India Cybersecurity Laws 2026: DPDP Act, CERT-In 6-Hour Rule, Maya OS & Deepfake Threats

The digital landscape in India has undergone a massive transformation. As we move through 2026, the era of relaxed data management is officially over. From the Digital Personal Data Protection Act, 2023 to the government-backed Maya OS, India is strengthening its digital security framework.

Whether you are a business owner, IT professional, or everyday internet user, understanding these changes is critical to staying compliant and secure.

Infographic explaining India cybersecurity rules 2026 including Digital Personal Data Protection Act, CERT-In 6-hour cyber incident reporting, Maya OS security and deepfake threats.



1. The “Delete” Button is Your Best Legal Friend

Under the Digital Personal Data Protection Act, 2023, data storage is now strictly regulated. Organizations must delete personal data once its purpose has been fulfilled.

Key Points

Data Minimization
Companies are legally required to collect and store only the data that is necessary.

The “Orphan Data” Risk
Old files containing personal information can create serious legal risks.

Example:
A forgotten file like
Team_Contact_List.xlsx containing employee addresses from years ago can become a major liability.

The Stakes
If such data leaks, penalties can reach up to
₹250 Crore.


2. The 6-Hour Cyber Incident Reporting Rule

India’s cybersecurity regulator Indian Computer Emergency Response Team (CERT-In) introduced a strict rule requiring organizations to report cyber incidents within 6 hours of detection.

Why This Matters

The Friday Trap
If suspicious files or ransomware activity appear at 4 PM on a Friday, reporting cannot wait until Monday.

Legal Consequences
The moment a cyber incident is detected, the
6-hour reporting clock starts. Failure to report can result in legal penalties.


3. The Rise of Deepfakes and Synthetically Generated Information

Artificial intelligence has created a new category of cyber threats known as Synthetically Generated Information (SGI).

These AI systems can mimic voices, faces, and even video calls with alarming accuracy.

Common Example

A scammer might impersonate your CEO or manager in a video call or WhatsApp message asking for sensitive credentials or financial transfers.

Best Protection Strategy

Always verify suspicious requests through a secondary communication channel such as:

·         Official office phone

·         Verified email

·         Direct in-person confirmation

Never share credentials based solely on a video call or urgent message.


4. Maya OS: India’s Secure Operating System

India is gradually shifting critical infrastructure to Maya OS, an indigenous operating system designed for national cybersecurity.

The Chakravyuh Security Sandbox

A major feature of Maya OS is the Chakravyuh sandbox environment.

How It Works

If a user inserts a compromised USB drive or downloads malicious software, the malware is isolated inside the sandbox.

This prevents it from accessing:

·         Core system files

·         Sensitive government data

·         Critical infrastructure systems

This secure-by-design approach strengthens India's digital defense.


5. The Chakshu Portal: Fighting Online Scams

India has launched the Chakshu Portal under the Sanchar Saathi Initiative to help citizens report cyber fraud easily.

Example Scam

You might receive a message saying:

“Your electricity connection will be disconnected due to KYC failure.”

These scams often include a phone number asking you to call immediately.

What You Should Do

1.     Do not call the number

2.     Take a screenshot of the message

3.     Upload it to the Chakshu portal

Authorities can quickly block the fraudster’s IMEI number nationwide.


Conclusion: The “3-Second Rule” for Digital Safety in 2026

Cybersecurity is no longer only about software tools—it’s about smart digital habits.

Before interacting with anything online, take three seconds and follow these rules:

1️. Don’t Click

Hover over links for a few seconds to see the real destination.

2. Don’t Share

Ask yourself why an application needs access to your contacts, camera, or location.

3️. Report Immediately

If something feels suspicious, report it to your IT team or authorities before the 6-hour CERT-In reporting window expires.


Stay vigilant
Stay compliant
Stay secure in India’s evolving digital ecosystem.


Post a Comment

0 Comments