The Indian cyber regulation register

Twenty instruments govern cyber security and personal data for Indian regulated entities, issued by six different authorities over four years. There is no official consolidated list of them — each regulator publishes its own, in its own format, and most secondary summaries are assembled from each other rather than from the notifications.

This is the list, kept current. Every entry carries the instrument’s own reference number, its issue date, whether it is actually in force, any deadline it sets, and the date somebody last opened the regulator’s own page to check. It is published as a page to read and as a dataset to use.

The register

Download the dataset

The same twenty records, generated from the source this page renders from, so the file and the table cannot disagree. Both are free to use under CC BY 4.0 — use them, and credit bitscore.in.

• india-cyber-regulations.json — the register, one object per instrument, with deadlines nested.
• india-cyber-regulations.csv — the same rows flattened for a spreadsheet, deadlines as kind:date:label.
• schema.json — JSON Schema for a record, so you can validate against it rather than guess at the shape.

Both files are served with permissive cross-origin headers, so you can fetch them straight from a browser or a notebook without proxying them first.

How this is maintained

Every entry was read from the issuing regulator’s own notification, not from secondary reporting. Where an instrument cannot be confirmed on a government source it does not go in. The verified date on each record is the day somebody last opened that source and re-read the reference, the date and the link — not the day this file was regenerated, which is a much easier thing to claim and worth nothing.

The oldest verification in the current set is 18 August 2026. Links are re-checked when the register is regenerated, and a change to any record is visible in the published dataset’s own history.

Get told when an instrument changes

Indian cyber regulation moved four times in the eighteen months to August 2026, and the changes that matter are rarely announced as changes — a categorisation threshold is revised inside a clarification circular, or a deadline moves in an extension that carves out three entity types. Leave your details and we will tell you when a record in this register moves.

Every instrument links to the issuing regulator’s own notification. Where a regulator serves its text through a PDF viewer or a query-string URL, the link goes to the document rather than to a landing page that may not render it.