CYBERSECURITY LAWS IN INDIA

India's rapid digital transformation has created unprecedented opportunities for economic development, governance and social interaction. At the same time, increasing dependence on digital systems has exposed individuals, businesses and public institutions to cyberattacks, identity theft, ransomware, data breaches, cyber fraud and threats to critical infrastructure. India's response has developed through a combination of the Information Technology Act, 2000, subordinate legislation, institutional mechanisms, criminal law and data-protection regulation. The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 have further expanded this legal landscape. This article examines the evolution of cybersecurity law in India and argues that the principal difficulty is no longer simply the absence of legislation, but the fragmentation of the existing framework. Effective cybersecurity requires more than criminalising cyber offences. It requires prevention, incident response, protection of personal information, institutional coordination, accountability and respect for constitutional rights. The article therefore argues for a shift from a predominantly reactive approach towards a resilient and rights-conscious cybersecurity framework.