Indian businesses face an increasingly complex cybersecurity compliance landscape that includes the Digital Personal Data Protection (DPDP) Act 2023, ISO 27001 information security standards, and CERT-In mandatory incident reporting directives. Understanding and implementing these frameworks is essential for legal compliance, customer trust, and protection against penalties that can reach 250 crore rupees.
What Does the DPDP Act 2023 Require from Businesses?
The Digital Personal Data Protection Act, 2023 is India’s first comprehensive data protection law. It applies to any organisation that processes digital personal data of individuals in India, regardless of where the organisation is based. Key obligations include:
- Lawful purpose: Personal data can only be processed for a specific, lawful purpose with the individual’s consent or for certain legitimate uses defined in the Act.
- Consent management: Consent must be free, specific, informed, unconditional, and unambiguous. Businesses must implement consent management platforms that record and allow withdrawal of consent.
- Data minimisation: Collect only the data necessary for the stated purpose. Review existing databases and delete data that no longer serves a valid purpose.
- Children’s data: Processing data of individuals under 18 requires verifiable parental consent. Targeted advertising to children is prohibited.
- Breach notification: Data breaches must be reported to the Data Protection Board and affected individuals without delay.
- Penalties: Non-compliance penalties range up to 250 crore rupees depending on the violation severity.
How Does ISO 27001 Certification Help Indian Companies?
ISO 27001 is the international standard for Information Security Management Systems (ISMS). While not legally mandated for most Indian businesses, it provides a structured framework for managing information security risks and is increasingly required by enterprise clients, government contracts, and international partners.
| ISO 27001 Component | What It Covers | Business Benefit |
|---|---|---|
| Risk assessment | Identifying and evaluating information security risks | Prioritised security investments |
| Access control | Who can access what data and systems | Reduced insider threat risk |
| Incident management | Detecting, reporting, and responding to security incidents | Faster recovery, regulatory compliance |
| Business continuity | Maintaining operations during disruptions | Minimised downtime and revenue loss |
| Supplier management | Ensuring third-party security standards | Supply chain risk reduction |
The ISO 27001:2022 update added controls for cloud security, threat intelligence, and data masking. Indian companies pursuing certification should align with the 2022 version.
What Are CERT-In’s Mandatory Reporting Requirements?
The Indian Computer Emergency Response Team (CERT-In) issued directions in April 2022 that significantly tightened cybersecurity obligations for organisations operating in India:
- 6-hour reporting: Cybersecurity incidents must be reported to CERT-In within 6 hours of detection. This includes data breaches, ransomware attacks, DDoS attacks, and unauthorised access.
- Log retention: All ICT system logs must be maintained for 180 days (rolling) within Indian jurisdiction.
- Time synchronisation: All systems must synchronise to Indian NTP servers (NIC or NPL).
- VPN/cloud providers: Must maintain subscriber records for 5 years, including validated customer names, IPs, and usage patterns.
- Crypto exchanges: Must maintain KYC and transaction records for 5 years.
How Should Indian SMBs Approach Compliance Practically?
Small and medium businesses in cities like Udaipur, Jaipur, or Pune often lack dedicated compliance teams. A practical approach:
- Start with a data audit: Map what personal data you collect, where it is stored, who accesses it, and how long you retain it.
- Implement basics first: SSL/TLS, strong password policies, two-factor authentication, regular backups, and employee security training.
- Document everything: Maintain written security policies, consent records, and incident response procedures. Regulators assess documentation.
- Use managed security services: Outsource monitoring and incident response if you cannot maintain an in-house security team.
What is the timeline for DPDP Act enforcement?
The DPDP Act received Presidential assent in August 2023. The government is implementing it in phases through rules that specify operational details. Businesses should not wait for full enforcement to begin compliance; the Act’s principles apply now, and early adopters gain competitive advantage and avoid last-minute scrambles.
How much does ISO 27001 certification cost in India?
For a small-to-medium business, ISO 27001 certification typically costs between 3-8 lakh rupees including consultant fees, internal audit costs, and certification body fees. Annual surveillance audits add 1-3 lakh rupees. The investment pays back through client trust, contract wins, and reduced incident costs.
Does DPDP Act compliance automatically satisfy CERT-In requirements?
No. The DPDP Act and CERT-In directives are separate frameworks with different requirements. DPDP focuses on personal data protection rights, while CERT-In focuses on cybersecurity incident response and infrastructure security. Organisations need to comply with both independently, though there is natural overlap in areas like breach reporting and log management.
What happens if a small business fails to report an incident within 6 hours?
CERT-In can impose penalties and direct remedial actions. The 6-hour window starts from detection, not occurrence. Establish an incident detection and escalation process so the responsible person is alerted immediately. Having a pre-drafted incident report template reduces the reporting time significantly.
