Important note
This is general information, not legal advice. Obligations depend on your organisation type, sector and data. Confirm with a qualified legal or compliance professional and check the latest official notifications.
CERT-In Directions (April 2022)
- Specified types of cyber incidents must be reported to CERT-In within six hours of noticing them
- Relevant ICT system logs should be maintained for a rolling 180 days, within Indian jurisdiction
- System clocks should be synchronised to designated NTP sources
- The directions apply to service providers, intermediaries, data centres, body corporates and government organisations as defined; check how they apply to you
Practical meaning: know who reports an incident and how, keep logs from firewalls, servers and key systems long enough, and keep time synchronised across devices.
Digital Personal Data Protection Act, 2023
- Applies to digital personal data processed in India, and in some cases outside
- Requires lawful processing, notice and consent where applicable, and reasonable security safeguards
- Requires notification of personal data breaches to the Data Protection Board and affected individuals as per the rules
- Penalties can be substantial (up to ₹250 crore for failing to maintain reasonable security safeguards)
- The DPDP Rules were notified in November 2025, with obligations phased in over roughly 12 to 18 months. Check current dates
Practical meaning: know where personal data lives, restrict who can access it, encrypt it, log access, back it up and be able to respond to a breach.
What good IT hygiene gives you
| Practice | Helps with |
|---|---|
| Asset and data inventory | Knowing what is in scope |
| MFA, least privilege, patching | Reasonable security safeguards |
| EDR and central logging | Detecting and reporting incidents; retaining logs |
| Tested backups | Recovery and continuity |
| Documented incident runbook | Meeting reporting timelines |
| Vendor and access reviews | Controlling who touches personal data |
Biometric and CCTV data
- Fingerprints and face data are personal data. Collect only what you need and tell people why
- Restrict who can view and export footage; keep access logs
- Set retention periods and delete on schedule
- Keep cameras and access devices on their own network segment
Key takeaways
- Know who reports incidents and keep logs for the required period
- Reasonable security safeguards are an everyday IT practice, not a one-time project
- Check official sources and take professional advice for your sector
A practical first step. Start with a short IT audit and data map: what systems hold personal data, who has access, where logs go, and who calls whom if something happens. Most gaps are fixable in weeks.
References and further reading
General information for orientation; it is not legal or professional advice. Specifications, products and regulations change, so verify current details before acting. Product names belong to their owners and are mentioned only as examples.