Cyber Security: Data protection: the DPDP Act and the IT Rules

The directions were issued under section 70B(6). Section 70B, inserted by the IT (Amendment) Act 2008, makes the Indian Computer Emergency Response Team the national agency for incident response, with functions such as collecting and analysing incident information, issuing alerts, emergency measures, coordination and guidelines. Sub-section (6) empowers CERT-In to 'call for information and give direction to the service providers, intermediaries, data centres, body corporate and any other person', and sub-section (7) makes non-compliance punishable with up to one year's imprisonment, a fine up to one lakh rupees, or both. Section 70A deals with the nodal agency for critical information infrastructure (NCIIPC), section 69A with blocking of online content, and section 79 with the safe harbour for intermediaries.

NCIIPC was designated on 16 January 2014 (Gazette notification G.S.R. 18(E)) as the national nodal agency under section 70A of the IT Act, as 'an organisation under the National Technical Research Organisation'. The NCIIPC Rules, 2013 place it under the administrative control of NTRO, the technical intelligence agency that reports to the National Security Adviser. Its job is to protect computer resources whose incapacitation would have a debilitating impact on national security, the economy, public health or safety, in sectors such as power and energy, banking and insurance, telecom, transport, government, strategic and public enterprises, and health. CERT-In, under the IT ministry, handles incident response for the whole cyberspace, and MHA's I4C deals with cybercrime.

Both statements are correct. The Finance Act, 2017 merged several tribunals, and section 48 of the IT Act now provides that the Telecom Disputes Settlement and Appellate Tribunal shall be the Appellate Tribunal under the Act from the commencement of Part XIV of Chapter VI of the Finance Act, 2017; the separate Cyber Appellate Tribunal ceased to exist. The DPDP Act, 2023 defines 'Appellate Tribunal' in section 2(a) as the TDSAT, and section 29 lets a person aggrieved by a Board order appeal within sixty days; the tribunal tries to dispose of appeals within six months and, as far as practicable, works as a digital office. Using one tribunal for both telecom and data disputes reflects the policy of reducing the number of specialised tribunals.

Statements 1 and 2 are correct. Section 18 establishes the Board as a body corporate with perpetual succession and a common seal, able to hold property, contract, and sue and be sued. Section 20 sets a two-year term with eligibility for re-appointment, and section 19 requires at least one member to be an expert in law. Under section 28 the Board functions as an independent body and, as far as practicable, as a digital office, with proceedings conducted using techno-legal measures. Statement 3 is wrong: the DPDP Act is a civil-penalty law. The Board can impose monetary penalties listed in the Schedule after an inquiry, up to Rs 250 crore for failure to take reasonable security safeguards, but it has no power to imprison anyone; it has civil-court powers only for summoning, evidence and inspection.

Section 10 lets the Central Government notify a Data Fiduciary or class as a Significant Data Fiduciary (SDF) on the basis of factors such as the volume and sensitivity of data, risk to Data Principals, impact on sovereignty and integrity of India, electoral democracy, State security and public order. An SDF must appoint a Data Protection Officer based in India who is responsible to the Board of Directors and is the point of contact for grievances, appoint an independent data auditor, and undertake periodic Data Protection Impact Assessments, periodic audits and other prescribed measures. The DPDP Rules add that an SDF must carry out the DPIA and audit once every twelve months and verify that algorithmic software it uses does not risk the rights of Data Principals. There is no requirement of prior CERT-In approval for processing; CERT-In handles incident response, not data-processing licences.

Pairs 1, 2 and 4 are correct. Section 65 punishes knowingly concealing, destroying or altering computer source code that must be kept by law (up to three years, a fine up to two lakh rupees, or both). Section 66C punishes fraudulent use of another person's electronic signature, password or other unique identification feature (up to three years and a fine up to one lakh rupees). Section 66F, cyber terrorism, covers acts such as denying access or penetrating systems with intent to threaten the unity, integrity, security or sovereignty of India, and carries up to life imprisonment. Pair 3 is wrong: section 66E punishes violation of privacy, that is, capturing, publishing or transmitting images of a person's private area without consent. Cheating by personation using a computer resource is section 66D.

Statements 1 and 2 are correct. Section 44(2) of the DPDP Act omits section 43A of the IT Act, along with the related rule-making power, so the 2011 'SPDI Rules' framework for sensitive personal data is replaced by the new law; this part commences 18 months after the 13 November 2025 notification. Section 44(3) substitutes RTI section 8(1)(j) with 'information which relates to personal information', removing the earlier test of whether disclosure had any relationship to public activity or interest. This change has been criticised by transparency activists. Statement 3 is wrong: section 34 says all sums realised by way of penalties imposed by the Board are credited to the Consolidated Fund of India. Unlike section 43A, the new Act has no compensation route to the individual, which is one of the main criticisms of the law.

Statements 1 and 2 are correct. Rule 6 lists minimum safeguards: data security measures such as encryption, obfuscation, masking or virtual tokens; access control; visibility through logs and monitoring; backups for continued processing; retaining logs and personal data for one year to detect and investigate unauthorised access; and contract clauses with Data Processors. Rule 7 requires a Data Fiduciary to tell affected Data Principals and the Board without delay, and to send the Board a detailed report within seventy-two hours (or longer if the Board allows), covering the facts, mitigation steps, findings on who caused it, and remedial measures. Statement 3 is wrong: the Rules were published on 13 November 2025, but rule 1(4) brings rules 3, 5 to 16, 22 and 23, including rules 6 and 7, into force only eighteen months after publication, in line with the phased commencement of the Act itself.

All three must report cyber incidents (d). Under Section 70B of the IT Act, 2000 and the CERT-In Rules, 2013, service providers (1), data centres (2), body corporates (3) and intermediaries must report cyber security incidents to CERT-In (the Indian Computer Emergency Response Team, under MeitY). CERT-In's April 2022 directions set a six-hour reporting deadline. They also require logs to be kept for 180 days, and VPN providers must store user details for five years.

Critical sectors are protected by NCIIPC under Section 70A. Notice the related laws: the Digital Personal Data Protection Act, 2023 and its 2025 Rules, which add a duty to report data breaches to the Data Protection Board.

Answer as per the official UPSC answer key.

Open this question's page →