Resources
Short articles on the duties that reach most Indian businesses, written from the regulator's own documents with the clause beside each point. Where our rulebook could not verify something in a primary source, the article says so.
SEBI CSCRF, 2024
SEBI's Cybersecurity and Cyber Resilience Framework of 20 August 2024, read from the source: who it binds, how stock brokers are placed into bands, and the duties that differ by band.
AuditSahi16 Oct 2026
IRDAI cyber guidelines, revised 2026
The IRDAI Information and Cyber Security Guidelines, fully revised on 6 April 2026, read from the source: who they bind, how intermediaries are tiered, and where smaller intermediaries get lighter controls.
AuditSahi16 Oct 2026
RBI digital lending rules, NBFCs
What RBI's digital lending rules ask of an NBFC, read from the source: what a lending service provider contract must say, what an app may collect, where borrower data must be stored, and what must be reported to RBI.
AuditSahi16 Oct 2026
CERT-In Directions, 2022
Twenty kinds of incident, six hours from noticing, a named point of contact, synchronised clocks and 180 days of logs kept in India. The Directions reach every body corporate.
AuditSahi4 Oct 2026
DPDP Act, 2023 and Rules, 2025
The Act came into force in three phases. What is already live, what starts on 13 November 2026, and the duties that begin on 13 May 2027, with the sections behind each.
AuditSahi4 Oct 2026
RBI Directions, 31 July 2026
One set of Directions each for commercial banks, NBFCs, co-operative banks, small finance banks, payments banks, AIFIs and credit information companies. Which ones we have verified, and what the NBFC Directions ask.
AuditSahi4 Oct 2026