Published on 08th June 2025
Authored By: Rishika Mishra
SVKM'S NMIMS Kirit P. Mehta School Of Law, Mumbai
Introduction
India’s digital expansion has witnessed new frontiers of economic growth, innovation, and interconnectivity never before. But the very pace of digitization has exposed India’s cybersecurity ecosystem, data privacy ecosystem, and legal ecosystem to ensure that it fights cybercrimes. With the growing sophistication of and frequency of cyber attacks, India’s cyber front has never required a stronger legal infrastructure to safeguard it as much as at present. It is the aim of this essay to examine India’s legal infrastructure for its cyber security, data privacy, and cyber forensics, on one hand, and its most critical issues and reforms awaited to address them, on the other.
Cybersecurity Regulations: A Legal Framework in the Making
India’s pivot of cyber law is the Information Technology Act, 2000 (IT Act). The IT Act, initially enacted to address electronic commerce as well as digital signatures, has subsequently been amended to address cybersecurity provisions. The amendments made in the year 2008 were significant as much as the amendments created penal provisions of law against cyberlaw crimes such as identity theft, hacking, and phishing[1]. Section 69 of the Act had also granted authority to the government for intercepting and tapping electronic messages in the arena of national security [2].But now IT Act is conceived as archaic in relation to present cyber threats of ransomware, attacks driven by artificial intelligence, and deepfakes. There exists no working cyberlaw, and hence there is disparity on the issue of how India must reply to incoming assaults.
Institutional Mechanisms
India has some institutions that try to address cybersecurity:
- CERT-In (Indian Computer Emergency Response Team)- coordinates incident response to cyber incidents. But its efficiency is generally hindered by slow compromises and the absence of technical abilities[3].
- The National Critical Information Infrastructure Protection Centre (NCIIPC)- focused its activities in industry protection that fell under categories of being of a critical nature like energy, finance, and healthcare. Regardless of whatever mandate it may have been given, varying jurisdictions between state departments and it becomes hurdles[4].
Recent Developments
India has been trying to toughen its cybersecurity stance in recent years. For example:
- The government has placed data localization on key sectors such as healthcare and finance to stop cross-border theft of data[5].
- Projects such as the Cyber Swachhta Kendra try to assist businesses in detecting and removing malware. SMEs, being the most vulnerable to cyber attacks, have the lowest adoption thus far[6].
Data Privacy: The Digital Personal Data Protection Act
The passing of the Digital Personal Data Protection Act (DPDP), 2023 was a giant leap towards India’s transition to data protection of privacy. The DPDP Act was finally realized after three decades of discussion following the trailblazing judgment of the Supreme Court in Justice K.S. Puttaswamy v. Union of India (2017)[7], where it had declared privacy to be a right under Article 21 of the Constitution.
The DPDP Act offers a menu of main provisions:
- Open Consent and Transparency: Organisations shall be required to obtain open and transparent consent of the individuals prior to processing their personal data unless the latter is one of the listed exemptions insofar as public interest or national security is concerned.
- Large Data Fiduciaries: Large entities that deal with large volumes of personal data will have additional compliance requirements such as regular audits and influence evaluations[8].
3.India Board of Data Protection: It will be tasked with investigating data privacy offenses and can impose a fine of up to ₹250 crore per offense.
DPDP Act is in the right direction to put India’s data protection regime on par with international regimes such as the European Union’s General Data Protection Regulation (GDPR)[9].
While the legislative rules attempt to demonstrate an open and transparent regime of data processing, the law has been faulted by other people because there are some exemptions provided to the government authorities, which are disempowering protection against privacy. For instance, government bodies are exempted from seeking approval before personal data is processed where the latter is to be processed for national security or law enforcement.[10]
Implementation Issues:
DPDP Act is not being implemented either:
- No or very few organizations are aware of or able to meet its stringent conditions.
- Uncertainty over standards for cross-border data flows generates confusion among Indian multinational firms.
Cyber Forensic
Cyber forensic can play a great deal of assistance in cybercrime investigation by obtaining, analyzing, and preserving evidence. Indian cyber forensics jurisprudence is infancy level.
- Admissibility of Electronic Evidence
Indian Evidence Act, until 2000, in which provisions of electronic evidence have been incorporated under Section 65B, is the one which prevails over admissibility of electronic evidence in a court of justice[11].
Court intricacies in procedural matters, however, lead to the courts rejecting the same. For instance, Electronic evidence can only be done with a Section 65B(4) certificate to verify the same but one cannot even obtain such a certificate when dealing with third-party websites or sources from abroad[12]. And Constabulary lacks tech savvy to handle electronic evidence and procedural errors are committed which makes it inadmissible.
- Operational Challenges
India does possess some operational difficulties to cyber forensic investigation:
- Skill Shortage: Cyber forensic-trained police officers exist in a percentage point of police officers. Skill shortages are resulting in a lag in investigation and decreasing the rate of conviction[13].
- Old Infrastructure: Forensic labs in most cases do not have the newer devices required to scan cloud or encrypted data properly[14].
- The 2022 AIIMS Delhi ransomware incident revealed such vulnerabilities. Though they received help from CERT-In and others, they took weeks to resume functioning due to a lack of forensic capacities as well as international standards like ISO/IEC 27037[15].
- The most controversial feature of Indian cyber governance is likely to be balancing state surveillance and individual privacy. The IT Act authorizes government agencies under Section 69 to intercept electronic communications beyond the judiciary’s jurisdiction—a provision that has been criticized as enabling bulk surveillance[16].
- The DPDP Act also raises the balancing act to a tougher level by refusing privacy protection to government servants on broad grounds of “public interest.” Such exceptions have been seen to leave the door ajar for abuse and are not consistent with constitutional values expressed in the Puttaswamy judgment.
One of these is through measures of judiciary control such as those of countries like the United States under its Foreign Intelligence Surveillance Act (FISA). They can make open surveillance possible without violating citizens’ rights.
The Way Forward
India itself has been the victim of some of the highest-profile cyberattacks in the past, whose exceptions mentioned were found to have inherent systemic loopholes in its own legal enforcement and cybersecurity mechanisms. The following are three of the most comprehensive case studies whose exposure not only revealed these vulnerabilities but also created legal and policymaking scandals.
- Aadhaar Data Leak (2023)
In 2023, a massive data leak poured Aadhaar details of more than 81 crore Indians onto the dark web. The data leak raised serious doubt regarding adequacy of data security provisions in the Aadhaar Act, 2016, since Aadhaar is an identity scheme traceable to a line of welfare schemes and programs launched by the government[17].
Judicial Reference:
Justice K.S. Puttaswamy (Retd.) & Anr. v. Union of India & Ors., (2019) 1 SCC 1[18]
The judgment reasserted the constitutional legitimacy of Aadhaar but read down some provisions, reaffirming the significance of privacy under Article 21 of the Constitution. It imparted a value to tighter protection of biometric data storage and collection.
Legal Loophole Exposed:
Even after the Supreme Court in Puttaswamy established that Indian citizens enjoy a right over privacy, lapses in implementation, weak encryption and audit methods gave entry to such data breaches. The data breach led to NCIIPC audits, which exposed weak security methods and no end-to-end encryption.
- AIIMS Delhi Ransomware Attack (November 2022)
On 23rd November, 2022, India’s leading medical college AIIMS Delhi was targeted with a high-grade ransomware attack which rendered hospital online services offline. Life-saving facilities like patient records, OPD registration, and lab reports were unavailable. Primary and secondary servers were targeted, and the hospital had to operate offline. National Informatics Centre (NIC) and CERT-In led the response with legal authorities on board but no ransom officially requested.
Legal Background:
No hearing has occurred so far in any court, but the violence breaks a line of orders under the Information Technology Act, 2000 (Section 43 of unauthorized access, Section 66 of hacking computers and Section 66F of cyberterrorism) and the Indian Penal Code (Sections 379 and 420)[19]. It also included moving the Personal Data Protection Bill to bring it into force, which had been pending in turn.
Regulatory Failures Uncovered
The breach revealed some intrinsic shortcomings: insufficient mandated cybersecurity on public health infrastructure, there was no single, standalone law that safeguarded data, there was no integrated digital agency, and breach disclosure rules were weak. In addition to this, any law that had been enacted was ineffective in the form of penalty against institutions without any cybersecurity mechanisms.
- Sun Pharma Cyberattack (March 2023)
Sun Pharmaceutical Industries Ltd. was hit in March 2023 by a gigantic ransomware assault later claimed by the ALPHV (BlackCat) ransomware gang, which stolen about 17 terabytes of confidential information. The data involved included customer information, vendor information, and information on over 1,500 US-based workers. Network partial segregation, business interruption, and calculated revenue loss after the attack ensued. Despite Sun Pharma having alerted stock exchanges to the attack and even having taken remedial steps, the group of cyber attackers targeted the company for underestimating the severity of the attack and setting traps in the system.
Legal Context
Although no court case has directly followed, several legal provisions apply. Under the Information Technology Act, 2000, Sections 43A (failure to protect data), 72A (unauthorized disclosure), 66E (privacy violation), and 66 (hacking) are relevant. Being a listed entity, Sun Pharma is also bound by SEBI’s LODR Regulations to disclose material cybersecurity incidents[20]. The incident also proceeded to bring the attention of the spotlight to the demand for the newly-embraced Digital Personal Data Protection Act, 2023, that places stringent requirements and punishing aspects on data breach.
Judicial and Regulatory Gaps :
The case illustrated a chain of shortcomings: failure to impose sufficient punishment for late or partial noncompliance, absence of compulsory cyber insurance, insufficiency of pre-2023 law in safeguarding personal data, and absence of third-party audit mandate by forensic auditors or public disclosure of noncompliance under the law. These shortcomings bore witness to increased transparency and business cybersecurity process responsibility.
Recommendations:
With the DPDP Act, 2023, everyone is hoping for increased systematic enforcement and more corporate responsibility, but these case studies indicate that more implementation, judicial response reform, and exercising cyber forensic capability are urgently required. India must go the whole hog if its virtual frontier is ever going to be properly secure:
- Global Cybersecurity Policy
One of the cyber legislations must override sectoral guidelines and patch-up legislations under the IT Act. The law must counter new-age threats like AI-based attacks and hold individuals accountable using autonomous surveillance techniques[21]. - Capacity Building
Involvement in innovation must be made in imparting training in cyber forensic and forensic labs of the highest order to law enforcement officers[22].
3.Judicial Oversight
Surveillance can be balanced by judicial review of privacy and national security[23].
- Public-Private Partnerships
Private sector and governments can be compelled to cooperate in an attempt to improve threat information sharing and incident response[24].
Conclusion
India stands at a juncture where its information hunger has to be satisfied by robust legal frameworks that attend to security requirements as much as individual freedom. Beneath all the palliates of such parties like the DPDP Act of recent, gaps enough still remain with regards to fulfilling cybersecurity requirements at such moments and in an appropriate manner affecting law enforcement for cybercrime and violation of data privacy.
By adopting root-level changes which unite global best practices and local solutions, India is able to build a robust digital space, a robust one that is robust enough to beat next years’ trials and tribulations and protect Indian nationals’ basic rights. A digital frontier such as this truly doesn’t necessarily consider the law so much because it’s India’s secret ingredient and recipe in its attempts to become the world’s tech-leading power.
References
[1] Information Technology (Amendment) Act, 2008.
[2] Information Technology Act 2000, s 69.
[3] Ministry of Electronics and Information Technology, ‘Indian Computer Emergency Response Team (CERT-In)’ https://www.cert-in.org.in accessed 17 April 2025.
[4] National Critical Information Infrastructure Protection Centre (NCIIPC) https://nciipc.gov.in accessed 17 April 2025.
[5] Reserve Bank of India, ‘Guidelines on Storage of Payment System Data’ (2018).
[6] Ministry of Electronics and IT, ‘Cyber Swachhta Kendra’ https://www.cyberswachhtakendra.gov.in accessed 17 April 2025.
[7] Justice K.S. Puttaswamy v Union of India (2017) 10 SCC 1.
[8] Digital Personal Data Protection Act 2023, s 10.
[9] DPDP Act 2023, s 18.
[10] DPDP Act 2023, s 17 (Exemptions for Government Agencies).
[11] Indian Evidence Act 1872, s 65B.
[12] Rahul Matthan, ‘Unpacking the Digital Personal Data Protection Act, 2023’ (2023) https://www.livemint.com accessed 17 April 2025.
[13] Ministry of Home Affairs, ‘Police Modernisation Statistics 2023’.
[14] National Crime Records Bureau (NCRB) Report on Cyber Forensics, 2023.
[15] AIIMS ransomware case analysis by CERT-In (2023).
[16] IT Act 2000, s 69; also see Internet Freedom Foundation reports.
[17] Unique Identification Authority of India (UIDAI), ‘Security Audit Report’ (2023).
[18] Justice K.S. Puttaswamy (Retd.) & Anr. v. Union of India & Ors. (2019) 1 SCC 1.
[19] Indian Penal Code 1860, ss 379, 420; IT Act 2000, ss 43, 66, 66F.
[20] Securities and Exchange Board of India (SEBI), LODR Regulations, 2015.
[21] Draft Digital India Act (Expected 2025).
[22] National Cyber Security Strategy Draft 2021 by NSCS.
[23] Foreign Intelligence Surveillance Act (FISA), USA (comparative analysis).
[24] NASSCOM and DSCI, ‘Public-Private Cybersecurity Collaboration Report’ (2022).
