Cybersecurity and data protection are closely connected, but they serve different purposes. Cybersecurity protects systems, networks and information from unauthorised access, disruption, alteration or destruction. Data protection governs how personal information is collected, used, stored, shared and deleted. Together, cybersecurity and data protection help businesses protect sensitive information, meet legal obligations and maintain the trust of customers, employees and business partners. For businesses in India, the connection has become increasingly important as digital operations expand and cyber threats grow more sophisticated. A ransomware attack, data leak or compromised employee account may create technical, financial, contractual and regulatory consequences. Understanding the applicable legal framework helps organisations move beyond reactive security measures towards a structured approach to risk management and accountability.

What Is the Difference Between Cybersecurity and Data Protection?

Cybersecurity focuses on protecting digital assets against threats. Common measures include encryption, access controls, network monitoring, multi factor authentication, secure software development, vulnerability management and incident response. Its primary concern is preventing or managing unauthorised activity involving systems and information. Data protection focuses on the rights of individuals and the responsible handling of personal information. It considers whether an organisation has a lawful basis to process data, whether the collection is necessary, who can access the information, how long it should be retained and when it must be erased. The National Institute of Standards and Technology’s explanation of the relationship between cybersecurity and privacy explains how these disciplines overlap while addressing distinct risks.

A business can have strong cybersecurity and still mishandle personal data. For example, a company may encrypt its customer database but use the information for purposes which were never properly disclosed. Conversely, a business may publish a comprehensive privacy policy but leave its database exposed through weak access controls. Effective compliance requires both secure systems and responsible data governance.

The Legal Framework for Cybersecurity and Data Protection in India

1. The Information Technology Act, 2000

The Information Technology Act, 2000 remains a key part of India’s cyber law framework. Section 43 addresses specified unauthorised acts involving computer systems, while Section 66 deals with certain acts described under Section 43 when committed dishonestly or fraudulently. Section 66C concerns identity theft, and Section 66D addresses cheating by personation using computer resources. Section 43A historically provided for compensation in specified circumstances involving failure by a body corporate to maintain reasonable security practices while handling sensitive personal data or information. However, the legal position must be read alongside subsequent data protection legislation and commencement notifications. Businesses should not assume older provisions operate unchanged or in isolation from the newer framework.

2. The Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 establishes a framework for processing digital personal data in India. It places obligations on Data Fiduciaries, including responsibility for implementing appropriate technical and organisational measures to protect personal data. It also addresses personal data breach notifications, individual rights and accountability. The Act and the Digital Personal Data Protection Rules, 2025 were introduced with a phased commencement schedule. As of October 2026, organisations must distinguish provisions already in force from substantive obligations scheduled for later commencement. Many core operational requirements under the Rules are scheduled to commence 18 months after notification, in May 2027. Businesses should consult the Ministry of Electronics and Information Technology’s official DPDP Rules and enforcement timeline before treating a future requirement as an existing legal duty. The practical lesson is clear: businesses should prepare their systems and policies in advance while accurately identifying which legal provisions apply at the relevant time.

3. CERT-In Cybersecurity Directions

The Indian Computer Emergency Response Team, or CERT-In, operates under Section 70B of the Information Technology Act. Its directions issued in April 2022 impose specific cybersecurity requirements on entities within their scope. These include reporting specified cyber incidents within six hours of noticing them or being informed of them, maintaining logs of ICT systems for a rolling period of 180 days within Indian jurisdiction, and meeting applicable requirements concerning time synchronisation and records. The reporting obligation is particularly important because the response team may not have all the facts within six hours. CERT-In guidance permits organisations to report the information available within the required period and provide further details later. Businesses should establish escalation procedures so employees do not delay reporting while waiting for a complete forensic investigation. The applicable directions and FAQs are available on the official CERT-In directions. Sector specific rules, regulatory directions and contractual requirements may create additional obligations for organisations operating in financial services, telecommunications, healthcare and other regulated industries.

Why Cybersecurity Is Essential for Legal Compliance?

1. Protecting Personal and Confidential Information

Businesses routinely process names, contact details, identity records, payment information, employee files, customer communications and confidential commercial data. Unauthorised disclosure can expose individuals to fraud and identity theft while causing financial and reputational harm to the organisation. Security controls should reflect the sensitivity of the information and the risks associated with its use. Practical measures include limiting access to authorised personnel, encrypting sensitive data, reviewing user permissions, maintaining reliable backups and testing recovery procedures. Security should also extend to paper records, removable devices, cloud platforms and third party systems where relevant.

2. Meeting Breach Reporting Obligations

A cyber incident may trigger several reporting duties. The applicable requirements depend on the type of incident, the organisation, the data involved and the legal or contractual framework. A report to CERT-In may be required even where the incident does not involve personal data. Conversely, an incident involving personal information may engage data protection duties alongside sectoral or contractual requirements. Businesses should not assume a single notification satisfies every obligation. The DPDP framework includes personal data breach notification requirements, with important operational provisions subject to phased commencement. International customers may also impose additional reporting deadlines under contracts or foreign privacy laws. A documented reporting matrix helps legal, security and management teams identify the correct recipient, deadline and information required.

3. Maintaining Accountability and Evidence

After an incident, regulators, customers, insurers or courts may ask what happened, when the organisation became aware of it, which safeguards were in place and how the response was managed. Logs, access records, risk assessments, incident tickets, vendor communications and decision records can help establish a reliable account. Evidence should be preserved in a controlled manner, with access restricted to appropriate personnel. Organisations should also consider legal holds and applicable retention requirements before deleting potentially relevant material. Documentation does not eliminate liability, but it can demonstrate that the business followed a considered process rather than responding without governance.

Practical Steps Businesses Should Take

1. Conduct a Data and Cyber Risk Assessment

Begin by identifying the personal and confidential information held by the organisation, where it is stored, why it is processed and who can access it. Map data flows between internal teams, cloud providers, software vendors and other service providers. This exercise helps identify excessive access, unnecessary collection, insecure transfers and information retained longer than required.

2. Establish Written Policies and Clear Responsibilities

A cybersecurity policy should define acceptable use, access management, password and authentication controls, device security, backups, vulnerability handling and incident escalation. A data protection policy should address collection, permitted use, transparency, retention, deletion, individual requests and sharing with third parties. The policies should work together and reflect the organisation’s actual systems and risk profile.

3. Train Employees and Test Incident Response

Human error remains a common source of security exposure. Regular training should cover phishing, suspicious attachments, social engineering, safe handling of personal data and prompt reporting of unusual activity. Staff should know whom to contact if an account is compromised or information is sent to the wrong recipient. An incident response plan should identify decision makers, technical responders, legal advisers, communications leads and external specialists. Tabletop exercises can test whether the organisation can contain an attack, preserve evidence, assess the affected data and meet reporting deadlines. Lessons from exercises and actual incidents should lead to documented improvements.

4. Review Vendors and Contracts

A business may remain exposed even when its own systems are secure if a service provider suffers a breach. Before appointing a vendor, assess its security practices, access requirements, incident history where available and ability to support recovery. Contracts should address confidentiality, security controls, incident notification, cooperation with investigations, subcontracting, data return and deletion, and allocation of responsibilities. Certification can provide useful evidence of a vendor’s security programme, but it does not automatically establish compliance with every legal requirement. Organisations should assess whether the vendor’s controls fit the nature of the data and the services provided.

The Role of Legal Advice in Cybersecurity Governance

Cybersecurity is not solely an IT responsibility. Legal teams help identify applicable laws, interpret reporting duties, review contractual exposure, assess cross border data flows and coordinate communications following an incident. Technical specialists establish what occurred and how systems can be secured; legal advisers help determine what the organisation must do, when it must act and how to document its decisions.Businesses may consult cybersecurity and data protection lawyers to review incident response plans, privacy practices, vendor agreements and regulatory obligations. Early legal input can help prevent avoidable delays, inconsistent notifications and unsupported public statements during a crisis.For ongoing governance, corporate legal advisory can help align cybersecurity policies with board oversight, risk management, commercial contracts and wider compliance procedures. This integrated approach is particularly useful for growing businesses, organisations handling sensitive information and companies serving customers across multiple jurisdictions.

Conclusion

Cybersecurity and data protection are complementary parts of responsible business management. Cybersecurity protects systems and information from unauthorised access, disruption or damage, while data protection governs the lawful and responsible handling of personal data. Neither can replace the other. Indian businesses should understand their obligations under the Information Technology Act, applicable CERT-In directions, the DPDP framework and relevant sectoral or contractual rules. By mapping data, strengthening security controls, preparing for breach reporting, training employees and reviewing vendors, organisations can reduce legal risks and build a more resilient compliance framework. Seeking timely legal guidance and integrating corporate legal advisory services into business risk management can help organisations align their cybersecurity measures with applicable laws, contractual commitments and evolving regulatory requirements. Regular legal and technical reviews remain essential as cyber threats and compliance obligations continue to evolve.

Frequently Asked Questions (FAQs)

Q1. What is the relationship between cybersecurity and data protection?

Cybersecurity protects systems and information from unauthorised access, disruption or damage. Data protection governs how personal data is collected, used, stored, shared and deleted. Strong cybersecurity supports data protection, but organisations must also ensure their processing practices are lawful and transparent.

Q2. Which Indian laws govern cybersecurity and data protection?

The principal frameworks include the Information Technology Act, 2000, applicable CERT-In directions and the Digital Personal Data Protection Act, 2023, together with its Rules as they commence. Sector specific regulations and contractual requirements may also apply.

Q3. Is cybersecurity legally mandatory for businesses in India?

Legal requirements depend on the organisation, its activities, the information it handles and the rules applicable to it. CERT-In directions impose specified requirements on entities within their scope, while data protection and sectoral laws may require appropriate safeguards. Businesses should assess their specific obligations rather than assume one standard applies to everyone.

Q4. What should a business do after a data breach?

The organisation should activate its incident response plan, contain the incident, preserve relevant evidence, assess the affected systems and information, and involve appropriate technical and legal personnel. It should identify all applicable reporting duties and deadlines, notify the relevant authorities or affected individuals where legally required, and document the response.

Q5. Does the DPDP Act require businesses to report personal data breaches?

The DPDP Act establishes personal data breach notification obligations, with detailed operational requirements provided by the Rules. Since commencement is phased, businesses should verify the applicable effective dates and requirements. They should also assess separate obligations under CERT-In directions, sectoral rules and contracts.

Q6. How can small businesses improve cybersecurity and data protection compliance?

Small businesses can start by mapping the personal data they hold, restricting access, enabling multi factor authentication, updating software, encrypting sensitive information, maintaining tested backups and training employees. They should also maintain written policies, review vendors and prepare an incident response process proportionate to their risks.

This update was released on 14 Oct 2026.

The views expressed in this update are personal and should not be construed as any legal advice. Please contact us directly on +91 22 40565252 or contact@mhcolaw.com for any assistance.

Legal Update Team
MANSUKHLAL HIRALAL & COMPANY
Advocates, Solicitors and Notaries
T: +91 22 40565252
Mumbai Office: Surya Mahal, 2nd Floor, 5, Burjorji Bharucha Marg, Fort, Mumbai-400 023, India
Delhi Office: Block C-9, Lower Ground Floor, Jangpura Extension, New Delhi - 110 014, India
www.mhcolaw.com

"Noted lawyer in the Real Estate practitioner from India" - Chambers & Partners

Please consider the environment before printing this email

The information contained in this communication is intended solely for the use of the individual or entity to whom it is addressed and others authorized to receive it. This communication may contain confidential or legally privileged information. If you are not the intended recipient, any disclosure, copying, distribution or action taken relying on the contents is prohibited and may be unlawful. If you have received this communication in error, or if you or your employer does not consent to email messages of this kind, please notify the sender immediately by responding to this email and then delete it from your system. No liability is accepted for any harm that may be caused to your systems or data by this message.