scorecardresearch
Follow Us:
Saturday, July 02, 2022

India to press ahead with strict cybersecurity rules despite industry concerns

The Indian Computer Emergency Response Team issued a directive in April asking tech companies to report data breaches within six hours of "noticing such incidents" and to maintain IT and communications logs for six months.

By: Reuters |
May 18, 2022 7:26:45 pm
NordVPN, one of the world's largest VPN providers, said it may remove its servers from India. (File photo)

India will not change upcoming cybersecurity rules that force social media, technology companies and cloud service providers to report data breaches swiftly, despite growing industry concerns, the government said on Wednesday.

The Indian Computer Emergency Response Team issued a directive in April asking tech companies to report data breaches within six hours of “noticing such incidents” and to maintain IT and communications logs for six months.

They also mandated cloud service providers such as Amazon and virtual private network (VPN) companies to retain names of their customers and IP addresses for at least five years, even after they stop using the company’s services.

The measures have raised concerns within the industry about a growing compliance burden and higher costs.

Best of Express Premium
Women’s emancipation or population control? Why abortion was legalised in...Premium
Udaipur killing on video | ‘Do something spectacular’: Man from Pak told ...Premium
In village of fauji dreams, second thoughts, insecurity over AgnipathPremium
Delhi HC recently struck down powers of Banks Board Bureau; new body to s...Premium

India’s junior IT minister Rajeev Chandrasekhar said there will be no changes despite the worries, saying tech companies have an obligation to know who is using their services.

India has tightened regulation of Big Tech firms in recent years, prompting pushback from the industry and in some cases even straining trade ties between New Delhi and Washington.

New Delhi has said the new rules were needed as cybersecurity incidents were reported regularly but the requisite information needed to investigate them was not always readily available from the service providers.

But the rules have caused widespread discontent. In a closed-door meeting this week, many social media and tech company executives discussed strategies to urge New Delhi to put the rules on hold, according to a source with direct knowledge.

The source said European authorities require data breaches to be reported within about 72 hours, adding that it was difficult to report incidents in six hours.

Chandrasekhar, however, said India was being generous, as some countries mandate immediate reporting.

The rules are set to be enforced from end of June. After they were announced, NordVPN, one of the world’s largest VPN providers, said it may remove its servers from India.

Privacy activists have said the rules contradict the idea of VPN, which is to safeguard identity of individuals such as whistleblowers from surveillance.

“If you don’t want to go by these rules, and if you want to pull out, then frankly … you have to pull out,” Chandrasekhar told reporters.

UPSC KEY Have you seen our section dedicated to helping USPC aspirants decode daily news in the context of their exams?

📣 Join our Telegram channel (The Indian Express) for the latest news and updates

For all the latest Technology News, download Indian Express App.

  • Newsguard
  • The Indian Express website has been rated GREEN for its credibility and trustworthiness by Newsguard, a global service that rates news sources for their journalistic standards.
  • Newsguard
Advertisement
Advertisement
Advertisement
Advertisement