CERT-In Directions take effect
Report specified cyber incidents within 6 hours of noticing them, keep ICT logs for 180 days in India, sync clocks with NIC or NPL, and name a point of contact.
CERT-InAll organisationsDPDP Act passed · IRDAI guidelines issued
India's Digital Personal Data Protection Act becomes law, pending rules. IRDAI issues information and cyber security guidelines for insurers.
DPDPIRDAIRBI Master Direction on IT governance applies
IT governance, risk, controls and assurance expectations for banks, NBFCs and other regulated entities.
RBISEBI issues CSCRF
The Cybersecurity and Cyber Resilience Framework for SEBI-regulated entities, with phased timelines by entity category.
SEBIDPDP Rules 2025 notified
The rules set a phased timeline. Provisions setting up the Data Protection Board apply first.
DPDPConsent manager provisions
Rules on registering and operating consent managers take effect about 12 months after notification.
DPDPMain DPDP obligations enforceable
Notice, consent, security safeguards, breach intimation, processor contracts, retention and rights requests. Penalties of up to ₹250 crore for failing to protect personal data.
DPDPAnyone processing Indian personal data
See InspireGRC on your own requirements
Bring a real questionnaire or your auditor's request list. 30 minutes, no scripted demo.