Updated: 02 June 2026
By Alok Sah, Head, Cybersecurity, Proactive Data Systems
First published May 2026, updated October 2026.
|
In brief The DPDP Rules, notified on 13 November 2025, set India's cyber compliance timeline. The Consent Manager framework activates on 13 November 2026. The penalty regime, with fines up to ?250 crore, becomes enforceable on 13 May 2027. CERT-In's six-hour incident reporting clock runs every day, and DPDP adds its own: intimation to the Data Protection Board without delay, a detailed report within 72 hours. RBI, SEBI, IRDAI, CEA and DoT each add a sectoral layer. A regulated-sector enterprise can answer to four to six regulators at once. The way through is not six compliance programmes. It is one control set, built once and mapped to every regulator. 2026 is the build year. 2027 is the penalty year. |
This roadmap is for CIOs, CISOs, DPOs, CROs and heads of compliance and legal in Indian enterprises across BFSI, manufacturing, ITeS and BPO, healthcare, power and telecom. It matters most to organisations likely to be designated Significant Data Fiduciaries, those in a regulated sector with its own reporting clock, and those holding personal data of European or US end-customers through a foreign principal, which adds a third notification duty on top of the Indian two. It is operational guidance from public regulatory sources, not legal advice.
Eight, and two of them apply to everyone. The Indian cyber regulatory landscape has two horizontal regimes, DPDP for every organisation processing personal data of individuals in India and CERT-In for every body corporate, and six sectoral ones layered on top.
| Regulation / Authority | Who It Applies To | What It Covers | Status |
|---|---|---|---|
| DPDP Act 2023 and DPDP Rules 2025 | Every Data Fiduciary processing personal data of individuals in India | Lawful processing, data principal rights, reasonable security safeguards, breach notification, Significant Data Fiduciary duties | Penalties enforceable 13 May 2027 |
| CERT-In Directions 2022 | Body corporates, intermediaries, data centres, service providers, government | Mandatory reporting of 20 specified incident categories within six hours; 180-day log retention | In force |
| NCIIPC (Section 70A, IT Act) | Designated critical information infrastructure | Conformity assessment framework drawing on IEC 62443 / IS 16335, ISO 27000, NIST and CIS |
In force |
| RBI cybersecurity directions | Banks, NBFCs, payment system operators | IT framework, periodic VAPT, rapid incident reporting, payment data localisation | In force |
| SEBI CSCRF (August 2024 master circular and advisories) | 22 categories of regulated entity: MIIs, brokers, AMCs, depositories, custodians | ISO 27001 for MIIs and Qualified REs, regular VAPT, Cyber Capability Index, SBOM for critical applications | In force; SBOM advisory 5 May 2026 |
| IRDAI information and cybersecurity guidelines | Insurers and intermediaries | Annual VAPT, board-accountable CISO, third-party risk, incident reporting | In force |
| CEA Cyber Security in Power Sector Guidelines 2021 | Power-sector entities | Electronic security perimeters per IEC 62443 / IS 16335 | In force |
| DoT licensing (UL and UL-VNO) | Telecom and cloud-calling carriers and their on-network customers | Lawful interception, data residency, security clauses | In force |
Four, between May 2026 and May 2027. The first has passed. The next is 13 November 2026.
| Date | Event and Legal Trigger |
|---|---|
| 5 May 2026 | SEBI advisory on AI vulnerability detection; SBOM mandate for critical applications at SEBI-regulated entities. Among the first explicit sectoral SBOM mandates in Indian regulation. |
| 13 November 2026 | DPDP Consent Manager framework activates, 12 months after the Rules. Registration opens; only India-incorporated entities with net worth of at least ?2 crore qualify to register as Consent Managers. |
| Q1 2027 (recommended, not statutory) | Significant Data Fiduciary readiness window: DPO appointed, independent data auditor appointed, DPIA completed for high-risk processing, ahead of the legal trigger. |
| 13 May 2027 | DPDP substantive obligations and penalty regime enforceable, 18 months after the Rules. SDF duties legally binding. The Data Protection Board can impose penalties up to ?250 crore per major violation. |
Until 13 May 2027, the Board exists and can issue guidance, but the penalty provisions are not in force.
Rule 6 sets the technical control set: encryption at rest and in transit, access limited to authorised persons, logs retained for at least one year, the ability to detect and reconstruct an incident, and a breach workflow to the Data Protection Board (intimation without delay, detailed report within 72 hours) and to affected individuals. The full control set is in our DPDP Act Compliance Checklist. Two parts of DPDP need their own work programmes.
Consent capture has to be rebuilt so each purpose is recorded separately, consent artefacts are retained as an audit trail, and there is an API surface that lets a registered Consent Manager read and update a principal's consent state. Most Data Fiduciaries will use a registered Consent Manager rather than register themselves. The detail is in our Consent Manager Framework guide.
For entities likely to be designated (large fintech, telecom, e-commerce, healthcare, social platforms, mobility), DPO appointment, annual independent audit and annual DPIA become enforceable on 13 May 2027. Aim for Q1 2027 to leave a buffer. Deciding and documenting whether you are likely to be designated is itself the first step.
They run in parallel, and one incident can need two filings to two regulators on two timelines. CERT-In requires a report within six hours of noticing or being notified of any of 20 specified incident categories, including unauthorised access, phishing, identity theft, data breach, data leak and ransomware. DPDP requires intimation to the Data Protection Board without delay and a detailed report within 72 hours. The six-hour operating model, the 20 categories and the submission channels are in our India CISO Incident Response Playbook.
DPDP and CERT-In are horizontal. Five sectoral regulators layer on top, each with its own VAPT cycle, reporting clock and accountable officer.
| Regulator | What It Adds |
|---|---|
| RBI | The 2016 Cyber Security Framework for Banks, master directions on IT framework and outsourcing, and the 2018 payment data localisation circular. Periodic VAPT of critical systems is mandatory. Incident reporting timelines are rapid and vary by directive. |
| SEBI | CSCRF applies to 22 categories of regulated entity. ISO 27001 is mandatory for MIIs and Qualified REs. Regular VAPT, the Cyber Capability Index and a dedicated incident reporting portal are baseline. The 5 May 2026 advisory added SBOM for critical applications. |
| IRDAI | Annual VAPT, a board-accountable CISO and third-party cyber risk management for insurers and intermediaries. These govern insurers themselves, not the controls underwriters require of corporate policyholders; those are in our Cyber Insurance Controls guide. |
| CEA | Electronic security perimeters per IEC 62443 / IS 16335 for power-sector entities. See our IEC 62443 OT Security Roadmap. |
| DoT | Lawful-intercept and data-residency clauses in UL and UL-VNO licences, binding on carriers and flowing to their on-network customers. Relevant to any enterprise deploying cloud calling in India. |
Because a regulated-sector estate can be answerable to four to six regulators at once, and six parallel programmes would build the same controls six times. A BFSI enterprise running cloud calling for a contact centre must satisfy RBI norms, DPDP, CERT-In, DoT licensing for the carrier handoff and, with capital-market exposure, SEBI CSCRF. A manufacturer with a pharma unit overlays NCIIPC, customer audits to IEC 62443 and DPDP for HR data. Each regulator has its own reporting clock, from immediate to six hours, with CERT-In's six hours applying to all. The right move is to map controls once and treat the overlap as the point.
Eight. Most of DPDP Rule 6, the CERT-In detection workflow, the RBI IT framework, SEBI CSCRF and the IRDAI annual cycle land on the same control set.
| Control | DPDP Rule 6 | CERT-In | RBI | SEBI CSCRF | IRDAI |
|---|---|---|---|---|---|
| Encryption at rest and in transit | Yes | Detectio signal | Yes | Yes | Yes |
| Phishing-resistant MFA on privileged access | Implicit via access control | Strongly recommended | Yes | Yes | Yes |
| Segmentation between personal-data systems and the general estate | Yes | Reduces blast radius | Yes | Yes | Yes |
| SIEM with one-year minimum log retention | Yes | Needed to reconstruct an incident inside six hours | Yes | Yes | Yes |
| EDR on endpoints and servers | Implicit via detection | Needed for category coverage | Yes | Yes |
Yes |
| Regular VAPT | Implicit via security safeguards | Useful | Mandatory | Mandatory | Annual, mandatory |
| Incident response playbook with multi-regulator notification | Implicit | Six-hour reporting | Rapid, per directive | Immediate, via SEBI portal | Yes |
| Named DPO / grievance officer | Yes, published | Operational contact | Yes (CISO) | Yes | Yes (CISO) |
Build the control once. Map the artefacts to each regulator. Once the control set exists, the cost of each additional regulator is mostly paperwork.
Six moves, in this order. The first is the one everything else depends on.
Personal data inventory. Map every store of personal data, structured and unstructured. Without it, every other DPDP step is guesswork.
Consent capture redesign. For 13 November 2026: each purpose recorded separately, plain-language notice, a verifiable timestamp, and the API surface for a registered Consent Manager.
DPO or grievance officer. Named, published, reachable, with the data principal rights workflow behind one orchestration layer.
Technical control set. Phishing-resistant MFA, segmentation, SIEM with one-year retention, EDR and named-user network access. Cisco ISE is our usual choice for the network layer.
Multi-regulator incident response. One internal trigger that fans out to CERT-In, the Data Protection Board, the sectoral regulator and any foreign principal.
SDF readiness. Decide and document whether you are likely to be designated, then start DPO appointment, auditor selection and the DPIA now. Q1 2027 is closer than it feels.
Proactive Data Systems, a Cisco Preferred Partner across all five architectures under the Cisco 360 Partner Program, with 35 years in Indian enterprise infrastructure, designs and deploys the control set that satisfies Rule 6, the CERT-In detection and reporting workflow and the sectoral overlays, for enterprises in BFSI, manufacturing and ITeS.
Want the gap map for your estate? Book a two-hour India Cyber Compliance Workshop with your CISO, DPO and risk lead. You get a gap map across DPDP, CERT-In and your sectoral regulator, and a costed build plan, within ten working days.
[ Book the Compliance Workshop ]
Reviewed quarterly against Data Protection Board notifications and sectoral regulator updates. This roadmap is operational guidance from public regulatory sources and is not a substitute for advice from a qualified Indian lawyer.
Sources
We'll get back to you shortly.
