Government Policies and Regulations on Data Centres, Critical IT Infrastructure and Cyber Resilience in India

India regulates its digital data facilities, critical computer resources, and cyber resilience systems through statutory frameworks under the Information Technology Act, dedicated sectoral directives, and national infrastructure policies. These rules establish security controls, operational benchmarks, mandatory incident reporting windows, and technical standards for physical data parks, enterprise networks, and essential public systems.

Institutional and Regulatory Framework

National Data Centre Policy

• The Ministry of Electronics and Information Technology formulated the draft National Data Centre Policy to accelerate domestic data storage capacity.
• The policy accords infrastructure status to data centres, placing them at par with other core infrastructure sectors for long-term institutional credit.
• It provides for the creation of Data Centre Economic Zones with specialized industrial zones, dedicated power corridors, and high-speed fiber connectivity.
• It encourages the adoption of renewable energy, high energy-efficiency ratios, and green building standards across large facilities.
• It designates data centres under the Essential Services Maintenance Act to guarantee uninterrupted round-the-clock operations.

Information Technology Act, 2000 and Statutory Powers

• Section 70 of the IT Act empowers the Central Government to declare any computer system, network, or database as a Protected System.
• Any unauthorized access or attempt to secure access to a declared Protected System is a cognizable offense punishable with imprisonment up to ten years.
• Section 70A mandates the establishment of a specialized national nodal agency to secure designated critical computer networks.
• Section 70B establishes the national nodal body for cyber incident response, threat detection, and emergency containment.

Digital Personal Data Protection Act, 2023

• The Act governs the processing and safeguarding of digital personal data within India and related foreign processing.
• It mandates reasonable security safeguards to prevent personal data breaches, imposing financial penalties up to ₹250 crore per instance of failure.
• It establishes the Data Protection Board of India to inquire into non-compliances, direct remedial actions, and levy financial penalties.
• Significant Data Fiduciaries must appoint a resident Data Protection Officer, undertake periodic Data Protection Impact Assessments, and conduct independent statutory audits.

Protection of Critical Information Infrastructure

National Critical Information Infrastructure Protection Centre

• NCIIPC is a dedicated unit of the National Technical Research Organisation, created under Section 70A of the IT Act.
• Critical Information Infrastructure covers physical or virtual assets whose destruction or incapacitation impacts national security, the economy, public health, or public safety.
• NCIIPC identifies six core critical sectors: Power and Energy, Banking and Finance, Telecommunications, Transport, Strategic Enterprises, and Government.
• It issues guidelines for standard operating procedures, threat vulnerability assessments, and supply chain security auditing for critical sector entities.

Sectoral Computer Emergency Response Teams

• Sectoral CERTs operate under administrative ministries to handle sector-specific incidents in coordination with national agencies.
• Power-CERT handles operational technology and Supervisory Control and Data Acquisition systems in the power grid.
• Fin-CERT operates under the financial sector regulators to coordinate digital banking and payment gateway threat intelligence.
• Telecom-CERT coordinates incident handling across public and private telecommunication service providers.

Cyber Resilience and Operational Directives

CERT-In Cyber Security Directions

• Directions issued by CERT-In under Section 70B(6) of the IT Act mandate all government bodies, commercial entities, and service providers to report specified cyber incidents within six hours of detection.
• Covered entities must synchronize their system clocks with the Network Time Protocol servers of the National Physical Laboratory or NIC.
• Virtual Private Server providers, Cloud Service providers, and VPN services must register and maintain validated customer identification records and IP logs for five years.
• Virtual asset service providers and crypto exchanges must maintain Know Your Customer records and financial transaction logs for five years.

Cyber Swachhta Kendra

• The Botnet Cleaning and Malware Analysis Centre functions under CERT-In to detect and neutralize botnet infections in citizen devices.
• It collaborates with internet service providers and antivirus vendors to notify affected users and supply remediation tools.

Key Agencies and Operational Roles

Facts

• The Information Technology Act, 2000 provides the basic statutory backing for cybersecurity, electronic records, and critical infrastructure protection in India.
• Section 70 of the IT Act prescribes a maximum prison term of ten years for unauthorized access to a declared Protected System.
• NCIIPC functions as part of the National Technical Research Organisation, which operates under the Prime Minister’s Office.
• CERT-In directions mandate the reporting of twenty specific categories of cybersecurity incidents within six hours.
• The National Physical Laboratory and the National Informatics Centre provide the standard national reference time servers for mandatory system clock synchronization.
• The draft National Data Centre Policy extends infrastructure status to the domestic data centre industry.
• The Indian Cybercrime Coordination Centre manages the national reporting portal at cybercrime.gov.in and the 1930 financial fraud assistance helpline.
• Section 69 of the IT Act authorizes designated central and state agencies to intercept, monitor, or decrypt digital information for public order and national security reasons.
• Cloud service providers operating in India must preserve customer identity records and connection logs for a statutory minimum of five years.
• The National Cyber Coordination Centre operates to generate real-time situational awareness of national cyber threats.