India regulatory tracker: MeitY, DPB, CERT-In, SEBI, RBI and IRDAI | Infofacility

Coming up

around 13 Nov 2026DPBRule 4 of the DPDP Rules 2025 and s. 6(9) of the Act take effect: Consent Manager registration opensOne year after the Rules, companies that want to act as Consent Managers can apply to the Board under Rule 4 and the First Schedule; they must be companies incorporated in India with a net worth of at least Rs 2 crore and meet the Schedule's conditions on independence and interoperability.Upcoming around 31 Mar 2027SEBIBRSR Core assessment or assurance reaches the top 1,000 listed entities (FY 2026-27)The last step of the glide path set on 12 Jul 2023: the top 1,000 listed entities by market capitalisation must have their BRSR Core for FY 2026-27 assessed or assured, and assessment or assurance of value chain disclosures becomes voluntary from the same year.Upcoming 13 May 2027MeitYDPDP Act and Rules: every remaining provision comes into forceNotice, consent, security safeguards, breach intimation, retention and erasure, children's data, Significant Data Fiduciary duties, Data Principal rights, appeals and the Schedule's penalties (up to Rs 250 crore) become enforceable eighteen months after the Rules were notified.Upcoming

Recent and in force

4 Nov 2026CERT-InArtificial Intelligence (AI) Security Auditing Guidelines (CISG-2026-04)CERT-In's guidance on auditing the security of AI systems, issued as a guideline rather than a Direction under s. 70B(6); expect CERT-In empanelled auditors and sector regulators to draw on it, and read it alongside ISO/IEC 42001.Voluntary 6 May 2026DPBAppointment to the posts of Chairperson and other Members in the Data Protection Board of India (F. No. 2(1)/2026-Pers.I)MeitY invites applications for the Board's Chairperson and four Members, at least one with legal expertise; the Board, established on 13 Nov 2025, needs them in place before it can hear complaints or impose penalties.Upcoming 26 Feb 2026CERT-InCyber Security Framework and Guidelines for Space including Satellite Communication (CISG-2026-01)Advisory guidelines, released with SIA-India, for satellite operators, ground stations, equipment vendors and space enterprises; not a Direction under s. 70B(6), so they bind you only where a regulator or a contract adopts them.Voluntary 10 Dec 2025MeitYCorrigenda to the Digital Personal Data Protection Rules, 2025 (G.S.R. 892(E))Eight typographical corrections to G.S.R. 846(E), including the clause reference "(a) to (g)" on page 38; nothing substantive changes, but quote the Rules from the corrected text.In force 13 Nov 2025MeitYDigital Personal Data Protection Rules, 2025 (G.S.R. 846(E))The Rules that make the Act work, in three phases: Rules 1, 2 and 17 to 21 (the Board) at once, Rule 4 (Consent Managers) one year later, and Rules 3, 5 to 16, 22 and 23 (notice, security safeguards, breach intimation within 72 hours, retention, children, Significant Data Fiduciaries, rights, appeals) eighteen months later, on 13 May 2027.In force 13 Nov 2025MeitYCommencement of provisions of the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E))Brings the Board provisions (ss. 18 to 26), the definitions and the rule-making powers into force at once; s. 6(9), on Consent Manager registration, after one year; and the operative duties, rights and penalties (ss. 3 to 17 and 27 to 34 among them) after eighteen months, on 13 May 2027.In force 13 Nov 2025DPBEstablishment of the Data Protection Board of India (G.S.R. 844(E))The Central Government establishes the Board under s. 18, with its head office in the National Capital Region; a companion notification, G.S.R. 845(E), fixes four Members. The Chairperson and Members are appointed separately; MeitY called for applications on 6 May 2026.In force 31 Aug 2025SEBICSCRF compliance deadline for SEBI regulated entities (extended by SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2025/96)The last extension, by two months from 30 Jun 2025, for all REs except MIIs, KRAs and QRTAs; from this date your cyber audits by CERT-In empanelled auditors run on the CSCRF calendar and the first audit cycle has closed.Deadline 28 Aug 2025SEBITechnical Clarifications to Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs) (SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2025/119)CSCRF scope is limited to systems used exclusively for SEBI-regulated activity, controls equivalent to another regulator's framework count as compliance, mobile app security and ISO 27001 certification become recommendatory, VAPT reports are submitted as summaries, portfolio managers are re-categorised by AUM, and REs must follow CERT-In's cyber security audit policy guidelines.In force 28 Mar 2025SEBIMeasures to facilitate ease of doing business with respect to framework for assurance or assessment, ESG disclosures for value chain and introduction of voluntary disclosure on green credits (SEBI/HO/CFD/CFD-PoD-1/P/CIR/2025/42)Listed entities may choose assessment or assurance for BRSR Core instead of mandatory reasonable assurance; value chain disclosures become voluntary for the top 250 from FY 2025-26 and their assessment or assurance voluntary from FY 2026-27; a green credits leadership indicator is added from FY 2024-25; the glide path to the top 1,000 stays.In force 3 Jan 2025MeitYDraft Digital Personal Data Protection Rules, 2025, published for public consultation (G.S.R. 02(E))MeitY published 22 draft rules and seven schedules for comment on MyGov until 18 Feb 2025 (later extended); 6,915 inputs were received, and the final Rules notified on 13 Nov 2025 replaced the draft, with changes to numbering and content.Superseded 20 Aug 2024SEBICybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities (REs) (SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113)One graded framework replaces SEBI's earlier cybersecurity circulars: five RE categories, cyber audits by CERT-In empanelled auditors, a Cyber Capability Index for MIIs and Qualified REs, with compliance originally due by 1 Jan 2025 for the six categories that already had a circular and 1 Apr 2025 for the rest.In force 7 Nov 2023RBIMaster Direction on Information Technology Governance, Risk, Controls and Assurance Practices (RBI/2023-24/107)From 1 Apr 2024, commercial banks, NBFCs in the top, upper and middle layers, credit information companies and all-India financial institutions need a board-level IT Strategy Committee, a CISO independent of the IT function, risk-based IS audit, six-monthly vulnerability assessments and annual penetration tests of critical systems, and half-yearly DR drills.In force 11 Aug 2023ParliamentThe Digital Personal Data Protection Act, 2023 (No. 22 of 2023)India's first standalone personal data law receives the President's assent; its sections take effect only on the dates the Central Government notifies under s. 1(2), so nothing changed for companies on this day.In force 12 Jul 2023SEBIBRSR Core: Framework for assurance and ESG disclosures for value chain (SEBI/HO/CFD/CFD-SEC-2/P/CIR/2023/122)Introduces BRSR Core, a set of KPIs under nine ESG attributes, with mandatory reasonable assurance on a glide path (top 150 listed entities in FY 2023-24, 250 in FY 2024-25, 500 in FY 2025-26, 1,000 in FY 2026-27) and value chain disclosures for the top 250 from FY 2024-25; the assurance and value chain requirements were replaced on 28 Mar 2025, the glide path stays.Superseded 24 Apr 2023IRDAIIRDAI Information and Cyber Security Guidelines, 2023Insurers and insurance intermediaries must run a board-overseen information security programme with a CISO and an Information Security Risk Management Committee, carry out annual risk assessments and audits reported to IRDAI, and follow CERT-In's 6-hour incident reporting; the Guidelines replace the 2017 guidelines for insurers.In force 10 Apr 2023RBIMaster Direction on Outsourcing of Information Technology Services (RBI/2023-24/102)Banks, larger NBFCs and other regulated entities must govern material IT outsourcing through a board-approved policy, risk-based due diligence, contracts with audit and access rights and storage of data in India, exit plans and concentration risk checks, and providers must report incidents fast enough for the entity to notify RBI within 6 hours; effective 1 Oct 2023.In force around 27 Jun 2022CERT-InCERT-In Directions of 28 Apr 2022 take effectSixty days after issue, by the Directions' own terms (many summaries give 28 Jun 2022); CERT-In's notice of 27 Jun 2022 gave MSMEs, and data centre, VPS, cloud and VPN providers for customer validation, until 25 Sep 2022.In force 28 Apr 2022CERT-InDirections under sub-section (6) of section 70B of the Information Technology Act, 2000 relating to information security practices, procedure, prevention, response and reporting of cyber incidents for Safe & Trusted Internet (No. 20(3)/2022-CERT-In)Every service provider, intermediary, data centre, body corporate and government organisation must report the cyber incidents listed in Annexure I to CERT-In within 6 hours of noticing them, keep 180 days of ICT logs within India, synchronise clocks to NIC or NPL time and designate a point of contact; the Directions take effect 60 days after issue.In force

This page explains the law in plain English. It is not legal advice. Each entry links to the document it describes.