IT Compliance Hub

Indian IT Laws & Regulations

The Indian laws, rules and regulator directions that IT, SaaS and IT service companies must follow: the DPDP Act and Rules, the IT Act, CERT-In Directions, IT Rules 2021, RBI, SEBI and IRDAI rules, and more.

  • 3 guides in this area
  • Mandatory and voluntary clearly labelled
  • Official sources in every guide
Where to start

Which one do you need?

Find the line that matches your situation. Many companies need more than one; the guides explain how they overlap.

If this is youStart withType
You process personal data of people in IndiaDPDP Act Law / regulation
You run IT systems in India and need to know incident reporting rulesCERT-In Directions Regulatory direction
All guides

Indian IT Laws & Regulations guides

Regulatory direction India

CERT-In Directions

CERT-In Directions under Section 70B(6) of the IT Act, 2000 relating to information security practices, procedure, prevention, response and reporting of cyber incidents for safe and trusted Internet (28 April 2022)

The CERT-In Directions of April 2022 require service providers, intermediaries, data centres, body corporates and government organisations in India to report specified cyber incidents to CERT-In within six hours of noticing them, keep ICT system logs for 180 days within India, synchronise clocks to Indian time sources and name a point of contact. Data centres, cloud, VPS and VPN providers must also keep subscriber records for five years. They are issued under Section 70B of the IT Act, and non-compliance can be punished with imprisonment or a fine.

Mandatory: Mandatory for service providers, intermediaries, data centres, body corporates and government organisations in India

Quick facts
What it covers
Cyber incident reporting, log retention, clock synchronisation, points of contact, and record-keeping for hosting, VPN and virtual asset providers.
Who needs it
Indian IT/ITES companies, cloud, VPN, data centre and SaaS providers
Why it matters
Almost every IT, SaaS and hosting company operating in India is covered, and the six-hour deadline is among the strictest incident reporting rules in the world.
Key requirements
  • Report listed cyber incidents to CERT-In within 6 hours of noticing them
  • Keep logs of all ICT systems for 180 days, within Indian jurisdiction
  • Synchronise ICT system clocks with NIC or NPL NTP servers, or sources traceable to them
  • Designate a point of contact and share it with CERT-In
  • Data centre, VPS, cloud and VPN providers keep subscriber details for 5 years
  • Provide information and assistance when CERT-In asks
Where it applies
India
Category
Indian IT Laws & Regulations
Read the CERT-In Directions guide
Law / regulation India

DPDP Act

Digital Personal Data Protection Act, 2023, with the Digital Personal Data Protection Rules, 2025

The Digital Personal Data Protection Act, 2023 is India's first comprehensive data protection law. It applies to digital personal data processed in India, and to processing abroad connected with offering goods or services to people in India. Organisations (data fiduciaries) need consent or a legitimate use, must give clear notices, protect data with reasonable security safeguards, report breaches, honour individuals' rights and take extra care with children's data. The Rules were notified in November 2025, and most obligations apply from May 2027. Penalties reach INR 250 crore.

Mandatory: Mandatory law; main obligations apply from May 2027

Quick facts
What it covers
Collection, use, storage, sharing, transfer and erasure of digital personal data by data fiduciaries and data processors.
Who needs it
Every Indian IT company and any business processing digital personal data of people in India
Why it matters
Every Indian IT, SaaS and edtech company handles personal data, and global companies serving Indian users are in scope too. Customers will expect DPDP-ready contracts and security well before May 2027.
Key requirements
  • Process personal data only with valid consent or for a legitimate use
  • Give a clear, standalone notice in plain language
  • Reasonable security safeguards, including encryption, access control and one-year log retention
  • Report personal data breaches to the Board and affected individuals
  • Verifiable parental consent for children under 18; no tracking or targeted ads to children
  • Honour rights to access, correction, erasure, grievance redressal and nomination
  • Extra duties for Significant Data Fiduciaries - DPO in India, annual DPIA and audit
Where it applies
India, and processing outside India connected with offering goods or services to people in India
Category
Indian IT Laws & Regulations
Read the DPDP Act guide
Law / regulation India

IT Act 2000

Information Technology Act, 2000 (as amended in 2008)

The Information Technology Act, 2000 is India's main law on electronic commerce, electronic records and signatures, cybercrime and intermediary liability. Its 2008 amendment added data protection duties (Section 43A), cyber offences such as identity theft, safe harbour for intermediaries (Section 79) and a legal basis for CERT-In (Section 70B). Rules made under it, such as the CERT-In Directions and the IT Intermediary Rules, set many of the obligations Indian IT companies follow today.

Mandatory: Mandatory law in India

Quick facts
What it covers
Legal recognition of electronic records and signatures, cyber offences and penalties, data protection compensation, interception and blocking powers, protected systems, CERT-In, and intermediary liability.
Who needs it
All Indian IT companies, intermediaries, digital businesses
Why it matters
Every IT company operating in India is subject to it: it defines cybercrimes against and by your systems, requires incident reporting through CERT-In, and decides when platforms are liable for user content.
Key requirements
  • Reasonable security practices for sensitive personal data (Section 43A, until May 2027)
  • Don't disclose personal information in breach of a lawful contract (Section 72A)
  • Comply with CERT-In directions, including 6-hour incident reporting (Section 70B)
  • Intermediary due diligence to keep safe harbour (Section 79 and the Intermediary Rules)
  • Comply with lawful interception, decryption and blocking orders (Sections 69 and 69A)
  • Electronic records and signatures valid under Sections 3 to 10A
Where it applies
India (and offences committed outside India involving a computer system in India)
Category
Indian IT Laws & Regulations
Read the IT Act 2000 guide
Other areas

More IT compliance categories

Information Security Data Privacy & Protection Cybersecurity IT Governance & Risk Management Cloud Security Secure Software Development Payment & Financial Data Security Healthcare IT AI Governance & Compliance Business Continuity & Disaster Recovery International IT Regulations All IT compliance guides
IT compliance help

Not sure which indian it laws & regulations rules apply to you?

Tell us what you build, where your customers are and what they ask for. We reply with suggested next steps.

  • No obligation
  • NDA on request
  • Reply within one business day
Prefer to talk first? Book a call WhatsApp iamvishavjeet@gmail.com

Get an IT compliance assessment

This form is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Need a custom Tutor LMS solution?

Tell us what you are building or what is broken. A Tutor LMS developer reads every inquiry and replies with next steps and a free estimate.

Get a free consultation Book a call

Get a free Tutor LMS consultation

Tell us what you are building or fixing. A Tutor LMS developer replies with honest advice and next steps.

  • No obligation
  • Tutor LMS and Pro specialists
  • Your details stay private

This form is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.