From Incident to Liability: A Compliance Officer’s Guide to India’s New Cyber Regime for Banks, NBFCs and PSOs

Eighty-seven minutes is not long enough for most organisations to notice anything at all. On the morning of 19^th October it was long enough for someone to take Rs. 3.3 crore out of a Hyderabad non-banking financial company, moving through the company’s own application programming interface in 183 transfers spread across 52 accounts, none of them large enough to look like anything worth stopping. The company found the breach the same day, which is better than many manage and was at the Telangana Cyber Security Bureau the following morning, by which time the money had been broken up and walked through the chain and only about Rs. 40 lakh could still be reached and frozen.

Three days before that the country’s largest bank had learned something uncomfortable about itself from other people. State Bank of India was told by its own threat intelligence vendor and separately by CERT-In, that records said to belong to its customers were circulating on the dark web and it has since confirmed 3,897 of them as genuine personal data, running to names, mobile numbers, dates of birth, addresses, branch identifiers and loan details. On 21st October it told the stock exchanges that the incident had no material effect on its business, which was true enough as a statement about the business, though a filing written for investors is not a filing written for the 3,897 people whose loan details are now in other hands and on that it said nothing.

The two incidents are not the same story and are worth keeping apart. One is money leaving and the other data leaking and they sit under different parts of the rulebook. What they share is that the controls meant to catch the thing did not and that the obligations which followed began running in hours rather than weeks.

Where the Court has been heading

That second point is where the ground has quietly moved. For some years the question after an incident was whether the institution had reported it properly and the question now, increasingly, is who pays.

The Supreme Court has been hearing a suo motu matter on digital arrest frauds since October 2025 and read in sequence the orders show the focus travelling from awareness, to investigation, to money.[1] By its order of 4^th August 2026 it was giving the Reserve Bank four weeks to adopt and circulate a standard operating procedure on temporary debit holds for mule and cyber-fraud accounts, directing it to implement a lagged credit mechanism and to give effect to the customer protection framework for electronic banking transactions and asking the inter-departmental committee to build a shared liability and victim compensation framework. At the hearing on 29^th October the bench went a good deal further, indicating that it favoured a form of strict liability under which a bank whose own failure of due diligence had let the fraud through would indemnify the victim for not less than the amount lost. The Chief Justice put the reasoning without much decoration, that unless there is a penal direction to banks they will not mend their ways.

What already binds an institution

There is a habit in Indian privacy conversations of treating the Digital Personal Data Protection Act as the thing to prepare for, with everything else as scenery and for a regulated financial entity this has it almost exactly backwards, because every instrument that actually governed those two October incidents was in force on the day they happened.

The longest-standing of these is also the easiest to overlook. The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, made under section 43A of the Information Technology Act, still govern how a body corporate handles sensitive personal data, which for a lender takes in passwords, financial information and much of what otherwise sits in a customer file.[2] Rule 8 is where the duty takes a shape one can be audited against, treating an organisation as having reasonable security practices where it maintains a comprehensive documented information security programme and naming IS/ISO/IEC 27001 in the rule itself as a standard that qualifies. Adopt it, have it certified or audited at least once a year by an independent auditor approved by the Central Government and compliance is deemed. The date this ends is worth marking, because section 43A is omitted when section 44(2) of the DPDP Act commences on 13^th May 2027 and the Rules fall away with their parent provision on precisely the day DPDP’s own safeguards obligation begins.

Then there are CERT-In’s 2022 directions, which allow six hours from noticing a reportable incident to telling CERT-In about it.[3] The number repays a little thought, because those are not six hours in which to establish what happened, or to form a view on how bad it looks, or to get the general counsel onto a call; the period runs from the moment of noticing. Since the directions reach service providers, intermediaries, data centres and body corporates generally they caught the Hyderabad company and the bank alike, with penal consequences under the Information Technology Act for those who ignore them.

Sitting over that is the Reserve Bank’s Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions of 31^st July 2026, effective on issue and notified entity by entity so that banks, non-banking financial companies, payments banks and co-operative banks each work from their own version.[4] What these are really concerned with is governance rather than technology, which is to say a board-approved information security policy, accountability that climbs past the chief information security officer and comes to rest at the board, technology risk identified systematically rather than by instinct and defined expectations on access control, logging, third-party arrangements and incident response. Incidents go to the Reserve Bank within six hours of detection through the DAKSH platform, with CERT-In notified as well and for a non-banking financial company the depth of all this scales with its regulatory layer and asset size. Non-bank payment system operators work under a parallel instrument from July 2024, phased by size, covering large operators since April 2025 and medium ones since April 2026.[5]

Then comes the change that alters the arithmetic. On 24^th June 2026 the Reserve Bank amended seven sets of Responsible Business Conduct directions to review the framework for limiting customer liability in digital transactions.[6] From 1^st January 2027 the protection reaches beyond unauthorised transactions into a wider class of fraudulent electronic banking transactions, complaints must be resolved within forty-five days at home and sixty across borders and a disputed card transaction attracts a provisional reversal within five days. The clause worth reading twice is the one on proof, because the burden of establishing customer negligence now rests on the bank and a customer who reports in time, where the loss followed a third-party breach or the institution’s own deficiency, carries nothing. Set that beside what the Court has been saying since August and the pattern is not subtle.

And the one still waiting

The DPDP Rules were notified on 13^th November 2025 but did not all commence together and the duties that matter most after an incident, keeping reasonable security safeguards and reporting a breach, fall in the eighteen-month tranche and take effect on 13^th May 2027.[7] Until then nothing in the statute requires an institution to tell an affected individual that their data has gone, which is precisely the space the SBI filing occupied. From that date a Data Fiduciary must intimate the Data Protection Board without delay, report in full within seventy-two hours and tell each affected person, with penalties under the Schedule extending to Rs. 250 crore for a safeguards failure and Rs. 200 crore for a notification failure.

Where this leaves a board

The instinct is to treat May 2027 as the deadline and plan backwards from it and October is the corrective, because neither incident turned on the DPDP Act at all. What governed both was CERT-In’s six hours and the Reserve Bank’s six hours and what arrives in January is a framework that asks the institution to prove its case rather than the customer to prove hers.

None of the work this implies is clever. It means knowing which systems and interfaces exist, including the ones nobody has looked at since the person who built them moved on, knowing who is authorised to decide within six hours and quite possibly at an inconvenient hour that an event is reportable and having walked through that decision once on a quiet afternoon before the day it is real. The dull controls are the ones that hold. What has changed is not the difficulty of the work but who answers for it and the answer now runs to the board.

[1] In Re: Victims of Digital Arrest Related to Forged Documents, Suo Motu Writ Petition (Criminal) No. 3 of 2025 (Supreme Court of India). Order dated 4^th August 2026: https://api.sci.gov.in/supremecourt/2025/59769/59769_2025_1_30_72575_Order_04-Aug-2026.pdf. Earlier orders in the same matter, including those dated 1^st December 2025, 16^th December 2025 and 9th February 2026, are available through the Supreme Court record of Diary No. 59769 of 2025. The observations of 29^th October 2026 on strict liability and indemnification are taken from contemporaneous reporting of the hearing before the bench of Chief Justice Surya Kant, Bagchi J and Mohana J; the signed order of that date had not been published at the time of writing and should be substituted once available.

[2] Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, notified vide G.S.R. 313(E) dated 11^th April 2011 under section 43A of the Information Technology Act, 2000. Rule 8(2) names IS/ISO/IEC 27001 as “one such standard referred to in sub-rule (1)”. Rule 8(4) deems compliance where that standard or an approved industry code has been “certified or audited on a regular basis by entities through independent auditor, duly approved by the Central Government”, the audit to be carried out at least once a year or on significant upgradation of process or computer resource. Section 43A, and the rule-making power under section 87(2)(ob), are omitted on the commencement of section 44(2) of the Digital Personal Data Protection Act, 2023 on 13^th May 2027. Text: https://www.wipo.int/wipolex/edocs/lexdocs/laws/en/in/in098en.pdf.

[3] Directions under sub-section (6) of section 70B of the Information Technology Act, 2000 relating to information security practices, procedure, prevention, response and reporting of cyber incidents for Safe & Trusted Internet, No. 20(3)/2022-CERT-In, dated 28^th April 2022, in force sixty days from issue. The reporting direction requires affected entities to “mandatorily report cyber incidents as mentioned in Annexure I to CERT-In within six hours of noticing such incidents or being brought to notice about such incidents.” Penal consequences arise under section 70B(7). Official text: https://www.cert-in.org.in/Directions70B.jsp.

[4] Reserve Bank of India (Commercial Banks – Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026, RBI/DoS/2026-27/410, DoS.CO.CSITEG.4/31.01.015/2026-27, dated 31^st July 2026: https://rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=13643. The corresponding instrument for non-banking financial companies is RBI/DoS/2026-27/461, DoS.CO.CSITEG.55/31.01.015/2026-27 of the same date: https://rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=13592. Under the latter, housing finance companies report cyber incidents to the National Housing Bank rather than to the Reserve Bank.

[5] Master Directions on Cyber Resilience and Digital Payment Security Controls for non-bank Payment System Operators, RBI/DPSS/2024-25/123, CO.DPSS.OVRST.No.S447/06-26-002/2024-25, dated 30^th July 2024, applicable to large non-bank PSOs from 1^st April 2025, medium from 1^st April 2026 and small from 1^st April 2028: https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=12715.

[6] Amendment Directions on ‘Review of Framework of Limiting Customer Liability in Digital Transactions’, issued 24^th June 2026, Reserve Bank of India Press Release 2026-2027/533, amending the Responsible Business Conduct directions for commercial banks, small finance banks, payments banks, local area banks, regional rural banks, urban co-operative banks and rural co-operative banks, and applicable to transactions made on or after 1^st January 2027: https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=63011.

[7] Digital Personal Data Protection Act, 2023 (Act 22 of 2023), sections 8(5) and 8(6) and Entries 1 and 2 of the Schedule: https://www.indiacode.nic.in/bitstream/123456789/22037/2/a2023-22.pdf. Section 8(6) requires that “in the event of a personal data breach, the Data Fiduciary shall give the Board and each affected Data Principal, intimation of such breach in such form and manner as may be prescribed.” The Digital Personal Data Protection Rules, 2025 were notified vide G.S.R. 846(E) dated 13th November 2025: https://egazette.gov.in/WriteReadData/2025/267650.pdf. Rule 1(4) provides that “Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication of this Gazette,” bringing Rule 6 (reasonable security safeguards) and Rule 7 (intimation of personal data breach) into force on 13th May 2027.

Author: Dwaipayan Das, Bitasta Ganguly

Co-Author: Amiya Mukherjee

This content is intended for informational purposes only and does not constitute a legal opinion. Readers are encouraged to seek legal counsel prior to acting upon any of the information provided herein. Despite our efforts to maintain accuracy, we do not make representations, warranties or undertakings regarding the quality, completeness or reliability of the content.  This content, including the design, text, graphics, their selection and arrangement, is Copyright 2026, Lexplosion Solutions Private Limited or its licensors. ALL RIGHTS RESERVED, and all moral rights are asserted and reserved.

For any clarifications, please reach out to us at 91-33-40618083 or inquiries@lexplosion.in. Refer to our privacy policy by clicking here.