India: Entry into force with grace period of CERT-In's Information Security Practices Directive including cybersecurity measures

On 27 June 2022, the directive by the Indian Computer Emergency Response Team (CERT-In) "relating to information security practices, procedure, prevention, response and reporting of cyber incidents" enters into force. The directive introduces obligations regarding the notification and mitigation of data breaches, data storage and user identification. Regarding data breaches, all service providers, intermediaries and data centres must report cyber incidents within 6 hours of noticing or being notified of a breach, and must implement protective and preventive actions mandated by CERT-In.