India's Regulatory Wave: The 5 Security Controls Every Organization Needs Now

India’s regulatory environment is not one framework — it’s four overlapping frameworks, each enforced by different agencies, each carrying penalties that reach into hundreds of crores. The good news: across DPDP, SEBI CSCRF, CERT-In, and RBI, organizations need to demonstrate exactly five controls.

The Framework

HashiCorp’s analysis maps four active Indian regulatory regimes to their common security requirements:

• DPDP Rules (Digital Personal Data Protection, notified November 2025): Covers any organization processing personal data of Indian residents. Penalties reach ₹250 crore for failures in security safeguards.
• SEBI CSCRF (Cybersecurity and Cyber Resilience Framework, August 2024): Applies to securities market entities with five resilience goals: anticipate, withstand, contain, recover, and evolve.
• CERT-In Directions (effective June 2022): Mandates improved observability and accelerated incident reporting across service providers, intermediaries, and data centers.
• RBI Payment Data Localization (since 2018): Requires payment data stored only in India; foreign processing must return data within 24 hours.

Encryption — At Rest and In Transit

All four frameworks require encryption. In practice, this means managing encryption keys centrally rather than application-by-application — a requirement that scales poorly with static secrets embedded in configuration files. Vault’s Transit engine provides encryption-as-a-service: applications call the API, Vault handles the cryptographic operations, and keys never leave the secure boundary.

Tokenization and Data Masking

DPDP and SEBI CSCRF both reference tokenization of sensitive fields — payment card numbers, Aadhaar identifiers, personal health data — to minimize exposure if a system is compromised. Vault’s Transform engine handles format-preserving encryption and tokenization, allowing tokenized data to flow through existing applications without schema changes.

Least-Privilege Access

CERT-In’s observability requirements and SEBI’s containment goals both imply access controls that limit blast radius when a credential is compromised. Dynamic secrets — credentials that exist only for the duration of a specific session — satisfy least-privilege requirements more reliably than rotating static credentials on a schedule.

Audit Logging with Retention

CERT-In requires incident reporting within defined windows, which requires audit logs that are both complete and tamper-evident. Vault’s audit devices write every request and response to configurable backends, providing the evidence trail that regulators and forensic investigators require.

Data Residency

RBI’s data localization rule has specific operational implications: data processed offshore must return to India-based storage within 24 hours. Boundary handles identity-based access brokering for India-resident infrastructure without routing sensitive data through external systems.

Source: HashiCorp Blog

Content created with AI assistance and reviewed for accuracy.