SEBI and IRDAI Regulations

SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF), issued via circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 dated 20 August 2024, applies to stock exchanges, depositories, mutual funds, brokers, and other market intermediaries. It prescribes requirements for data classification, access controls, encryption, incident response, and business continuity. A crucial 2025 update introduced the 'Principle of Equivalence': if a Regulated Entity (e.g., a Bank acting as a Broker) complies with a stricter primary regulator's (RBI) cyber framework, SEBI deems it compliant with CSCRF to avoid duplication. The DPDPA, however, has no such equivalence - entities must still meet the DPDPA's specific privacy-centric safeguards under Rule 6 and breach notification under R.7. The financial services sector guide provides additional compliance context.

IRDAI's Information and Cyber Security Guidelines, 2023 (IRDAI/GA&HR/GDL/MISC/88/04/2023, dated 24 April 2023) apply to insurance companies and intermediaries. They cover data protection, access management, network security, and incident reporting. Insurance entities process sensitive personal data including health information, financial details, and family data. The DPDPA's consent requirements and children's data provisions (R.10-12) add additional obligations beyond IRDAI's framework.

Regulated entities in both sectors face dual compliance obligations. Key areas of overlap include: (a) incident reporting - SEBI's CSCRF, IRDAI's guidelines and CERT-In require reporting within 6 hours of becoming aware of a cybersecurity incident, while DPDPA Rule 7(2)(a) requires the Data Fiduciary to intimate the Board without delay on becoming aware of a breach, followed by a detailed Rule 7(2)(b) report within 72 hours. Reporting only at the 72-hour mark does not, by itself, satisfy the DPDPA, since the without-delay intimation is a separate and earlier obligation - and it would also breach the sectoral 6-hour requirement; (b) data retention - sectoral requirements may mandate longer retention than DPDPA's R.8; (c) security measures - both frameworks prescribe security standards; and (d) cross-border transfers - sectoral restrictions may apply beyond DPDPA. The principle of applying the stricter standard at each overlap point applies.

Securities and insurance entities should: (a) map all regulatory requirements in a compliance matrix; (b) identify overlap points between sectoral and DPDPA requirements; (c) implement the stricter standard at each overlap; (d) establish unified incident response procedures covering all regulators; and (e) designate compliance officers familiar with both frameworks.