Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

India CERT-In Cyber Security Directions

In force India · In force Jun 27, 2022 · no upcoming deadlines

Official text
Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics

Deadlines

ComplianceSep 25, 2022 · 4.1 years ago · Source
Extended date for MSMEs and subscriber validationThe Directions apply to micro, small and medium enterprises, and subscriber validation duties apply to data centres, VPS, cloud and VPN providers, from this date.
Takes effectTentativeJun 27, 2022 · 4.3 years ago · Source
CERT-In Directions take effectThe Directions apply 60 days after issue on 28 Apr 2022. The exact day (27 or 28 June 2022) depends on how the 60 days are counted.

Summaries for reference, not legal advice. Check the official text.

What it does

Requires service providers, intermediaries, data centres, body corporates and government bodies to report listed cyber incidents to CERT-In within 6 hours of noticing them. Entities must sync clocks to Indian NTP servers, keep ICT logs for a rolling 180 days within India, and name a point of contact. Data centre, VPS, cloud and VPN providers must keep validated subscriber details for 5 years.

Who it applies to
Service providers, intermediaries, data centres, body corporates and government organisations in India, with extra record duties for data centres, VPS, cloud and VPN providers, virtual asset providers and exchanges.
Penalties
Non-compliance can lead to punitive action under section 70B(7) of the IT Act, which provides for imprisonment of up to one year, a fine of up to INR 1 lakh, or both.
Enforced by
Indian Computer Emergency Response Team (CERT-In), MeitY
Official name
Directions under section 70B(6) of the Information Technology Act, 2000 relating to information security practices, procedure, prevention, response and reporting of cyber incidents for Safe and Trusted Internet
Citation
CERT-In Directions No. 20(3)/2022-CERT-In, 28 Apr 2022
Topics
Cybersecurity, Breach notification, Data residency
Verified 2026-09-25 cert-in.org.in cert-in.org.in cert-in.org.in
Research notes

The Directions say they take effect 60 days after issue, and the 27 June 2022 extension notice repeats this without naming a day, so the main effective date is marked tentative. Penalty figures come from section 70B(7) of the IT Act, which the Directions cite.

Related

In forceAustralia
Australia Cyber Security Act (ransomware reporting)Australia's first standalone cyber law: mandatory reporting of ransomware or cyber-extortion payments within 72 hours, security standards for consumer smart devices, 'limited use' protections for information shared with ASD and the National Cyber Security Coordinator, and a Cyber Incident Review Board. Ransomware payment reporting has applied since 30 May 2025.In effect since Nov 30, 2024
AmendedAustralia
Australia Privacy ActAustralia's federal privacy law (13 Australian Privacy Principles, Notifiable Data Breaches scheme). The 2024 amendment adds a statutory tort for serious invasions of privacy, tiered civil penalties and infringement notices, a mandate for a Children's Online Privacy Code, clearer security duties, and privacy-policy transparency for substantially automated decisions from 10 December 2026. It also adds criminal doxxing offences.Next: Dec 10 Children's Online Privacy Code must be registered · in 44 days
AmendedAustralia
Australia SOCI ActAustralia's critical infrastructure security law. Owners and operators of critical infrastructure assets must register ownership and operational information, and many must report cyber security incidents to the Australian Signals Directorate. Responsible entities for many asset classes must also keep a critical infrastructure risk management program. Systems of national significance face enhanced cyber security obligations, and the government has step-in and assistance powers.In effect since Jul 11, 2018
In forceChina
China Cross-Border Data Flow ProvisionsRelaxes China's data export regime by exempting common transfers (contracts with the individual, cross-border HR, emergencies, and non-CII transfers of PI of fewer than 100,000 people a year) and setting volume thresholds for when a CAC security assessment, standard contract or certification is needed. Data is not 'important data' unless regulators have notified or published it as such.In effect since Mar 22, 2024
In forceChina
China Cyber Incident Reporting MeasuresRequires network operators in China to grade cybersecurity incidents using an annexed grading guide and report incidents rated relatively major or above. CII operators must report within 1 hour, central government bodies within 2 hours, and other operators to the provincial CAC within 4 hours. A full post-incident report is due within 30 days after handling ends, and ransom demands must be disclosed.In effect since Nov 1, 2025
AmendedChina
China Cybersecurity LawChina's base cybersecurity statute: multi-level protection scheme duties for network operators, localization and security review duties for critical information infrastructure (CII) operators, and content controls. The 2025 amendment, in force from 1 January 2026, adds AI governance support, ties PI processing to PIPL, allows fines on first violations and sharply raises maximum fines.In effect since Jun 1, 2017
In forceChina
China Data Export Security Assessment MeasuresSets the CAC security assessment that must be passed before certain data leaves China, including exports of important data and large-scale personal information exports. Data handlers must run a self-assessment, then apply through the provincial CAC for a national CAC review. Transfers already under way had six months to come into compliance.In effect since Sep 1, 2022
In forceChina
China Data Security LawSets up China's data classification and grading system, with heightened protection for 'important data' and 'core data'. Requires data processors to run data security management systems, risk monitoring and incident handling, and restricts giving data stored in China to foreign judicial or law-enforcement bodies without approval.In effect since Sep 1, 2021
Questions about India CERT-In Cyber Security Directions
What are the India CERT-In Cyber Security Directions compliance deadlines?
Jun 27, 2022: CERT-In Directions take effect (tentative). Sep 25, 2022: Extended date for MSMEs and subscriber validation.
When does India CERT-In Cyber Security Directions take effect?
India CERT-In Cyber Security Directions took effect on Jun 27, 2022.
Who does India CERT-In Cyber Security Directions apply to?
Service providers, intermediaries, data centres, body corporates and government organisations in India, with extra record duties for data centres, VPS, cloud and VPN providers, virtual asset providers and exchanges.
What are the penalties under India CERT-In Cyber Security Directions?
Non-compliance can lead to punitive action under section 70B(7) of the IT Act, which provides for imprisonment of up to one year, a fine of up to INR 1 lakh, or both.