DPDP Act and Cybersecurity: What Businesses Need to Prepare for in India

India’s Digital Personal Data Protection Act, 2023, has made personal data governance a critical business priority. DPDP Act cybersecurity compliance requires organisations to look beyond privacy policies and assess how they collect, store, process, secure and share digital personal data. Businesses must prepare for stronger accountability, appropriate security safeguards, breach reporting and responsible handling of personal information.

For companies operating in India, compliance is not simply an IT project. It involves legal teams, cybersecurity professionals, management, human resources, marketing, procurement and third party service providers. A weakness in any of these areas can expose an organisation to regulatory action, financial penalties and reputational damage.

This guide explains the Act’s cybersecurity requirements, the role of the Digital Personal Data Protection Rules, 2025, the steps businesses should take, and how to build a practical compliance programme.

What Does the DPDP Act Mean for Cybersecurity?

The Digital Personal Data Protection Act, 2023, establishes legal obligations for organisations processing digital personal data in India. It applies to digital personal data processed within India and, in specified circumstances, processing outside India connected with offering goods or services to individuals in India.

The Act uses the term Data Fiduciary for an entity determining the purpose and means of processing personal data. A Data Processor processes personal data on behalf of a Data Fiduciary. A company may therefore remain responsible for protecting personal data even when it outsources hosting, customer support, payroll or cloud infrastructure.

Section 8(5) requires Data Fiduciaries to protect personal data in their possession or under their control, including data processed by a Data Processor on their behalf, through reasonable security safeguards to prevent personal data breaches.

The obligation makes cybersecurity a matter of legal accountability. Organisations must be able to demonstrate not only that policies exist, but also that appropriate controls operate effectively.

Businesses should review the official DPDP Act and Rules published by the Ministry of Electronics and Information Technology to understand the statutory framework and applicable commencement dates.

What Are the Key Cybersecurity Requirements Under the DPDP Rules, 2025?

The Digital Personal Data Protection Rules, 2025, were notified on 14 November 2025. Their implementation follows a phased timeline, so businesses must distinguish between obligations already in force and requirements scheduled to commence later.

Rule 6 sets out the security safeguards expected from Data Fiduciaries. These include appropriate technical and organisational measures to protect personal data against breaches. The prescribed measures cover encryption, obfuscation or masking where appropriate, access controls, monitoring, backups and measures to support the detection and investigation of unauthorised access.

The Rules also address the retention of relevant logs and personal data for at least one year, subject to the applicable legal requirements and exceptions. Businesses should configure their systems and retention policies accordingly, rather than assuming ordinary operational logs will remain available when an incident occurs.

In practical terms, organisations should implement multi factor authentication, least privilege access, secure configuration, vulnerability management, endpoint protection and appropriate network segmentation. They should also test restoration from backups and review access permissions regularly.

No single security certification automatically establishes compliance. Standards such as ISO 27001 and recognised cybersecurity frameworks can provide useful structures, but businesses must still assess whether their actual controls meet the legal requirements and risks of their processing activities.

How Should Businesses Prepare for Personal Data Breach Reporting?

Breach response is one of the most important areas of DPDP Act cybersecurity compliance. Section 8(6) requires a Data Fiduciary to notify the Data Protection Board of India and affected individuals when a personal data breach occurs, in accordance with the prescribed procedure.

Rule 7 of the 2025 Rules establishes the notification process. A Data Fiduciary must inform affected individuals without delay, explaining the nature and extent of the breach, its likely consequences, mitigation measures, recommended protective steps and contact information for further assistance.

The Board must also receive an initial notification without delay. A more detailed report, including updated information and remedial measures, must generally follow within 72 hours, unless the Board allows additional time.

Businesses should prepare standard notification templates, escalation procedures and decision making authority before an incident occurs. A response team should include cybersecurity, legal, communications, compliance and relevant business leaders.

For example, if attackers obtain customer account information, the organisation should establish what data was affected, whether unauthorised access continues, which individuals face risk and what containment measures are needed. It should preserve evidence, coordinate legally required notifications and document the investigation.

The objective is to respond quickly without making unsupported claims. Initial communications should provide the information available, with further updates supplied as the investigation develops.

How Does the DPDP Act Interact With CERT In Requirements?

The DPDP framework does not replace India’s existing cybersecurity obligations. Depending on the organisation and incident, the Information Technology Act, 2000, and directions issued by the Indian Computer Emergency Response Team (CERT In) may also apply.

Under the CERT In Directions issued on 28 April 2022, specified cyber incidents must be reported within six hours of noticing them or being brought to their notice. The directions cover categories including data breaches, data leaks, unauthorised access and certain other cybersecurity incidents.

The six hour reporting requirement is distinct from the DPDP Rules’ breach notification requirements. A single incident may trigger both regimes, so businesses should not assume one notification automatically satisfies the other.

Organisations should establish an incident classification process, identify the relevant reporting channels and maintain an escalation matrix with clear deadlines. Their incident response plan should explain who determines reportability, who approves notifications and who maintains evidence of submissions.

Businesses can consult the CERT In official website for applicable directions, advisories and reporting information.

What Should Businesses Include in Their Compliance Programme?

Effective compliance starts with understanding where personal data resides and how it moves through the organisation. Businesses should conduct a data inventory covering customer information, employee records, website registrations, payment related information and data handled by service providers.

The next step is to document the purpose and legal basis for processing, identify access permissions and review retention practices. Data should not remain in systems indefinitely without a valid reason. Secure deletion procedures should cover production databases, endpoints, backups and third party environments, subject to applicable retention obligations.

Companies should also review privacy notices, consent mechanisms and processes for handling individual rights requests. Although these are not cybersecurity controls in the narrow technical sense, they are essential parts of the broader DPDP compliance framework.

Vendor management deserves particular attention. Contracts with cloud providers, payroll processors, customer relationship management platforms and outsourced support teams should address security responsibilities, incident escalation, access restrictions, evidence preservation and cooperation during investigations.

A compliance programme should also include periodic risk assessments, employee awareness training, access reviews, vulnerability testing and incident response exercises. Management should receive reports on unresolved risks, overdue remediation and significant incidents.

What Additional Obligations Apply to Significant Data Fiduciaries?

The Central Government may designate an organisation as a Significant Data Fiduciary based on statutory factors, including the volume and sensitivity of personal data processed and risks to individuals’ rights, sovereignty, security and public order.

Significant Data Fiduciaries face additional obligations under the Act and Rules. These include appointing a Data Protection Officer based in India, appointing an independent data auditor, undertaking periodic data protection impact assessments and audits, and complying with applicable requirements concerning algorithmic systems and specified data transfers.

Such organisations should integrate legal compliance into enterprise risk management. The security team, privacy function and senior management should jointly assess whether automated decision making, large scale profiling or sensitive business operations create additional risks.

Companies should also monitor commencement notifications and government directions. The phased implementation of the framework means organisations must plan against the actual commencement dates applicable to each provision rather than treating every requirement as simultaneously enforceable.

What Penalties Can Businesses Face for Non Compliance?

The DPDP Act provides for substantial financial penalties. Under its Schedule, failure to take reasonable security safeguards to prevent personal data breaches may attract a penalty of up to ₹250 crore. Failure to notify the Board or affected individuals of a personal data breach may attract a penalty of up to ₹200 crore.

The actual penalty depends on the applicable provision and circumstances. The statutory maximum is not an automatic fine for every incident. However, organisations should recognise the potential consequences of inadequate controls, delayed reporting and weak governance.

A business may also face contractual disputes, operational disruption, customer complaints and reputational harm. Other applicable laws and sector specific requirements may create additional obligations.

Maintaining evidence of implemented controls, incident decisions, training, vendor reviews and remediation can help demonstrate accountability. Documentation alone is insufficient if controls exist only on paper, so businesses should retain evidence of testing and actual operation.

How Can Businesses Build a Practical Compliance Roadmap?

A phased roadmap helps organisations prioritise legal risk and operational readiness.

Phase 1: Assess current practices

Map personal data, identify systems and vendors, review privacy notices, and compare existing controls against applicable statutory requirements.

Phase 2: Strengthen security

Implement access controls, encryption, monitoring, secure backups, vulnerability management and documented retention procedures.

Phase 3: Prepare for incidents

Create breach escalation procedures, reporting templates, evidence preservation protocols and a tested incident response plan.

Phase 4: Monitor and improve

Conduct periodic reviews, train employees, test controls, assess vendors and track regulatory developments and commencement dates.

Where legal interpretation, regulatory exposure or incident response creates uncertainty, organisations may consult cybersecurity lawyers for data protection to assess their obligations and align compliance policies with operational safeguards.

If a breach also involves alleged hacking, extortion, identity theft or other criminal conduct, criminal lawyers for cyber offences may assist with the criminal law implications, evidence preservation and interactions with investigating authorities.

Conclusion

DPDP Act cybersecurity compliance requires businesses in India to connect data protection law with practical security measures. Organisations should identify the personal data they hold, restrict access, maintain appropriate safeguards, prepare for breach notifications and establish clear accountability across internal teams and external service providers.

The most effective approach is proactive. Businesses should assess their current controls, prioritise material risks, test their incident response procedures and monitor the phased implementation of the legal framework. By combining sound cybersecurity practices with informed legal oversight, organisations can strengthen data protection and improve their readiness for regulatory scrutiny.