India's compliance clock is ticking and most enterprises haven't started
ADVERTISEMENT
India crossed 100 crore internet connections not too long ago. UPI processed over 2,100 crore transactions worth ₹27 lakh crore in a single month. The rise of financial technology (fintech) has reshaped how Indians transact, invest, and access credit, spawning one of the world's most dynamic digital finance ecosystems. The Software-as-a-Service (SaaS) boom and the rapid digitisation of key sectors, from banking and financial services to manufacturing, have made India one of the most consequential digital economies in the world.
Statistics on cybersecurity incidents from 2025 do not make comfortable reading. Over 50 lakh web-based attacks hit Indian businesses. Spyware incidents surged 72% year on year. Backdoor intrusion attempts crossed 7 lakh. India's Computer Emergency Response Team (CERT-In) handled nearly 29.44 lakh cyber incidents in the same period. These are not abstract statistics. Each one represents a real organisation, a real network, and a real exposure that could have cascading business consequences.
83% is not a statistic. It is a warning
But more alarming than the attack volumes is that 83% of Indian organisations have not yet begun comprehensive implementation of the Digital Personal Data Protection Act.
The DPDP Act and its accompanying Rules are not on the horizon. They are here. Key provisions are expected to come into full effect by May 2027, and that window is shorter than most leadership teams appreciate. Breach reporting obligations, consent frameworks, encryption mandates, and periodic security audits for entities classified as Significant Data Fiduciaries are not aspirational guidelines. They carry direct financial and reputational liability.
The organisations that treat this deadline as a business transformation trigger will come out structurally stronger. The ones treating it as a compliance checkbox are building a risk position that will be very difficult to defend when enforcement arrives.
The threat has changed. The attacker has too
What makes the current environment particularly difficult is the shift in attacker behaviour. Volume matters, but it is the nature of these attacks that deserves boardroom attention.
Spyware does not announce itself. Backdoors are built specifically for the long game. By the time a compromise surfaces, sensitive data such as client records, financial flows, strategic decisions, authentication credentials, may already be long gone. Threat intelligence data from 2025 shows that spyware and backdoor attacks are not opportunistic. They are targeted, patient, and increasingly sophisticated. Artificial intelligence (AI) has amplified this further, enabling attackers to run personalised phishing campaigns at scale and adapt in real time to bypass conventional perimeter defences.
CERT-In's six-hour incident reporting mandate under its 2022 Directions is already in force. An organisation that discovers a breach today has six hours to report it. That is an operational reality most enterprises are not yet structured to meet.
Compliance and security are the same conversation
India's security operations centre (SOC) landscape is catching up, with 54% of organisations planning to establish one in the next 12 months. That is a positive signal. But infrastructure without intelligence is just infrastructure. The question is not whether you have a security operations centre. The question is whether it can see what is happening inside your environment fast enough to matter.
The regulatory pressure and the threat environment are not parallel tracks. They converge at the point of a breach. A spyware incident that results in unauthorised data exfiltration does not just create an operational crisis. Under the DPDP framework, it simultaneously triggers breach reporting obligations, consent violation liability, and audit scrutiny. The compliance failure and the security failure are the same event, with the same consequences.
The window to act is now
India's digital ambitions are real, and they are worth protecting. The country is building a digital public infrastructure that the world is watching and, in many cases, beginning to replicate. The credibility of that infrastructure rests on how seriously Indian enterprises treat the responsibility that comes with handling data at this scale.
The organisations that build their security posture around intelligence, integration, and genuine operational readiness rather than periodic audits will be the ones that lead. The ones that wait for enforcement to force their hand will find that the cost of delay is far greater than the cost of preparation.
The clock is not just ticking toward a regulatory deadline. It is ticking toward the next incident. In India's current threat landscape, those two things are closer together than most organisations would like to believe.
(The author is Director of Government Affairs and Public Policy, Asia-Pacific and Japan at Kaspersky. Views are personal.)