DPDPA, CERT-In, RBI, NCIIPC & DAP 2026
Compliance built into your India cloud architecture — continuously enforced, not periodically assessed.
Free Consultation
DPDPA 2023
Data flow mapping, consent management, and IaC-based controls for India's personal data protection law.
CERT-In Directive
6-hour incident reporting, 180-day log retention in India, NTP synchronization — enforced by infrastructure.
India Sovereign Cloud
Data localization enforced by Azure Policy (Central India) and AWS Config (Mumbai / Hyderabad).
6 Hours to Report. 180 Days in India.
Automated incident detection and log retention enforcement. Meet the CERT-In directive before it becomes a criminal liability.
Free Consultation
DPDPA 2023
Data flow mapping, consent management, and IaC-based controls for India's personal data protection law.
CERT-In Directive
6-hour incident reporting, 180-day log retention in India, NTP synchronization — enforced by infrastructure.
India Sovereign Cloud
Data localization enforced by Azure Policy (Central India) and AWS Config (Mumbai / Hyderabad).
India Compliance Deadline — Is Your CERT-In Log Retention Enforced in India?
New from VinfraSec
Ephor runs your CERT-In and DPDP clocks. Your people sign off.
Compliance operations for Indian regulated organisations. AI agents check your AWS configuration, start the CERT-In 6-hour and DPDP breach clocks the moment an incident is logged, and draft every report. Only your named approver approves, and a person files. Hosted and processed in India.
- 6 hours
- to report a cyber incident to CERT-In. Ephor drafts it; your team files it.
- 72 hours
- for the detailed DPDP breach report to the Data Protection Board.
- 19 checks
- in a read-only AWS readiness scan, each mapped to a CERT-In or DPDP clause.
Architecture-Led Compliance for India's Regulated Industries
VinfraSec implements DPDPA 2023, CERT-In, RBI MD on IT, NCIIPC, and DAP 2026 requirements as continuously enforced infrastructure controls — using Terraform, Azure Policy (Central India region), and AWS Config (Mumbai/Hyderabad) to make compliance a stable property of your environment, not a state you restore before each audit.
- DPDPA 2023 compliance
- CERT-In 6-hour incident reporting
- 180-day log retention in India
- RBI MD on IT for banks & NBFCs
- NCIIPC / CII protection
- DAP 2026 defense compliance
India Regulatory Compliance Services
Architecture-led compliance for India's most critical regulatory frameworks — DPDPA 2023, CERT-In, RBI MD on IT, NCIIPC, and DAP 2026. We implement controls as continuously enforced infrastructure, not documentation or checklists.
DPDPA 2023
Data flow mapping, consent management, DPO advisory, and IaC-based security controls for India's personal data protection law.
Learn More
CERT-In Compliance
6-hour incident reporting, 180-day log retention in India, NTP synchronization with NIC servers — enforced by IaC.
Learn More
RBI MD on IT
Cybersecurity framework for banks and NBFCs. IS audit, BFSI security controls. IaC-based implementation.
Learn More
NCIIPC / CII
ISMS implementation, security audits, and incident reporting for critical information infrastructure operators.
Learn More
DAP 2026 Defense
Cybersecurity for India's defense industrial base — DRDO vendors, OFB suppliers, and MoD contractors.
Learn More
ISACA Training
CISA, CISM, CRISC certification training for Indian GRC and compliance professionals.
Learn More
Why Choose VinfraSec
India's compliance frameworks require continuous enforcement — not annual audits. VinfraSec builds the technical controls that work at 3am during a CERT-In incident, not just during your next audit cycle.
0+
India Compliance Frameworks0
Hours — CERT-In Reporting Window0
Days Log Retention Required0+
Years Infrastructure ExperienceSovereign Compliance for India's Regulated Industries
VinfraSec Services India Ltd is the India practice of Virtual Infrastructure Services LLC (USA). We specialize in architecture-led compliance engineering for DPDPA 2023, CERT-In, RBI Master Directions on IT, NCIIPC, and DAP 2026. Based in Gachibowli, Hyderabad, serving regulated industries across India — banking, critical infrastructure, defense, and data-processing organizations.
Free Consultation
Five Frameworks. One Architecture.
India's regulated industries must comply with multiple overlapping frameworks — each with its own technical, operational, and reporting requirements. VinfraSec implements all five as a unified, architecture-led compliance program.
DPDPA 2023
CERT-In Directive
RBI MD on IT
Common questions
Answers checked against the rules in force in October 2026. Something else? Ask the assistant.
What is the DPDP Act 2023?
The Digital Personal Data Protection Act, 2023 is India's data protection law. It covers digital personal data processed in India, and processing outside India that's connected with offering goods or services to people in India. An organisation that decides why and how data is processed is a Data Fiduciary. It must give notice and get valid consent (or rely on a legitimate use), protect the data with reasonable security safeguards, report breaches, honour Data Principals' rights, and erase data once the purpose is served.
When do the DPDP Act's obligations apply?
The DPDP Rules, 2025 were notified on 13 November 2025 and commence in phases. The Data Protection Board provisions applied straight away. Consent Manager registration opens on 13 November 2026. The core duties apply from 13 May 2027: notice, consent, security safeguards, breach intimation, Data Principal rights, children's data and Significant Data Fiduciary obligations.
What does CERT-In require of organisations in India?
CERT-In's Directions of 28 April 2022, issued under Section 70B(6) of the IT Act, apply to service providers, intermediaries, data centres, body corporates and government organisations. You must report the listed cyber incidents to CERT-In within 6 hours of noticing them, keep ICT system logs for a rolling 180 days within Indian jurisdiction, sync system clocks to the NTP servers of NIC or NPL (or servers traceable to them), and name a Point of Contact for CERT-In.
Which RBI directions apply to banks and NBFCs?
On 31 July 2026 RBI issued entity-wise Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions for commercial, small finance and payments banks, urban co-operative banks, NBFCs (by regulatory layer and asset size) and all-India financial institutions. They consolidate earlier IT governance and cybersecurity requirements, took effect immediately, and require cyber incidents to be reported to RBI on the DAKSH platform within 6 hours of detection.
What is Critical Information Infrastructure under NCIIPC?
Section 70 of the IT Act defines Critical Information Infrastructure as a computer resource whose incapacitation or destruction would have a debilitating impact on national security, the economy, public health or safety. NCIIPC, the national nodal agency under Section 70A, treats power and energy, banking and financial services, telecom, transport, government, and strategic and public enterprises as critical sectors.
What is DAP 2026?
DAP 2026 is the Ministry of Defence's Defence Acquisition Procedure 2026. It was released as a draft in February 2026 to replace DAP 2020, and as of late September 2026 it had not been finalised, so capital acquisitions still run under DAP 2020.
What is Ephor?
Ephor is VinfraSec's compliance operations platform for Indian regulated organisations. AI agents do the continuous work, such as checking your cloud configuration, running incident clocks and drafting reports, and named people at your organisation approve anything that carries liability. It runs only in AWS Mumbai, with disaster recovery in Hyderabad. Today it covers the CERT-In Directions and the DPDP Act and Rules.
Does VinfraSec certify organisations?
VinfraSec does readiness, implementation and internal-audit-style assessments. We don't issue certifications, audit opinions or third-party attestations. The DPDP Act has no certification scheme, so nobody can sell you a "DPDP certificate". What we give you is the controls and evidence that stand up when a regulator, customer or independent auditor asks.