Acts, rules and directions that apply to IT companies, SaaS businesses and IT service providers in India. 9 entries, 3 with a full guide.
India's IT law is built on the Information Technology Act, 2000, which covers electronic records, cyber offences, intermediary liability and the powers of CERT-In. Rules under the Act set many day-to-day duties: the CERT-In Directions of 28 April 2022 (six-hour incident reporting, 180-day logs, clock sync) apply to almost every IT company today.
Personal data is moving to the Digital Personal Data Protection Act, 2023. Its Rules were notified on 13 November 2025, and the main duties on notice, consent, security, breach reporting and data principal rights start on 13 May 2027. Until then the SPDI Rules 2011 under Section 43A of the IT Act still apply.
Sector regulators add their own rules: RBI's IT governance directions for banks and NBFCs, SEBI's Cybersecurity and Cyber Resilience Framework for market entities, and IRDAI's guidelines for insurers. They reach IT vendors through outsourcing contracts and audit rights.
Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (India)
LawMandatory by lawIndia, extraterritorial
India's Digital Personal Data Protection Act, 2023 governs the processing of digital personal data. Data fiduciaries must give clear notice, obtain free, specific and informed consent (or rely on a listed legitimate use), protect data with reasonable security safeguards, report breaches to the Data Protection Board and affected people, honour rights to access, correction, erasure and grievance redress, and delete data when no longer needed. The DPDP Rules 2025 phase most duties in from 13 May 2027. Penalties reach INR 250 crore.
Covers, who needs it and key requirements
What it covers
Digital personal data (and non-digital data later digitised): notice and consent, legitimate uses, consent managers, data fiduciary duties, processors, security safeguards, breach notification, children's and disabled persons' data, data principal rights, Significant Data Fiduciaries, cross-border transfers and the Data Protection Board.
Who needs it
Every Indian IT company, SaaS provider, app and IT service provider that processes personal data, and foreign companies offering goods or services to people in India. IT service providers acting for clients are data processors bound by contract.
Why it matters
It replaces the limited SPDI Rules with a full privacy regime, has penalties up to INR 250 crore per breach, and Indian and foreign clients will expect DPDP-ready processors.
Applies in
India; applies extraterritorially to processing connected with offering goods or services to data principals in India
Information Technology Act, 2000 (India), as amended in 2008, with rules made under it
LawMandatory by lawIndia
The Information Technology Act, 2000 is India's core law for electronic commerce and cybersecurity. It gives legal recognition to electronic records and signatures, defines cyber offences such as hacking, identity theft and data theft, makes companies liable to compensate for negligent handling of sensitive data (Section 43A, until the DPDP Act replaces it), sets due diligence and safe harbour rules for intermediaries (Section 79), and empowers CERT-In to issue binding directions (Section 70B).
Covers, who needs it and key requirements
What it covers
Electronic records and signatures, cyber contraventions and offences, corporate data protection (Section 43A and SPDI Rules), intermediary due diligence and safe harbour, government interception and blocking powers, critical information infrastructure and CERT-In's powers.
Who needs it
Every company operating computer systems in India: IT and software companies, SaaS and app providers, hosting and cloud providers, and intermediaries such as platforms and marketplaces.
Why it matters
It defines what is a crime, when you must pay compensation, and what intermediaries must do to keep safe harbour; CERT-In's binding directions come from it.
Applies in
India; extends to acts outside India involving computers or networks located in India (Section 75)
CERT-In Directions of 28 April 2022 under Section 70B(6) of the Information Technology Act, 2000 relating to information security practices, procedure, prevention, response and reporting of cyber incidents
RegulationMandatory by lawIndia
CERT-In's Directions of 28 April 2022 are binding rules for almost every organisation running IT systems in India. They require reporting listed cyber incidents to CERT-In within six hours of noticing them, keeping logs of all ICT systems for a rolling 180 days within India, synchronising clocks with NIC or NPL time servers, and naming a point of contact. Data centres, VPS, cloud and VPN providers must keep subscriber records for five years. Non-compliance is a criminal offence under Section 70B(7).
Covers, who needs it and key requirements
What it covers
Cyber incident reporting (20 listed incident types), log retention, clock synchronisation, point of contact, information requests from CERT-In, subscriber records for data centre, VPS, cloud and VPN providers, and KYC records for virtual asset service providers.
Who needs it
IT companies, SaaS providers, data centres, cloud, VPS and VPN providers, intermediaries, body corporates and government organisations operating in India.
Why it matters
The six-hour reporting window is one of the strictest in the world and failing to comply is a criminal offence, so incident response plans for India must be built around it.
Report listed cyber incidents to CERT-In within 6 hours of noticing them (incident@cert-in.org.in or the reporting portal)
Enable and keep logs of all ICT systems securely for a rolling 180 days within Indian jurisdiction
Synchronise system clocks with the NTP servers of NIC or NPL (or traceable sources)
Designate a point of contact to interface with CERT-In and share details
Provide information and assistance when CERT-In asks
Data centres, VPS, cloud and VPN providers: keep validated subscriber records for 5 years; VASPs keep KYC and transaction records for 5 years
India AI Governance Guidelines
India AI Governance Guidelines (MeitY / IndiaAI Mission, November 2025)
FrameworkVoluntaryIndia
Released by MeitY in November 2025, the India AI Governance Guidelines set out a principle-based, innovation-first approach to AI rather than a new AI law. They propose relying on existing laws such as the IT Act and DPDP Act, voluntary measures and techno-legal tools, and new institutions for coordination. For companies they recommend grievance mechanisms, transparency, risk assessments and voluntary frameworks. Binding duties for AI content currently come from the IT Rules amendments of February 2026.
Covers, who needs it and key requirements
What it covers
Governance principles, institutional framework, risk classification approach, voluntary commitments, techno-legal measures and how existing laws apply to AI.
Who needs it
AI developers and deployers in India, and IT companies building AI products for the Indian market.
Why it matters
It signals how Indian regulators will judge AI governance, and pairs with binding IT Rules duties on synthetic content.
Map AI use against existing Indian laws (IT Act, DPDP Act, consumer and sector rules)
Set up grievance redressal for AI-affected users
Adopt transparency and risk assessment practices
Label synthetic content where the IT Rules require it
RBI IT Governance Directions
RBI Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices, 2023 (and Master Direction on Outsourcing of IT Services, 2023)
RegulationMandatory if in scopeIndia
The Reserve Bank of India's Master Direction on IT Governance, Risk, Controls and Assurance Practices (7 November 2023, effective 1 April 2024) requires banks, NBFCs and other regulated entities to have board-level IT governance, IT and information security risk management, business continuity, and IS audit. A separate Master Direction on Outsourcing of IT Services (April 2023) sets due diligence, contract, audit-rights and exit requirements that apply to IT vendors and cloud providers serving them.
Covers, who needs it and key requirements
What it covers
IT governance structures, IT strategy, information security, cyber risk, change and patch management, BCP and DR, IS audit, and outsourcing of IT services including cloud.
Who needs it
Banks, NBFCs, payment system operators and credit information companies regulated by RBI, and their IT and cloud vendors.
Why it matters
Indian financial clients must flow these requirements into vendor contracts and audits.
Board-approved IT strategy and IT governance committees
Information security policy, cyber risk management and SOC
BCP and DR with regular drills
Annual IS audit
Outsourcing risk assessment, contracts with audit rights and exit plans
SEBI CSCRF
SEBI Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities, 2024
RegulationMandatory if in scopeIndia
SEBI's Cybersecurity and Cyber Resilience Framework, issued on 20 August 2024 with phased compliance through 2025, sets cybersecurity standards for stock exchanges, depositories, brokers, mutual funds, investment advisers and other SEBI-regulated entities. It follows a graded approach by entity category and covers governance, identification, protection, detection, response, recovery and evolution, with cyber audits, a security operations centre for larger entities and incident reporting to CERT-In and SEBI.
Covers, who needs it and key requirements
What it covers
Cyber governance, asset and risk identification, protection controls, SOC and detection, incident response and reporting, recovery, audits and third-party (including cloud) risk.
Who needs it
SEBI-regulated entities and the IT, cloud and SaaS vendors that serve them.
Why it matters
Market entities must audit their vendors and include CSCRF requirements in contracts.
Classify the entity category and applicable controls
Board-approved cybersecurity policy and governance
SOC or managed SOC as required
Periodic cyber audits by CERT-In empanelled auditors
Incident reporting to CERT-In and SEBI
IRDAI Cyber Security Guidelines
IRDAI Information and Cyber Security Guidelines, 2023
RegulationMandatory if in scopeIndia
The Insurance Regulatory and Development Authority of India's Information and Cyber Security Guidelines (April 2023) require insurers and insurance intermediaries to run an information security programme with a board-approved policy, a CISO, risk assessment, data classification, SOC monitoring, incident reporting within six hours in line with CERT-In, annual audits and controls over outsourced IT and cloud vendors.
Covers, who needs it and key requirements
What it covers
Governance, risk assessment, data security, access control, cloud and outsourcing, monitoring, incident response, audits and business continuity for insurers.
Who needs it
Insurers and insurance intermediaries in India and their IT service providers.
Why it matters
Insurers pass these controls to their IT vendors through contracts and audits.
Board-approved information and cyber security policy
CISO and information security committee
Incident reporting within 6 hours
Annual comprehensive cyber security audit
Vendor and cloud security controls
IT Rules 2021
Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended up to February 2026
RegulationMandatory if in scopeIndia
The IT Rules 2021 set the due diligence an intermediary (platforms, marketplaces, hosting and many SaaS services that host user content) must follow to keep safe harbour under Section 79 of the IT Act. They require published terms, a grievance officer, action on unlawful content within set timelines, and extra duties for significant social media intermediaries. Amendments in force from 20 February 2026 add labelling and provenance rules for synthetically generated content and a three-hour window for acting on government and court orders.
Covers, who needs it and key requirements
What it covers
Intermediary due diligence, grievance redressal, takedown timelines, synthetic content labelling, significant social media intermediary duties, and digital media ethics code.
Who needs it
Platforms, marketplaces, social media, hosting and SaaS services in India that host or transmit user content, and AI content tool providers.
Why it matters
Failing due diligence removes safe harbour and exposes the platform to liability for user content.
Appoint a grievance officer and resolve complaints within set timelines
Act on government or court orders within 3 hours (from February 2026)
Label synthetic content and keep provenance markers
Extra compliance officers and reports for significant social media intermediaries
SPDI Rules 2011
Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
RegulationMandatory by lawIndia
The SPDI Rules 2011 under Section 43A of the IT Act are India's current data protection rules for sensitive personal data such as passwords, financial and health information and biometrics. They require a privacy policy, consent for collection, purpose limits, consent for disclosure and transfers, and reasonable security practices, with ISO/IEC 27001 named as one recognised standard. They will be replaced when the DPDP Act's main provisions start on 13 May 2027.
Covers, who needs it and key requirements
What it covers
Sensitive personal data or information: privacy policy, consent, collection limits, disclosure, transfers, grievance officer and reasonable security practices.
Who needs it
Body corporates in India that collect or handle sensitive personal data, including IT and BPO companies.
Why it matters
They are the data protection rules that apply today, until the DPDP Act takes over.
Applies in
India (until the DPDP Act's main provisions start on 13 May 2027)
