Technology Act, 2000 is India's core law for electronic commerce, electronic records and cyber security. It gives legal recognition to electronic records and digital signatures, defines cyber offences such as hacking, identity theft and data theft, sets compensation for unauthorised access and for failing to protect sensitive personal data, regulates intermediaries, and gives the government and CERT-In powers over incidents, blocking and interception. Most rules that apply to IT companies, from CERT-In Directions to the intermediary rules, are made under it.
IRDAI Information and Cyber Security Guidelines, 2026 (revising the 2023 Guidelines on Information and Cyber Security for Regulated Entities)
IRDAI's Information and Cyber Security Guidelines set minimum security standards and governance for insurers and insurance intermediaries in India. The 2026 revision, issued on 6 April 2026 and applicable from the 2026-27 financial year, keeps the 2023 structure but strengthens governance: quarterly security committee meetings, a new IT Steering Committee, an independent and technically qualified CISO, risk-based budgets, independent experts on the risk committee, and remediation of audit gaps within 12 months.
Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended up to 2026
India's IT Rules 2021 set the due diligence that intermediaries such as social media platforms, marketplaces, hosting providers, app stores and messaging services must follow to keep legal immunity for user content. They require published rules for users, grievance officers, fast removal of unlawful content on orders, data retention and cooperation with authorities. Significant social media intermediaries have extra duties, and 2026 amendments added labelling of AI-generated synthetic content and much shorter takedown deadlines.
Reserve Bank of India Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026 (successor to the 2023 Master Direction on IT Governance, Risk, Controls and Assurance Practices)
RBI's technology directions set how banks, NBFCs and other regulated entities govern IT, manage cyber and technology risk, run operations, audit systems and recover from disruption. Issued as entity-wise directions on 31 July 2026, they replace the 2023 IT Governance Master Direction and older cyber security circulars. They require board IT strategy committees, a CISO, IT and security policies, vulnerability testing, disaster recovery drills, IS audits, vendor oversight and cyber incident reporting to RBI within six hours.
Reserve Bank of India directive on Storage of Payment System Data (circular DPSS.CO.OD No. 2785/06.08.005/2017-18, 6 April 2018) and FAQs of 26 June 2019
RBI's payment data localisation directive requires the entire data relating to payment systems operated in India to be stored only in systems located in India. Processing may happen abroad, but the data must then be deleted overseas and brought back within one business day or 24 hours, whichever is earlier. It applies to card networks, wallets, payment aggregators, banks and their gateways and vendors, and compliance is verified through audits by CERT-In empanelled auditors.
SEBI Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities, circular of 20 August 2024 as clarified
SEBI's Cybersecurity and Cyber Resilience Framework sets one cyber standard for stock exchanges, depositories, brokers, mutual funds, portfolio managers, investment advisers and other SEBI-regulated entities. It grades entities into five categories, then sets proportionate requirements for governance, a CISO, security operations, VAPT, cyber audits, a Cyber Capability Index, incident handling, recovery within two hours for critical systems and cloud adoption with data and keys in India.
Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (G.S.R. 313(E))
The SPDI Rules 2011 are India's first rules on personal data protection, made under section 43A of the IT Act. They define sensitive personal data such as passwords, financial information, health records and biometrics, and require body corporates handling it to publish a privacy policy, obtain written consent, limit use and disclosure, control transfers, appoint a grievance officer and implement audited reasonable security practices such as IS/ISO/IEC 27001. They remain in force until the DPDP Act removes section 43A.
Ayushman Bharat Digital Mission (ABDM) and its Health Data Management Policy, with integration standards for health information providers and users
The Ayushman Bharat Digital Mission is India's national digital health ecosystem. It gives people an ABHA health ID, registers health professionals and facilities, and lets health records move between providers and apps only with the patient's consent, through a federated network where records stay with the providers that created them. Its Health Data Management Policy sets rules on consent, privacy, security and data rights, and software must follow ABDM standards and pass sandbox certification to integrate.
India AI Governance Guidelines: Enabling Safe and Trusted AI Innovation (MeitY, IndiaAI Mission, November 2025)
India's AI Governance Guidelines, released by MeitY on 5 November 2025, set out how India intends to govern AI without a standalone AI law for now. They define seven guiding principles, or sutras, and recommendations across six pillars, from infrastructure to accountability. They propose graded liability, AI incident reporting, content authentication, regulatory sandboxes and new institutions, and rely on existing laws such as the IT Act, IT Rules and DPDP Act for enforcement.
MeitY empanelment of cloud service offerings under the MeghRaj (GI Cloud) initiative, with STQC audit
MeitY cloud empanelment is the Government of India's approval of cloud service offerings for use by government and public sector bodies. Under the MeghRaj (GI Cloud) initiative, providers are audited by STQC or empanelled auditors against standards for security, interoperability, data portability, service levels and contract terms, with services hosted in India. Government departments procure from empanelled offerings, and regulators such as SEBI reference empanelment for regulated entities.
The Act and its Rules are being brought into force in phases. The DPDP Act guide lists which provisions apply now and the dates for the rest, with links to the official notifications.
Do CERT-In Directions apply to private IT companies?
Yes. They apply to service providers, intermediaries, data centres, body corporates and government organisations. A body corporate includes any company, so private IT companies are covered.
Is ISO 27001 recognised under Indian law?
The SPDI Rules name IS/ISO/IEC 27001 as one standard that satisfies the requirement for reasonable security practices, subject to audit. The DPDP Rules set their own security safeguards.
We build the parts auditors and privacy laws look for: role-based access, audit logs, encryption, consent records, data export and erasure, and secure development practices. Tell us about your product and get a free quote within one business day.
