GUIDE
CERT-In directions and the DPDP Act: an IT checklist for Indian businesses
Darshan Savkar (opens in new tab) · Published 17 October 2026 · Last reviewed 17 October 2026 · 4 min readCERT-In directions (April 2022)
CERT-In (opens in new tab), the Indian Computer Emergency Response Team, issued directions on 28 April 2022 under section 70B(6) of the Information Technology Act, 2000. They apply to service providers, intermediaries, data centres, body corporates and government organisations, so most registered companies are covered.
| Requirement | What it means in IT terms |
|---|---|
| Report specified cyber incidents to CERT-In within 6 hours of noticing them | An incident runbook that names who decides and who reports, with CERT-In’s reporting details in it. The directions list the incident types, including unauthorised access, data breaches and leaks, malicious code, website defacement and attacks on servers |
| Keep logs of all ICT systems securely for a rolling 180 days, within India | Central log retention for firewalls, servers, Microsoft 365 or Google Workspace audit logs and key applications. Check how long your SaaS tools keep logs by default and where |
| Sync system clocks to the NTP servers of NIC or NPL, or to servers traceable to them | Point domain controllers, firewalls and servers to an approved time source, so log timestamps line up during an investigation |
| Designate a point of contact and share it with CERT-In | Name a person, and a backup, who handles CERT-In communication |
Data centres, cloud and VPN providers have extra duties, such as keeping subscriber records for 5 years. These apply to the providers, not usually to their business customers.
The DPDP Act, 2023
The Digital Personal Data Protection Act, 2023 governs digital personal data in India. If you decide why and how personal data is processed, you are a “data fiduciary”. If you process it on someone else’s behalf, you are a “data processor”. The DPDP Rules, 2025, notified in November 2025, give the detail and phase it in: most duties apply 18 months after notification.
| Duty (section of the Act) | What it means in IT terms |
|---|---|
| Protect personal data with reasonable security safeguards to prevent a breach (s. 8(5)) | Encryption, access control, MFA, logging and monitoring, and backups for the systems holding personal data. The Rules list these safeguards and require logs to be kept for at least one year |
| Notify the Data Protection Board and each affected person of a personal data breach (s. 8(6)) | An incident process that can tell, quickly, whose data was affected and what. Prepare the notification templates before you need them |
| Erase personal data once its purpose is served, unless the law requires keeping it (s. 8(7)) | A retention schedule, applied to mailboxes, shared drives, CRMs and backups |
| Use data processors only under a valid contract (s. 8(2)) | Data processing agreements with your IT, cloud and software providers, and a list of who processes what |
| Publish a way for people to raise grievances (s. 8(10)) | A named contact, and a way to find and act on an individual’s data when they ask |
Penalties are set in the Act’s Schedule: up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore for failing to notify a breach.
A combined IT checklist
- Name an incident lead, a backup and a CERT-In point of contact.
- Write a one-page incident runbook with the 6-hour CERT-In clock and the DPDP breach notices in it.
- Turn on audit logging in Microsoft 365 or Google Workspace, on firewalls and on servers, and keep logs for at least one year. That meets the Rules’ one-year minimum and CERT-In’s 180 days, as long as the logs are kept in India or you confirm the arrangement is acceptable.
- Point every system’s clock to an NIC or NPL time server, or a server traceable to them.
- Turn on MFA and encryption, and limit access to personal data to the people who need it.
- Map where personal data sits: CRM, email, HR files, spreadsheets and backups.
- Set a retention schedule, and apply it.
- Sign data processing agreements with your IT and software providers.
- Rehearse once: walk through a fake incident and time how long it takes to answer “what happened, whose data, who do we tell?”
Sources
- CERT-In (opens in new tab), Directions under sub-section (6) of section 70B of the Information Technology Act, 2000, dated 28 April 2022, and the accompanying FAQs.
- Ministry of Electronics and Information Technology (MeitY) (opens in new tab), the Digital Personal Data Protection Act, 2023 (No. 22 of 2023) and the Digital Personal Data Protection Rules, 2025.
This guide is general information, not legal advice. Laws and standards change; check the primary sources linked below, and ask your lawyer how they apply to your business. See our editorial and claims policy for how we write and review guides. Found an error? Email hello@zaivit.com with the subject "Correction".