Cyber Security Legal Checklist for Startups in India

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Cyber law

An Indian startup that collects a name, a phone number, an email address or a payment detail is processing personal data, and from that moment it owes duties under the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. The obligations do not wait for scale. Section 43A of the IT Act makes a body corporate liable to compensate for negligence in maintaining reasonable security practices, and the DPDP Act requires a Data Fiduciary to protect personal data, to limit its use to the stated purpose, and to notify a breach.

The reassuring part is that a startup can meet most of these duties with documentation and discipline rather than large budgets. The harder part is that investors, enterprise customers and regulators now ask for that documentation, and a company that cannot produce it loses deals as well as arguments. This is a checklist a founder can actually run, in the order that reduces risk fastest.

What a startup must comply with, in order of urgency

1. Know what personal data you hold

You cannot protect what you have not mapped. Before any security tool is bought, list every category of personal data the business touches — sign-up details, KYC documents, payment information, support tickets, candidate resumes, employee records — and note where each sits: which database, which cloud region, which vendor, which laptop. The DPDP Act places the obligation on the person who determines the purpose and means of processing, so the company, not the tool, is the responsible party.

A one-page data map is enough to start. It is also the first document an investor's diligence team will ask for, and the first thing a regulator will test if there is a breach.

Retention belongs in the same exercise. Personal data kept after the purpose it was collected for has been served is data that can be breached for no benefit, and the DPDP Act expects erasure once the purpose is met and consent is withdrawn. A startup should know, for each category of data it holds, how long it is kept, who decides when it should go, and how deletion actually happens across live databases, backups and vendor systems.

2. Give notice and take consent

The DPDP Act builds on notice and consent. A user should be told, in clear language, what personal data is collected, why, and how to withdraw consent or ask for erasure. Consent must be free, specific, informed and unambiguous, and the purpose must be stated before the data is used, not added later. A privacy policy that buries the real purpose in generalities does not meet that standard, and a product that quietly shares data with an advertising network does not either.

There is a special rule for children. Processing a child's personal data requires verifiable parental consent, and behavioural monitoring and targeted advertising directed at children are prohibited. A consumer app with younger users needs to design for that from the start, because retrofitting is expensive.

3. Lock down security

Section 43A of the IT Act asks for reasonable security practices and procedures, and the DPDP Act asks for technical and organisational measures. For a startup, the reasonable baseline is access control, encryption of personal data at rest and in transit, logging that records who did what, a tested backup, and a policy that describes who can approve what. None of this requires a security department; it requires an owner and a written standard.

Security also has a criminal dimension. If a person gains unauthorised access to your systems, section 43 read with section 66 of the IT Act applies, and identity theft or impersonation may bring in sections 66C and 66D. If an insider walks out with your customer list, criminal breach of trust under section 316 of the Bharatiya Nyaya Sanhita, 2023 may also be charged.

4. Publish a grievance route

If the product hosts content uploaded by users, the startup is an intermediary, and the safe harbour in section 79 of the IT Act is conditional on observing the IT Rules, 2021. That means a grievance officer, a published contact point, and the prescribed timelines for acknowledging and resolving complaints. A startup that skips this step and then faces a complaint about user content discovers that the safe harbour it assumed it had was never available.

5. Prepare to report an incident

Incident response is a legal process as much as a technical one. When a breach happens, the DPDP Act requires notification to the Data Protection Board and to affected Data Principals, and specified cyber incidents must be reported to CERT-In within six hours under its directions. Putting a name and a phone number against this task in advance is the difference between reporting within the window and missing it.

6. Train the people who handle data

Most incidents begin with a person, not a program. A short, repeated briefing on phishing, password hygiene and the handling of customer records costs almost nothing and prevents a large share of the incidents a young company is likely to face. Training records matter too, because when a company is asked what it did to prevent a breach, a dated attendance sheet answers the question that a policy document alone cannot.

The documents that shape liability

A startup's exposure is often fixed years before a dispute, in the paper it signs. A data processing agreement with a vendor should state the purpose of processing, the security standard, retention and deletion, breach notification, and a right of audit. A technology contract with a client should avoid open-ended warranties of security that the startup cannot meet. Employment contracts should include confidentiality, intellectual property assignment and acceptable-use terms, because insider cases are decided partly on what the employer was entitled to expect.

These documents do not stop a breach. They determine who pays for it, which is what most cyber litigation is really about.

A compliance checklist you can run this week

Two of these deserve emphasis for a startup. The logs table row is where most young companies fail, because evidence kept informally is evidence kept inadmissibly: section 63(4) of the Bharatiya Sakshya Adhiniyam, 2023 requires a certificate before electronic records can be relied on. The grievance row is where most young companies are unpleasantly surprised, because intermediary duties look optional until a takedown complaint arrives.

When the bar rises: significant data fiduciaries

The DPDP Act creates a heavier category, the Significant Data Fiduciary, by reference to factors such as the volume and sensitivity of the data processed, the risk to Data Principals and the potential impact on the state. A company that crosses into that category carries additional duties, including the appointment of a Data Protection Officer and an independent data auditor. Most startups will not begin there, but a business that grows quickly can arrive without noticing, and the classification changes what the board must be able to show.

What cyber insurance does and does not cover

Cyber insurance can cover the cost of investigation, notification and business interruption, and it is worth having. It does not cover a penalty imposed for a statutory default, and it does not cure a failure to comply with the DPDP Act or the IT Act. A policy also depends on the disclosures made when it was bought: an insurer will examine whether the security measures described in the proposal form actually existed. Insurance is a cushion, not a substitute for compliance.

Where startups get it wrong

• Treating a privacy policy as a legal document only, and letting the product do something different.
• Assuming the cloud provider's compliance certificates are the startup's compliance.
• Collecting data that will never be used, which enlarges the breach surface for nothing.
• Keeping no record of security decisions, then having to reconstruct diligence during a dispute.
• Ignoring the six-hour reporting timeline until an incident has already aged.
• Waiting for an enterprise customer's security questionnaire before doing any of this.

If your startup is accused

A complaint can arrive from a user, a client or a competitor. The usual allegations are negligence causing loss under section 43A, cheating by personation under section 66D, or a failure to protect data. The correct first response is not public comment but documentation: produce the security policy, show that it was followed, and show the incident timeline. If a director is likely to be arrested, the application for bail has to be built on that record, and a hurried application built on nothing is a wasted one.

Where the startup itself is the victim, the route is the same as for any other business: report on cybercrime.gov.in, dial 1930 if money has moved, file a written complaint that is registered under section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023, and if the police decline to register it, move the Magistrate under section 175(3) of the BNSS.

What decides the outcome

In a dispute about a breach, the deciding question is not whether the intrusion was clever but whether the company was negligent in its practices. A court will ask what the startup did, what it wrote down, and whether the written standard was followed. A regulator will ask how quickly the company notified and whether it told the whole truth. An enterprise customer will ask the same questions, which is why compliance documentation has a commercial value and not only a defensive one.

Attribution is the other half. A criminal case against an intruder succeeds or fails on whether an investigating agency can link a device or an account to a person, and the startup's logs are often the only material that can do it. This is why preserving logs at the first sign of trouble matters more than winning an argument about how the breach happened.

When to involve a lawyer

Two moments justify a call. The first is when the product begins handling personal data at scale, because the design choices made then create the liability later. The second is the moment an incident is discovered, because that window decides what is preserved and what is said. A cyber crime lawyer in Kolkata can review the data map, the privacy notice and the vendor contracts together, and take the defence side if a complaint follows. Founders who prefer to write first and ask later can at least read the practice notes on the blog and keep the contact page to hand before that first letter arrives.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Cyber Crime Compliance for Companies in India: Legal Duties
• Cyber Bullying and Schools: Duties and Liability in India
• Property Fraud Online: Duties of Real Estate Agents
• Patient Data Breach: Legal Duties of Hospitals in India
• E-Commerce Sellers: Fraud, Duties and Legal Remedies
• Data Breach Duties for CA Firms in India: What to Do

Cyber crime lawyer in your city · Bank account freeze help · Contact