India's cybersecurity mandate: Compliance, resilience, and AI advantage

(the GDPR and NIS2) and Singapore's Personal Data Protection Act (Amended 2020) but with a stronger focus on opera- tional resilience over documentation.

- SUJATHA S IYER

NDIA'S digital economy is scaling faster than ever, driven by fintech, e-commerce, AI startups, and government digitalisation. Along with this growth comes a vital need for cyber resilience and data protection.

Policy moves and audit directives, such as the Digital Personal Data Protection (DPDP) Act and the Comprehensive Cyber Security Audit Policy from the Indian Computer Emergency Response Team (CERT-In), mark a turning point. These represent India's declaration of digital sovereignty. The message is clear: data protection and cyber resilience have become national imperatives.

India's cybersecurity landscape

The DPDP Act establishes India's first comprehensive data protection initiative by mandating explicit consent for data collection, implementing purpose limitation and minimal data retention, and requiring 72-hour breach reporting, among others. It also requires reasonable security safeguards across all data-handling entities, and mandates penalties for noncompliance, which can reach up to 250 crore per violation.

These rules are still being refined. The DPDP Act compels enterprises to shift from reactive compliance to proactive data governance.