Custody does not have to travel

Section 8(5) of the Digital Personal Data Protection Act, 2023 requires a Data Fiduciary to protect personal data in its possession or under its control, including processing carried out on its behalf by a Data Processor, by taking reasonable security safeguards. Section 2 defines "person" to include the State, so a department can itself be a Data Fiduciary. The Schedule provides a penalty that may extend to two hundred and fifty crore rupees for breach of that obligation, as determined by the Board.

Section 17(2)(a) disapplies the Act to processing by such instrumentality of the State as the Central Government may notify, on the grounds listed there. That is a notified carve-out rather than a blanket exemption for government bodies, and the Section 17(1) exemptions expressly preserve sub-sections (1) and (5) of Section 8. Applicability should be assessed department by department.

The CERT-In Directions of 28 April 2022 name Government organisations alongside service providers, intermediaries, data centres, and body corporate, and require the cyber incidents listed in Annexure I to be reported within six hours of noticing them or being brought to notice about them.

The E-mail Policy of Government of India provides that only the e-mail services provided by NIC shall be used for official communications by all organizations except those exempted under its clause 14, and that services provided by other providers shall not be used for any official communication. It applies to employees of the Government of India and to State and Union Territory governments that use or adopt it.

The Guidelines for Indian Government Websites require a security audit clearance certificate from NIC, STQC, an STQC-empanelled laboratory, or a CERT-In empanelled laboratory before a government website, web application, portal, or mobile app is hosted in production, and require a Security Policy, Privacy Policy, and Contingency Management Plan approved by the department.

Rule 160 of the General Financial Rules, 2017 makes it mandatory for Ministries and Departments to receive all bids through e-procurement portals in respect of all procurements, and Rule 159 makes e-publishing of tender enquiries, corrigenda, and bid awards mandatory for the Central Government, its attached and subordinate offices, and autonomous and statutory bodies, with narrow national-security exemptions.

Rule 149 of the General Financial Rules, 2017 records that the Government of India has established the Government e-Marketplace for common use goods and services, and that procurement by Ministries or Departments will be mandatory for goods or services available on GeM. The rules should be read with the current amendments for the entity concerned.

The Manual for Procurement of Goods, 2024, published by the Department of Expenditure and listed by the Central Vigilance Commission, states that the technical evaluation report is a confidential document whose contents shall not be disclosed, that all records relating to the evaluation shall be retained until completion of the project and its audit, and that the contractor shall maintain confidentiality and secrecy of the procuring entity's information.

The Department of Public Enterprises Guidelines on Corporate Governance for Central Public Sector Enterprises, continued on a mandatory basis, require board members and senior management to respect the confidentiality of information relating to the affairs of the company and to maintain the confidentiality of unpublished information about its business and affairs, and require the board to integrate risk management into normal business practice. These are governance duties rather than technical security standards.

The Comptroller and Auditor General's Report No. 15 of 2022 on Union Government compliance audit records that unauthorised use of user IDs and passwords by other postal staff or outsiders led to fraudulent withdrawal in four Circles, and recommends that an effective password policy be put in practice as part of an IT security policy to prevent unauthorised usage or login by staff.

By notification S.O. 18(E) of 16 January 2014, made under sub-section (1) of Section 70A of the Information Technology Act, 2000, the Central Government designated the National Critical Information Infrastructure Protection Centre as the national nodal agency in respect of Critical Information Infrastructure Protection.

The Information Technology (Information Security Practices and Procedures for Protected System) Rules, 2018 apply to organisations whose systems are notified under Section 70. They require the Chief Information Security Officer to share information security audit reports, post-audit compliance reports, and IT security service level agreements with NCIIPC, and to establish a process for sharing logs of the protected system.

The National Cyber Security Policy, 2013 states an objective to enable protection of information while in process, handling, storage, and transit, so as to safeguard privacy of citizen's data and reduce economic losses due to cyber crime or data theft. It is a policy statement, not a directly enforceable rule.

The CERT-In Directions of 28 April 2022 also require Government organisations to enable logs of all their ICT systems and maintain them securely for a rolling period of 180 days within the Indian jurisdiction, and to synchronise system clocks with the NTP servers of NIC or NPL, or servers traceable to them.

MeitY has been empanelling cloud services of Cloud Service Providers since 2015 across public cloud, virtual private cloud, and government community cloud deployment models. The empanelment document requires that cloud services be hosted within India, that data residency be limited to the boundaries of India, and that no data, whether as backups or otherwise, be transmitted outside the boundaries and legal jurisdiction of India.