Let suppliers use the design without surrendering the design

Section 8(5) of the Digital Personal Data Protection Act, 2023 requires a Data Fiduciary to protect personal data in its possession or under its control, including processing carried out on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach. The Schedule provides a penalty that may extend to two hundred and fifty crore rupees for breach of that obligation, as determined by the Board. For a manufacturer this reaches employee, dealer, customer, and warranty records rather than the design itself.

The CERT-In Directions of 28 April 2022 require service providers, intermediaries, data centres, body corporate, and Government organisations to report the cyber incidents listed in Annexure I within six hours of noticing them or being brought to notice about them. Annexure I expressly includes attacks on critical infrastructure, SCADA and operational technology systems, data breach, and data leak.

Section 43A of the Information Technology Act, 2000 provides for damages by way of compensation where a body corporate handling sensitive personal data is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain. Section 72A punishes disclosure of information in breach of a lawful contract with imprisonment that may extend to three years, a fine that may extend to five lakh rupees, or both.

India has no standalone trade secrets statute. The National Intellectual Property Rights Policy, 2016 lists the protection of trade secrets among the areas identified for study and research for future policy development, which is consistent with protection today resting on contract and equitable remedies rather than a registration right. That places practical weight on what the recipient of a drawing can technically do with it.

Where a computer resource is declared a protected system by notification under Section 70 of the Information Technology Act, 2000, the Information Technology (Information Security Practices and Procedures for Protected System) Rules, 2018 apply. They require the Chief Information Security Officer to share information security audit reports, post-audit compliance reports, and IT security service level agreements with NCIIPC, and to establish a process for sharing logs of the protected system. Applicability depends on the specific notification.

DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, requires a contractor within its scope to implement NIST SP 800-171 and to rapidly report cyber incidents, defined in the clause as within 72 hours of discovery. Indian suppliers encounter it through flow-down in United States defense and aerospace supply chains rather than directly.

NIST Special Publication 800-171, Revision 3, published in May 2024, provides recommended security requirements for protecting the confidentiality of Controlled Unclassified Information when it is resident in nonfederal systems and organizations. It is the technical baseline the DFARS clause points to.

Where an item is a defense article, 22 CFR 120.33 defines technical data to include information required for the design, development, production, manufacture, assembly, operation, repair, testing, maintenance, or modification of defense articles, and states that this includes information in the form of blueprints, drawings, photographs, plans, instructions, or documentation. This applies only to specific controlled exports and should be assessed case by case.

Article 32 of Regulation (EU) 2016/679 requires the controller and processor to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. Article 83(4) places infringements of Article 32 in the tier of administrative fines up to 10 million euro, or up to 2% of total worldwide annual turnover of the preceding financial year, whichever is higher. This reaches an Indian manufacturer through European customer and employee data.

Regulation (EU) 2024/2847 sets horizontal cybersecurity requirements for products with digital elements placed on the Union market. It entered into force in December 2024 and applies from 11 December 2027, with Chapter IV applying from 11 June 2026 and Article 14 from 11 September 2026. Manufacturers exporting connected products into the Union should check the staged dates against their own portfolio.

The IEC 62443 series addresses security for industrial automation and control systems. IEC/TS 62443-1-1 defines the terminology, concepts, and models for IACS security and establishes the basis for the remaining standards in the series. It is the reference customers and auditors most often name for the operational technology side of a plant.

ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection, Information security management systems, Requirements, is the third edition of the ISMS requirements standard. Certification against it is a common contractual expectation from OEM customers, though it is a management-system standard rather than a technical control list.

TISAX, operated by the ENX Association, is described as an assessment mechanism for assessing the information security of companies and an exchange mechanism for sharing those assessment results among participants. ENX was founded by automotive manufacturers, national automotive associations, and automotive suppliers, which is why Indian tier suppliers to European OEMs are routinely asked for a TISAX label.

The SEBI (Listing Obligations and Disclosure Requirements) (Second Amendment) Regulations, 2023 inserted Regulation 27(2)(ba), under which details of cyber security incidents or breaches or loss of data or documents are to be disclosed along with the quarterly corporate governance report, as may be specified. Listed manufacturers have separately made material-event intimations under Regulation 30 about such incidents.