ISO 27001, SOC 2, GDPR, the DPDP Act, HIPAA, PCI DSS, NIST, the EU AI Act and more, in one place. Each guide says plainly whether something is a law you must follow, a contract requirement or a voluntary standard, who it applies to, and how to implement it.
25 guides, each with official sources
Mandatory laws clearly separated from voluntary standards
25 guides: 12 legal or regulatory requirements and 13 voluntary standards, frameworks and certifications. Search by name or abbreviation, or filter by category, type and region.
ISO/IEC 27001: Information security management systems. Requirements
ISO/IEC 27001 is the international standard for an information security management system (ISMS). It is voluntary, but enterprise customers and tenders often require it. You build a risk-based system that meets clauses 4 to 10, choose controls from the 93 in Annex A, and an accredited certification body audits you. The certificate lasts three years, with yearly surveillance audits.
Voluntary: Voluntary, often required by customers
Quick facts
What it covers
Information security risk management, governance, people, physical and technical controls, supplier security, incident handling and continual improvement.
Who needs it
SaaS, IT services, BPO, any firm selling to enterprises
Why it matters
It is the security certificate customers ask for most often outside the US, and it gives independent proof that security is managed, not improvised.
Key requirements
Define the ISMS scope and context (clauses 4.1 to 4.4)
Leadership commitment, an information security policy and assigned roles
Risk assessment and risk treatment, with a Statement of Applicability
Controls chosen from the 93 in Annex A, with exclusions justified
ISO/IEC 27002: Information security, cybersecurity and privacy protection. Information security controls
ISO/IEC 27002 is the companion guidance to ISO 27001. It describes the same 93 security controls listed in ISO 27001 Annex A, and for each one explains its purpose and how to implement it. It is voluntary and you cannot be certified to it. IT teams use it to design controls, write policies and prepare for an ISO 27001 audit.
Voluntary: Voluntary guidance; not certifiable
Quick facts
What it covers
Guidance for 93 organisational, people, physical and technological security controls, each tagged with attributes such as control type and cybersecurity concept.
Who needs it
Teams implementing ISO 27001 Annex A
Why it matters
Annex A of ISO 27001 gives each control in one sentence. ISO 27002 is where you find what the control is for and what good implementation looks like.
System and Organization Controls 2 (AICPA SOC for Service Organizations: Trust Services Criteria)
SOC 2 is an attestation report in which an independent CPA firm gives its opinion on a service organisation's controls, measured against the AICPA Trust Services Criteria. It is voluntary, but US enterprise customers routinely ask SaaS and IT vendors for it. A Type 1 report covers control design at a point in time; a Type 2 report also tests how the controls operated over a period, usually 3 to 12 months.
Voluntary: Voluntary, often required by customers
Quick facts
What it covers
Controls over security (always included) and, if chosen, availability, processing integrity, confidentiality and privacy of the systems used to serve customers.
Who needs it
B2B SaaS, cloud hosting, managed service providers
Why it matters
It is the most requested security report in US vendor reviews, and it replaces many long security questionnaires with one independent report.
Key requirements
Security (Common Criteria CC1 to CC9) is always in scope
California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020
The CCPA, as amended by the CPRA, is California's comprehensive privacy law. It applies to for-profit businesses anywhere that collect California residents' personal information and meet a revenue or data-volume threshold. It gives consumers rights to know, delete, correct and opt out of the sale or sharing of their data, requires specific contracts with service providers, and since 2026 adds rules on automated decision-making, risk assessments and cybersecurity audits.
Mandatory: Mandatory for businesses that meet the thresholds
Quick facts
What it covers
Personal information about California residents, including employees and B2B contacts, collected by businesses and handled by their service providers and contractors.
Who needs it
For-profit businesses above revenue/data thresholds handling California residents' data
Why it matters
Many SaaS and IT companies either meet the thresholds themselves or act as service providers to businesses that do, and US customers expect CCPA-compliant contract terms.
Key requirements
Notice at collection and a privacy policy updated at least yearly
Rights to know, delete, correct, and opt out of sale or sharing
Right to limit use of sensitive personal information
Honour Global Privacy Control browser signals as opt-outs
Service provider and contractor contracts with required terms
Reasonable security; data breach private right of action
Risk assessments, cybersecurity audits and ADMT rules phased in from 2026
Where it applies
California, USA (applies to businesses anywhere that handle California residents' data)
General Data Protection Regulation (Regulation (EU) 2016/679)
The GDPR is the EU's main data protection law. It applies to any organisation established in the EU that processes personal data, and to organisations outside the EU that offer goods or services to people in the EU or monitor their behaviour. It sets principles, lawful bases, individuals' rights, security and breach duties, rules for processors and international transfers, and fines of up to EUR 20 million or 4% of global annual turnover.
Mandatory: Mandatory law for organisations in scope, including many outside the EU
Quick facts
What it covers
Collection, use, storage, sharing, transfer and deletion of personal data about people in the EU, by controllers and processors.
Who needs it
Any business processing personal data of people in the EU
Why it matters
Any IT or SaaS company with EU users or EU business customers is likely in scope, and EU customers will not sign without a data processing agreement and evidence of compliance.
Key requirements
Follow the 7 principles in Article 5, including data minimisation and accountability
Have a lawful basis for every processing purpose (Article 6)
Give clear privacy information (Articles 13 and 14)
Honour data subject rights, usually within one month
Sign processor contracts that meet Article 28
Keep records of processing activities (Article 30)
Apply appropriate security (Article 32)
Report qualifying breaches to the authority within 72 hours
Carry out DPIAs for high-risk processing
Use a valid mechanism for transfers outside the EEA
Where it applies
EU/EEA, plus non-EU organisations offering goods or services to, or monitoring, people in the EU
ISO/IEC 27701: Information security, cybersecurity and privacy protection. Privacy information management systems. Requirements and guidance
ISO/IEC 27701 sets the requirements for a privacy information management system (PIMS): a structured way to manage personal data as a controller, a processor, or both. Since the 2025 edition it is a standalone management system standard, so it can be certified without ISO 27001, although many companies certify to both together. It is voluntary, and it provides strong evidence for privacy laws such as the GDPR and India's DPDP Act.
Voluntary: Voluntary, increasingly requested by customers
Quick facts
What it covers
Governance, risk management and controls for processing personally identifiable information (PII), with separate control sets for controllers and processors.
Who needs it
Controllers and processors wanting certifiable privacy governance
Why it matters
Customers increasingly want independent proof that a vendor handles personal data properly, not just securely. ISO 27701 gives that proof in a format auditors and procurement teams recognise.
Key requirements
Define the PIMS scope and your role as PII controller, processor or both
Leadership commitment, privacy policy, roles and responsibilities
Privacy risk assessment and treatment, with a Statement of Applicability
Controls for controllers (lawful basis, notices, rights, DPIAs, transfers)
Controls for processors (customer instructions, sub-processors, return and deletion)
Internal audit, management review and continual improvement
The CIS Critical Security Controls are a prioritised set of 18 security controls and 153 specific safeguards that defend against the most common cyber attacks. They are published free by the Center for Internet Security. Implementation Group 1 (IG1) defines essential cyber hygiene for every organisation; IG2 and IG3 add safeguards for more complex and higher-risk environments. They are voluntary and not certifiable.
Voluntary: Voluntary; referenced by some regulators, insurers and contracts
Quick facts
What it covers
Prioritised technical and process safeguards for assets, software, data, configuration, accounts, access, vulnerabilities, logging, email and web, malware, recovery, network, training, suppliers, application security, incident response and penetration testing.
Who needs it
SMBs to enterprises wanting a prioritised control set
Why it matters
They tell a small or busy IT team exactly what to do first, based on how real attacks happen, which makes them one of the fastest ways to raise security.
Key requirements
Inventory of enterprise assets and software (Controls 1 and 2)
Data protection and secure configuration (Controls 3 and 4)
Account and access control management (Controls 5 and 6)
Continuous vulnerability management and audit logs (Controls 7 and 8)
Malware defences and data recovery (Controls 10 and 11)
Security awareness, service provider and application security (Controls 14 to 16)
Incident response and penetration testing (Controls 17 and 18)
Federal Information Security Modernization Act of 2014 (originally the Federal Information Security Management Act of 2002)
FISMA is the US federal law that requires every federal agency to run an information security programme for its information and systems, including those operated by contractors on its behalf. Agencies apply NIST standards, chiefly the Risk Management Framework and SP 800-53 controls, authorise systems to operate, report incidents to CISA and report annually to OMB and Congress. IT companies meet FISMA requirements through their contracts when they build, host or operate systems for federal agencies.
Mandatory: Mandatory for US federal agencies; flows down to contractors operating federal systems
Quick facts
What it covers
Security programmes, risk management, system authorisation, continuous monitoring, incident reporting and annual evaluation for federal information and systems.
Who needs it
Federal agencies, contractors operating federal systems
Why it matters
IT contractors and service providers that build or run systems for US federal agencies inherit FISMA obligations through contract clauses, and must deliver systems that can receive an authority to operate.
Key requirements
Agency-wide information security programme led by the CIO and CISO
Categorise systems (FIPS 199) and apply minimum security requirements (FIPS 200)
Select and implement NIST SP 800-53 controls
Assess, authorise (ATO) and continuously monitor systems under the NIST RMF
Report incidents to CISA and major incidents to Congress
Annual independent evaluation by the agency Inspector General and reporting to OMB
Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2 Directive)
NIS2 is the EU's main cybersecurity law for important sectors. It replaced the 2016 NIS Directive and greatly widened its scope to include cloud providers, data centres, managed service and managed security service providers, online marketplaces and many manufacturers. In-scope medium and large entities must manage cyber risk with at least ten baseline measures, make management accountable, and report significant incidents within 24 hours. Fines reach EUR 10 million or 2% of worldwide turnover.
Mandatory: Mandatory for in-scope entities through national laws
Quick facts
What it covers
Cybersecurity risk management, governance, supply chain security and incident reporting for essential and important entities in 18 sectors.
Who needs it
Essential and important entities incl. cloud, data centres, MSPs, MSSPs, digital providers
Why it matters
Many IT companies are now directly regulated as digital infrastructure or ICT service management providers, and regulated customers will pass NIS2 security requirements down to their suppliers.
Key requirements
Determine whether you are an essential or important entity, and register
Management bodies approve and oversee cyber risk measures and take training
At least the ten measures in Article 21(2), including supply chain security
Early warning within 24 hours of a significant incident
Incident notification within 72 hours and a final report within one month
Supervision, audits and fines up to EUR 10 million or 2% of turnover
The NIST Cybersecurity Framework (CSF) is a voluntary framework for managing cybersecurity risk, published by the US National Institute of Standards and Technology. Version 2.0, released in February 2024, organises outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. It applies to organisations of any size or sector worldwide. There is no certification; organisations use profiles and tiers to measure where they are and plan improvements.
Voluntary: Voluntary; required by some contracts and sector rules
NIST Special Publication 800-53: Security and Privacy Controls for Information Systems and Organizations
NIST SP 800-53 is the US government's catalogue of security and privacy controls, organised into 20 families such as access control, incident response and supply chain risk. US federal agencies must use it under FISMA, and cloud providers selling to them meet it through FedRAMP. Anyone else can use it voluntarily as a detailed control library. Revision 5 is current, with baselines for low, moderate and high impact systems published in SP 800-53B.
Voluntary: Mandatory for US federal systems under FISMA; voluntary for others, but required for FedRAMP cloud services
Quick facts
What it covers
Technical, operational and management controls for security and privacy across 20 control families, with enhancements for higher-risk systems.
Who needs it
Federal agencies, FedRAMP cloud providers, government contractors
Why it matters
It is the control set behind FISMA, FedRAMP and much US government contracting, and the most detailed free control catalogue available for designing a security programme.
Key requirements
Categorise the system by impact (low, moderate, high)
Select the matching baseline from SP 800-53B and tailor it
Control Objectives for Information and Related Technologies
COBIT is ISACA's framework for governing and managing enterprise information and technology. COBIT 2019 defines 40 governance and management objectives in five domains, design factors to tailor them, and capability levels to measure them. It is voluntary and widely used by IT auditors, boards and regulators, especially in banking. ISACA has announced COBIT 7 for late 2026; COBIT 2019 remains the reference until it is released.
Voluntary: Voluntary; widely used by auditors and regulators as a reference
Quick facts
What it covers
How the board and management set direction for IT, align it with business goals, manage risk, resources and performance, and monitor and assure IT processes.
Who needs it
IT governance, audit and risk teams; firms subject to SOX
Why it matters
It is the common language of IT auditors and many financial regulators, and it links technology decisions to business outcomes in a way boards understand.
Key requirements
Evaluate, Direct and Monitor (EDM) - 5 governance objectives for the board
Align, Plan and Organise (APO) - 14 management objectives
Build, Acquire and Implement (BAI) - 11 management objectives
Deliver, Service and Support (DSS) - 6 management objectives
Monitor, Evaluate and Assess (MEA) - 4 management objectives
Design factors to tailor the governance system; capability levels 0 to 5
ISO 9001: Quality management systems. Requirements
ISO 9001 is the world's most widely used standard for quality management systems. It requires an organisation to understand its customers, plan and control how it delivers products and services, manage risks, measure results and keep improving. It is voluntary and certifiable. ISO 9001:2026 was published in September 2026, and certificates to the 2015 edition are expected to remain valid during a transition period ending in September 2029.
Voluntary: Voluntary; often required in tenders and enterprise contracts
Quick facts
What it covers
Customer focus, leadership, planning, resources, operational control of products and services, supplier control, measurement, internal audit and improvement.
Who needs it
Software companies and IT service providers bidding for enterprise and government work
Why it matters
Government and enterprise tenders, especially in India, the Middle East and Europe, often require ISO 9001, and it gives software and IT service companies a disciplined way to deliver consistently.
Key requirements
Context, interested parties and QMS scope (clause 4)
Leadership, quality policy and roles (clause 5)
Risks and opportunities, quality objectives, planning changes (clause 6)
Resources, competence, awareness, documented information (clause 7)
ITIL is the most widely used body of best practice for IT service management: how to design, deliver, support and improve IT and digital services. It is voluntary and not certifiable for organisations; individuals take ITIL certifications. ITIL Version 5, released in early 2026, keeps ITIL 4's guiding principles, four dimensions, service value system and 34 practices, and adds a unified digital product and service lifecycle and AI guidance.
Voluntary: Voluntary best practice
Quick facts
What it covers
Service strategy, design, change, incident and problem management, service desk, service levels, continual improvement and the wider digital product and service lifecycle.
Who needs it
IT service providers, MSPs, internal IT operations
Why it matters
Customers, especially enterprises and government, expect IT service providers to run incidents, changes and service levels in a recognisable, ITIL-aligned way.
Key requirements
Seven guiding principles, such as focus on value and start where you are
Four dimensions - organisations and people, information and technology, partners and suppliers, value streams and processes
The service value system and value chain
34 management practices, including incident, change, problem and service level management
FedRAMP is the US government programme that assesses and authorises cloud services for use by federal agencies. Any cloud service that holds federal information generally needs it. In 2026 FedRAMP moved from its document-heavy Rev5 process to the 20x approach with Consolidated Rules, certification classes A to D and more automated, evidence-based validation. The rules become mandatory on 1 January 2027, and existing Rev5 authorizations sunset at the end of 2028.
Mandatory: Required for cloud services used by US federal agencies
Quick facts
What it covers
Security assessment, authorization and continuous monitoring of cloud products and services used by US federal agencies.
Who needs it
Cloud and SaaS providers selling to US federal agencies
Why it matters
Without FedRAMP, a cloud or SaaS company can't sell to most US federal agencies, and many state, local and defence buyers use it as a benchmark.
Key requirements
Meet the security requirements of the applicable class or baseline (built on NIST SP 800-53)
Independent assessment, traditionally by an accredited 3PAO
Machine-readable, reusable evidence under 20x
Continuous monitoring, vulnerability detection and response
Marketplace listing and agency use
Adopt the Consolidated Rules by the applicable deadlines
OWASP Top 10: The Ten Most Critical Web Application Security Risks
The OWASP Top 10 is a free, community-built list of the ten most critical security risks to web applications, published by the OWASP Foundation. The 2025 edition adds Software Supply Chain Failures and Mishandling of Exceptional Conditions, and keeps Broken Access Control at number one. It is an awareness document, not a full standard, but customers, auditors, PCI DSS and penetration testers widely use it as a baseline for secure development.
Voluntary: Voluntary awareness standard; referenced by PCI DSS, customers and pen testers
Quick facts
What it covers
Common web application weaknesses, from access control and misconfiguration to supply chain, cryptography, injection, design, authentication, integrity, logging and error handling.
Who needs it
Web and SaaS development teams
Why it matters
It is the shared baseline developers, testers and customers use to talk about web application security, and most security questionnaires ask how you address it.
PCI DSS is the security standard for protecting payment card data. It isn't a law: card brands such as Visa and Mastercard require it through contracts with banks, which pass it on to merchants and service providers. Anyone who stores, processes or transmits cardholder data, or can affect its security, must comply. Version 4.0.1 is current, with 12 requirements, and all requirements introduced in version 4.0 have been mandatory since 31 March 2025.
Mandatory: Contractually required for anyone who stores, processes or transmits card data, or can affect its security
Quick facts
What it covers
Security of cardholder data and sensitive authentication data across networks, systems, applications, people and service providers.
Who needs it
Merchants, payment gateways, SaaS that store, process or transmit card data
Why it matters
E-commerce sites, SaaS platforms that take payments, and IT providers that host or support payment systems all fall in scope, and acquirers can fine or stop working with non-compliant businesses.
Key requirements
Network security controls and secure configurations (Requirements 1 and 2)
Protect stored account data and encrypt it in transit (3 and 4)
Anti-malware, secure systems and software, and script controls on payment pages (5 and 6)
Need-to-know access, strong authentication with MFA, physical security (7 to 9)
Logging, monitoring and regular security testing (10 and 11)
Policies, risk analysis, awareness and third-party management (12)
The Sarbanes-Oxley Act (SOX) is a US federal law that requires public companies to maintain and report on effective internal control over financial reporting. Executives must certify financial reports, and larger companies need an independent auditor's opinion on those controls. For IT teams, SOX means IT general controls over access, change management and operations for every system that affects the financial statements, including SaaS vendors' systems, which is why customers ask vendors for SOC 1 reports.
Mandatory: Mandatory for SEC-registered public companies; vendors are affected through customers' audits
Quick facts
What it covers
Internal control over financial reporting, including IT general controls and application controls for financial systems, plus executive certification and record retention.
Who needs it
Public companies and IT vendors supporting financial reporting systems
Why it matters
IT and SaaS companies preparing to list in the US must build SOX controls, and vendors whose software affects customers' financial reporting are pulled into their customers' SOX audits.
Key requirements
CEO and CFO certification of financial reports (Section 302)
Management assessment of internal control over financial reporting (Section 404(a))
Auditor attestation for accelerated and large accelerated filers (Section 404(b))
IT general controls - access, change management, operations, and development
Evidence of controls operating throughout the year
Record retention and penalties for destroying audit records (Section 802)
Where it applies
USA (and foreign companies registered with the SEC)
Health Insurance Portability and Accountability Act of 1996
HIPAA is the US law that protects health information. Its rules apply to covered entities (health plans, healthcare clearinghouses and most healthcare providers) and to business associates, the vendors that create, receive, maintain or transmit protected health information for them. SaaS, cloud and IT providers serving US healthcare are usually business associates and must sign a business associate agreement, implement the Security Rule, and report breaches. HHS proposed a major Security Rule update in January 2025; the final rule is now targeted for July 2027.
Mandatory: Mandatory for covered entities and their business associates
Quick facts
What it covers
Uses and disclosures of protected health information (PHI), security of electronic PHI, individuals' rights, and breach notification.
Who needs it
Healthcare SaaS, telehealth, health IT vendors (business associates)
Why it matters
Any IT or SaaS company handling patient data for US healthcare organisations is directly liable under HIPAA as a business associate, and healthcare buyers won't sign without a BAA.
Key requirements
Sign business associate agreements (BAAs) with covered entities and subcontractors
Conduct and document a security risk analysis
Administrative, physical and technical safeguards for ePHI
Use and disclose PHI only as permitted, under the minimum necessary standard
Notify breaches of unsecured PHI within the required time limits
Policies, training, and six-year retention of documentation
The EU AI Act is the world's first comprehensive AI law. It sorts AI systems by risk: some practices are banned, high-risk systems face strict requirements, some systems carry transparency duties, and general-purpose AI models have their own rules. It applies to providers and deployers inside and outside the EU. Bans and AI literacy have applied since February 2025 and GPAI rules since August 2025. After the 2026 Digital Omnibus, high-risk obligations apply from 2 December 2027 (stand-alone systems) and 2 August 2028 (AI in regulated products).
Mandatory: Mandatory law for providers and deployers of AI systems in scope, including many outside the EU
Quick facts
What it covers
Development, placing on the market and use of AI systems and general-purpose AI models in the EU, by risk category.
Who needs it
AI providers, deployers, importers; SaaS with AI features used in the EU
Why it matters
Software companies that build AI features, integrate AI models or sell AI products into the EU have legal duties that depend on their role and the use case, and EU customers already ask about them in procurement.
Key requirements
Don't use prohibited AI practices (Article 5)
Take measures to support staff AI literacy (Article 4)
Tell people when they interact with AI and mark AI-generated content (Article 50)
GPAI model providers - technical documentation, copyright policy, training data summary
High-risk providers - risk management, data governance, documentation, logging, human oversight, accuracy, QMS, conformity assessment, registration
High-risk deployers - use as instructed, human oversight, monitoring, log retention, some impact assessments
Where it applies
EU market (applies to non-EU providers whose AI systems or outputs are used in the EU)
ISO/IEC 42001: Information technology. Artificial intelligence. Management system
ISO/IEC 42001 is the first international, certifiable standard for an AI management system (AIMS). It sets out how an organisation that develops, provides or uses AI should govern it: policies, roles, risk and impact assessment, controls across the AI life cycle, and continual improvement. It is voluntary, follows the same structure as ISO 27001, and is becoming the standard way for software companies to show customers and regulators that their AI is responsibly managed.
Voluntary: Voluntary; increasingly requested by enterprise customers buying AI
Quick facts
What it covers
Governance, risk management, impact assessment, data, life cycle, third-party and responsible use controls for AI systems an organisation develops, provides or uses.
Who needs it
Companies building or using AI in products
Why it matters
Buyers of AI products increasingly want independent evidence of responsible AI, and ISO 42001 supports obligations under the EU AI Act and other AI laws.
Key requirements
Define AIMS scope and your role (developer, provider, user of AI)
AI policy, leadership commitment and assigned responsibilities
AI risk assessment and AI system impact assessment
Statement of Applicability against 38 Annex A controls
Controls for data, AI system life cycle, third parties and responsible use
Monitoring, internal audit, management review and improvement
ISO 22301: Security and resilience. Business continuity management systems. Requirements
ISO 22301 is the international standard for a business continuity management system (BCMS). It requires an organisation to understand which activities matter most, how quickly they must be restored after a disruption, and to plan, test and improve its response. It is voluntary and certifiable, follows the same structure as ISO 27001, and helps IT and SaaS companies meet customer uptime commitments and continuity requirements in laws such as NIS2 and DORA.
Voluntary: Voluntary; often expected by banks, governments and enterprise customers
Quick facts
What it covers
Business impact analysis, risk assessment, continuity strategies and solutions, business continuity plans and procedures, exercising and testing, and continual improvement.
Who needs it
IT service providers, data centres, SaaS with uptime SLAs
Why it matters
Customers depend on IT and SaaS providers to stay available, and banks, regulators and large buyers increasingly ask for tested continuity plans and evidence.
Key requirements
Context, interested parties, legal requirements and BCMS scope
Leadership commitment, business continuity policy and roles
Business impact analysis and risk assessment
Business continuity strategies and solutions
Business continuity plans and incident response structure
Exercise programme, evaluation, internal audit and management review
CERT-In Directions under Section 70B(6) of the IT Act, 2000 relating to information security practices, procedure, prevention, response and reporting of cyber incidents for safe and trusted Internet (28 April 2022)
The CERT-In Directions of April 2022 require service providers, intermediaries, data centres, body corporates and government organisations in India to report specified cyber incidents to CERT-In within six hours of noticing them, keep ICT system logs for 180 days within India, synchronise clocks to Indian time sources and name a point of contact. Data centres, cloud, VPS and VPN providers must also keep subscriber records for five years. They are issued under Section 70B of the IT Act, and non-compliance can be punished with imprisonment or a fine.
Mandatory: Mandatory for service providers, intermediaries, data centres, body corporates and government organisations in India
Quick facts
What it covers
Cyber incident reporting, log retention, clock synchronisation, points of contact, and record-keeping for hosting, VPN and virtual asset providers.
Who needs it
Indian IT/ITES companies, cloud, VPN, data centre and SaaS providers
Why it matters
Almost every IT, SaaS and hosting company operating in India is covered, and the six-hour deadline is among the strictest incident reporting rules in the world.
Key requirements
Report listed cyber incidents to CERT-In within 6 hours of noticing them
Keep logs of all ICT systems for 180 days, within Indian jurisdiction
Synchronise ICT system clocks with NIC or NPL NTP servers, or sources traceable to them
Designate a point of contact and share it with CERT-In
Data centre, VPS, cloud and VPN providers keep subscriber details for 5 years
Provide information and assistance when CERT-In asks
Digital Personal Data Protection Act, 2023, with the Digital Personal Data Protection Rules, 2025
The Digital Personal Data Protection Act, 2023 is India's first comprehensive data protection law. It applies to digital personal data processed in India, and to processing abroad connected with offering goods or services to people in India. Organisations (data fiduciaries) need consent or a legitimate use, must give clear notices, protect data with reasonable security safeguards, report breaches, honour individuals' rights and take extra care with children's data. The Rules were notified in November 2025, and most obligations apply from May 2027. Penalties reach INR 250 crore.
Mandatory: Mandatory law; main obligations apply from May 2027
Quick facts
What it covers
Collection, use, storage, sharing, transfer and erasure of digital personal data by data fiduciaries and data processors.
Who needs it
Every Indian IT company and any business processing digital personal data of people in India
Why it matters
Every Indian IT, SaaS and edtech company handles personal data, and global companies serving Indian users are in scope too. Customers will expect DPDP-ready contracts and security well before May 2027.
Key requirements
Process personal data only with valid consent or for a legitimate use
Give a clear, standalone notice in plain language
Reasonable security safeguards, including encryption, access control and one-year log retention
Report personal data breaches to the Board and affected individuals
Verifiable parental consent for children under 18; no tracking or targeted ads to children
Honour rights to access, correction, erasure, grievance redressal and nomination
Extra duties for Significant Data Fiduciaries - DPO in India, annual DPIA and audit
Where it applies
India, and processing outside India connected with offering goods or services to people in India
Information Technology Act, 2000 (as amended in 2008)
The Information Technology Act, 2000 is India's main law on electronic commerce, electronic records and signatures, cybercrime and intermediary liability. Its 2008 amendment added data protection duties (Section 43A), cyber offences such as identity theft, safe harbour for intermediaries (Section 79) and a legal basis for CERT-In (Section 70B). Rules made under it, such as the CERT-In Directions and the IT Intermediary Rules, set many of the obligations Indian IT companies follow today.
Mandatory: Mandatory law in India
Quick facts
What it covers
Legal recognition of electronic records and signatures, cyber offences and penalties, data protection compensation, interception and blocking powers, protected systems, CERT-In, and intermediary liability.
Who needs it
All Indian IT companies, intermediaries, digital businesses
Why it matters
Every IT company operating in India is subject to it: it defines cybercrimes against and by your systems, requires incident reporting through CERT-In, and decides when platforms are liable for user content.
Key requirements
Reasonable security practices for sensitive personal data (Section 43A, until May 2027)
Don't disclose personal information in breach of a lawful contract (Section 72A)
Comply with CERT-In directions, including 6-hour incident reporting (Section 70B)
Intermediary due diligence to keep safe harbour (Section 79 and the Intermediary Rules)
Comply with lawful interception, decryption and blocking orders (Sections 69 and 69A)
Electronic records and signatures valid under Sections 3 to 10A
Where it applies
India (and offences committed outside India involving a computer system in India)
