India's dual compliance regime is now fully active. A cybersecurity incident can trigger a 6-hour CERT-In reporting obligation and a 72-hour DPDP Act notification requirement at the same time. Most Indian organisations have incident response processes designed for neither. Here is how to handle both correctly.
The Cyber Security and Resilience Bill is expected to receive Royal Assent in late 2026. It introduces a 24-hour early warning requirement, a 72-hour full report obligation and penalties of up to £17 million for serious breaches. Most organisations in scope are not ready for the reporting timeline and the compliance window after Royal Assent will be narrow.
Most UAE organisations subject to NESA compliance requirements understand that they need to comply. Far fewer understand that ISO 27001 certification does not get them there, that the gap between the two frameworks is where the real regulatory risk sits and that the consequences of non-compliance now include losing government contracts entirely.
The attack window has officially collapsed. CERT-In’s new blueprint urges Indian organizations to patch critical vulnerabilities within 12 hours of detection. Driven by AI-assisted threat exploitation, this radical shift demands that enterprise security operations match machine-speed attacks or face severe compliance risks.