Digital Personal Data Protection Act 2023 and privacy by design

In short

The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's first standalone personal data protection law: it regulates how any organisation processes digital personal data, builds the whole scheme on notice and consent, and creates the Data Protection Board of India to adjudicate breaches with penalties up to ₹250 crore. Privacy by design is the engineering counterpart - building data protection into system architecture, defaults and the development lifecycle rather than bolting on a policy document at the end. Together they decide how Indian product teams design signup flows, logging, retention jobs, consent records and vendor contracts. The topic is examined in cyber law, information security management and GRC papers, and is now a standard interview area for security analyst, privacy/GRC consultant, DPO-support and appsec roles at TCS, Infosys, Wipro, Deloitte, EY, PwC, KPMG, Accenture and every Indian fintech and health-tech company.

Explained

Background, scope and key definitions

• Constitutional basis: *K.S. Puttaswamy v. Union of India* (2017, nine-judge bench) held privacy to be a fundamental right under Article 21; any intrusion must satisfy legality, legitimate aim, necessity/proportionality and procedural safeguards. The DPDP Act is the statutory response, after the 2018 Srikrishna Committee draft and the withdrawn 2019 Bill.
• Enactment and status: passed August 2023 (Act No. 22 of 2023), notified in stages. The DPDP Rules, 2025 were notified on 14 November 2025; the core Data Fiduciary duties - notice, consent, security safeguards, breach intimation, erasure, DPO contact publication - and the omission of IT Act section 43A come into effect only from 13 May 2027. Until that date, section 43A of the IT Act, 2000 and the SPDI Rules, 2011 continue to govern reasonable security practices for sensitive personal data. Provisions creating the Data Protection Board and rule-making powers are already operative.
• Personal data: any data about an individual who is identifiable by or in relation to such data. Digital personal data = personal data in digital form, or non-digital data later digitised. The Act does not create a separate "sensitive personal data" category (unlike the SPDI Rules and GDPR).
• Processing: any wholly or partly automated operation - collection, storage, use, sharing, disclosure, erasure.
• Data Principal: the individual the data is about; for a child it includes the parent/lawful guardian, and for a person with disability the lawful guardian.
• Data Fiduciary: who decides the purpose and means of processing (GDPR's "controller"). Data Processor: processes on a Fiduciary's behalf under contract (GDPR's "processor"). Significant Data Fiduciary (SDF): notified by the Central Government on volume and sensitivity of data, risk to Data Principals, risk to electoral democracy, sovereignty and public order.
• Consent Manager: an India-registered company, accountable to the Data Principal, offering a single interoperable platform to give, manage, review and withdraw consent - an India-specific institution with no GDPR parallel. Rules prescribe a minimum net worth (₹2 crore) and registration with the Board.
• Extra-territorial reach: applies to processing outside India if it relates to offering goods or services to Data Principals in India.
• Not covered: personal data processed for purely personal/domestic purposes, and data the Data Principal has voluntarily made publicly available (for example, a blogger's own published details or statutory public disclosures).

Grounds for processing, notice and consent

• Only two lawful grounds exist: consent, and certain legitimate uses (section 7). There is no open-ended "legitimate interest" balancing test as in GDPR.
• Consent must be free, specific, informed, unconditional, unambiguous, with a clear affirmative action, and limited to the data *necessary* for the stated purpose. Any part exceeding necessity is invalid to that extent.
• Notice must, in clear and plain language, state the personal data and the purpose, how to exercise rights and withdraw consent, and how to complain to the Board. Notice must be available in English or any of the Eighth Schedule languages. Where consent was given before the Act's commencement, the Fiduciary must give the notice as soon as reasonably practicable; processing may continue until the Data Principal withdraws consent.
• Withdrawal must be as easy as giving consent; on withdrawal, processing must stop and data be erased unless law requires retention. Consequences of withdrawal are borne by the Data Principal.
• Legitimate uses include: data voluntarily provided for a specified purpose where no objection is indicated; State functions, subsidies, benefits, licences and services; compliance with law or court order; medical emergency, epidemic or public-health measures; disaster or breakdown of public order; and employment purposes - including safeguarding the employer from loss and providing services/benefits to employees.
• Children and persons with disability: processing a child's data (under 18) needs verifiable consent of the parent/guardian; tracking, behavioural monitoring and targeted advertising directed at children are prohibited. The Rules allow exemptions for classes such as healthcare and educational institutions for limited purposes. Verification may use a virtual token mapped to a verified identity (for example a DigiLocker-issued credential).

Obligations, rights and institutional machinery

• Data Fiduciary duties: process only for a lawful purpose; ensure completeness, accuracy and consistency when data is used for a decision about the Principal or shared with another Fiduciary; implement reasonable security safeguards (Rules illustrate encryption, obfuscation, masking or tokenisation, access control, logging and monitoring, backups, and contractual controls over processors); publish the contact of a DPO or a person able to answer questions; establish a grievance redressal mechanism.
• Breach handling: on any personal data breach, intimate each affected Data Principal and the Board without delay, and give the Board detailed information (nature, extent, cause, mitigation, remedial measures) within 72 hours (extendable on request). Note that the DPDP breach duty is separate from the CERT-In directions of 28 April 2022, which require reporting specified cyber incidents within 6 hours - the two obligations run in parallel.
• Storage limitation / erasure: erase on withdrawal of consent or when the purpose is no longer served, unless retention is required by law. The Rules set a three-year retention limit, measured from the Data Principal's last approach/contact, for specified large platforms (e-commerce, online gaming and social media intermediaries above prescribed user thresholds), with 48 hours' advance notice before erasure.
• Additional SDF duties: appoint a Data Protection Officer based in India, reporting to the board or governing body, who is the grievance point of contact; appoint an independent data auditor; conduct a periodic Data Protection Impact Assessment and audit (annually under the Rules); observe restrictions on transferring specified personal data outside India; and verify that algorithmic software does not pose a risk to Data Principals' rights.
• Cross-border transfer: the Act permits transfer to any country except those restricted by Central Government notification - a blacklist (negative list) model, the opposite of GDPR's adequacy whitelist. Sectoral rules that are stricter (for example the RBI's 2018 payment-data localisation direction) continue to prevail.
• Rights of the Data Principal: (1) right to access a summary of personal data and processing activities and the identities of Fiduciaries with whom it was shared; (2) right to correction, completion, updating and erasure; (3) right to grievance redressal - must be used before approaching the Board; (4) right to nominate another individual to exercise rights in case of death or incapacity. There is no standalone right to data portability or to object to automated decision-making.
• Duties of the Data Principal (section 15, unusual in global law): do not impersonate, do not suppress material information, do not file false or frivolous complaints, furnish only authentic information when seeking correction.
• Data Protection Board of India: a body of a chairperson and members appointed by the Central Government, functioning as a digital office - proceedings conducted digitally. It inquires into breaches on complaint or reference, directs remedial/mitigation measures, and imposes penalties; it may accept voluntary undertakings in lieu of proceedings. It is not a rule-making regulator - rules are made by the Central Government.
• Appeals: to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) within 60 days, digitally; then to the Supreme Court.
• Exemptions: notified State instrumentalities (sovereignty, security, public order, foreign relations) may be exempt from most of the Act; also research, archiving and statistical purposes subject to prescribed standards; court/tribunal functions; prevention and investigation of offences; processing by a foreign Fiduciary under contract for data of non-residents; and approved schemes of merger or amalgamation. Startups may be notified for relaxed obligations.
• Effect on other law: the Act overrides inconsistent laws but is in addition to them; it omits section 43A and the related rule-making power in section 87(2)(ob) of the IT Act, and narrows RTI section 8(1)(j) so that personal information is exempt from disclosure - both with effect from 13 May 2027.

Privacy by design: principles and engineering practice

• Origin: Ann Cavoukian's seven Foundational Principles - (1) proactive not reactive, preventative not remedial; (2) privacy as the default setting; (3) privacy embedded into design; (4) full functionality - positive-sum, not zero-sum; (5) end-to-end security over the full lifecycle; (6) visibility and transparency; (7) respect for user privacy - user-centric.
• Codified in GDPR Article 25 ("data protection by design and by default") and in ISO/IEC 27701 (privacy information management, extending ISO/IEC 27001), ISO/IEC 29100 (privacy framework, 11 principles), ISO/IEC 29134 (privacy impact assessment) and the NIST Privacy Framework. DPDP's duties - necessity-bound consent, accuracy, security safeguards, erasure, SDF impact assessment - make privacy by design the practical way to comply even though the Act does not use the phrase.
• Core data-handling principles (the exam list): lawfulness and fairness; purpose limitation; data minimisation (collect only what is needed); accuracy; storage limitation; integrity and confidentiality; accountability; transparency.
• Privacy design strategies (Hoepman's eight): MINIMISE, SEPARATE, ABSTRACT, HIDE (the data-oriented four); INFORM, CONTROL, ENFORCE, DEMONSTRATE (the process-oriented four).
• Privacy-enhancing technologies (PETs):
  • Anonymisation - irreversible removal of identifiability; anonymised data falls outside "personal data". Pseudonymisation/tokenisation - identifiers replaced by a reversible token; still personal data.
  • k-anonymity (each record indistinguishable from k−1 others on quasi-identifiers), l-diversity (each equivalence class has l distinct sensitive values), t-closeness (distribution within a class close to the overall distribution).
  • Differential privacy - calibrated noise bounds what any single record can reveal (privacy budget ε).
  • Encryption at rest and in transit, format-preserving encryption, data masking in non-production environments, secure multi-party computation, homomorphic encryption, federated learning, zero-knowledge proofs, consent and preference management platforms.
• Lifecycle practice: data inventory and Record of Processing Activities; data flow mapping; DPIA at design stage for high-risk processing; privacy user stories and threat modelling with LINDDUN (Linkability, Identifiability, Non-repudiation, Detectability, Disclosure of information, Unawareness, Non-compliance); privacy test cases in CI; retention and deletion jobs with audit logs; subject-rights (DSAR) workflow with identity verification and SLAs; vendor/processor due diligence and data processing agreements; breach runbook aligned to both the 6-hour CERT-In and 72-hour Board clocks.
• Dark patterns are the opposite of privacy by default: pre-ticked boxes, bundled consent, "I'll do it later" nags and asymmetric reject buttons. The CCPA (Central Consumer Protection Authority) Guidelines for Prevention and Regulation of Dark Patterns, 2023 under the Consumer Protection Act, 2019 list 13 specified dark patterns including forced action, privacy Zuckering, nagging and basket sneaking.
• Limitations and criticism of the Act: broad government exemptions and wide delegated rule-making; no sensitive-data tiering so health, biometric and financial data get the same baseline; no data-portability right; no explicit right against automated decision-making; no statutory compensation to the affected individual (penalties go to the Consolidated Fund of India); Board members' short tenure and government appointment raise independence questions; the long runway to 13 May 2027 leaves section 43A/SPDI as the operative security standard in the meantime.

Penalties, comparison and sectoral overlay

• Penalties are decided by the Board after inquiry, considering nature, gravity, duration, repetitiveness, gain or loss, mitigation and proportionality. They are civil financial penalties, not criminal - the Act creates no imprisonment.
• Sectoral privacy obligations continue alongside DPDP: RBI master directions and the 2018 payment-data localisation circular; SEBI cyber security and cyber resilience framework; IRDAI regulations; TRAI and the telecom licence conditions; Account Aggregator consent artefacts under the RBI NBFC-AA framework; ABDM/health data management policy; UIDAI Aadhaar Act regulations; MeitY/CERT-In directions; and the Telecommunications Act, 2023 for communication data. The Bharatiya Nagarik Suraksha Sanhita, 2023 and Bharatiya Sakshya Adhiniyam, 2023 govern procedure and electronic evidence in any resulting proceedings.

Key points

• DPDP Act, 2023 - India's first dedicated personal data protection statute, covering digital personal data only.
• Commencement - Rules notified 14 November 2025; the main Fiduciary duties and omission of IT Act s.43A take effect 13 May 2027; until then s.43A and the SPDI Rules, 2011 apply.
• Puttaswamy (2017) - privacy is a fundamental right under Article 21; the proportionality test is the constitutional backdrop.
• Data Principal / Data Fiduciary / Data Processor - individual / controller-equivalent / processor-equivalent.
• Two lawful grounds only - consent, or a listed legitimate use; no GDPR-style legitimate-interest balancing.
• Consent test - free, specific, informed, unconditional, unambiguous, by clear affirmative action, limited to necessary data, withdrawable as easily as given.
• Consent Manager - India-registered, Board-registered intermediary through which a Principal manages consent across Fiduciaries.
• Children - under 18; verifiable parental consent mandatory; tracking, behavioural monitoring and targeted ads at children prohibited.
• Breach duty - intimate every affected Principal and the Board without delay; detailed report to the Board within 72 hours; CERT-In's separate 6-hour incident clock still applies.
• Significant Data Fiduciary - extra duties: India-based DPO, independent data auditor, annual DPIA and audit, algorithmic due diligence.
• Cross-border - permitted by default, restricted only to countries on a Government negative list; stricter sectoral localisation (RBI) prevails.
• Rights - access summary, correction/erasure, grievance redressal, nomination; no portability, no right against automated decisions.
• Duties of the Data Principal - no impersonation, no suppression of material facts, no frivolous complaints.
• Data Protection Board of India - digital-office adjudicator, not a rule-maker; appeal to TDSAT in 60 days, then Supreme Court.
• Maximum penalty - up to ₹250 crore for failure of reasonable security safeguards; ₹10,000 on a Data Principal for breach of duties.
• Privacy by design - Cavoukian's seven principles, with privacy as the default setting and end-to-end lifecycle protection.
• Hoepman's eight strategies - MINIMISE, SEPARATE, ABSTRACT, HIDE, INFORM, CONTROL, ENFORCE, DEMONSTRATE.
• PETs - anonymisation, pseudonymisation, k-anonymity/l-diversity/t-closeness, differential privacy, encryption, federated learning.
• Standards - ISO/IEC 27701 (PIMS on ISO/IEC 27001), ISO/IEC 29100, ISO/IEC 29134 (PIA), NIST Privacy Framework; LINDDUN for privacy threat modelling.

Formulas and examples

Example 1 - Which penalty head applies, and to whom. A Bengaluru ed-tech platform stores 8 lakh learner records, including 3 lakh learners aged 14-17, in an S3 bucket left publicly readable. The data is scraped. The company discovers it on day 1 and reports to the Board on day 6; it had taken only parental email confirmation (no verification) for the minors' accounts.

• Head 1 - no reasonable security safeguards (public bucket, no encryption or access control): ceiling ₹250 crore.
• Head 2 - breach report to the Board filed on day 6, beyond 72 hours: ceiling ₹200 crore.
• Head 3 - children's data processed without *verifiable* parental consent: ceiling ₹200 crore.
• These are ceilings per head, so the theoretical aggregate exposure is ₹650 crore; the Board would fix a far lower actual figure after applying the section 33(2) factors. Separately, the incident is a CERT-In reportable incident with a 6-hour clock, and the affected learners/guardians must be intimated without delay. Note that if this happened today (5 November 2026) the Fiduciary duties are not yet enforceable - the operative security standard is IT Act s.43A with the SPDI Rules until 13 May 2027.

Example 2 - Data minimisation applied to a signup form. A loan app's current signup collects: name, mobile, email, PAN, Aadhaar number, full contact list, SMS inbox, precise GPS, selfie, date of birth, gender, employer name.

• Purpose = KYC + credit assessment for a personal loan.
• Necessary: name, mobile, email, PAN, date of birth, employer name, and income proof.
• Not necessary - must be dropped: contact list, SMS inbox, precise GPS (classic over-collection; RBI's digital-lending framework also bars contact and media access).
• Aadhaar number: collect only if the chosen KYC route is Aadhaar-based, and store only the masked/last-4 or a virtual ID; otherwise use offline XML/DigiLocker.
• Reduction: 12 fields/permissions → 7, i.e. 42% fewer data items, and three dangerous permissions removed. Consent for the dropped items would in any case be invalid "to the extent" it exceeds necessity.

Example 3 - k-anonymity on a placement dataset. A college releases placement data with quasi-identifiers (Branch, Year of birth, District). Equivalence-class sizes are: {CSE,2004,Pune} = 12, {CSE,2004,Nagpur} = 5, {ECE,2003,Pune} = 2, {ECE,2004,Thane} = 1.

• k = smallest class size = 1, so the table is only 1-anonymous - the single ECE/2004/Thane student is directly re-identifiable.
• Generalise year of birth to a 2-year band (2003-2004) and district to state: classes become {CSE,2003-04,MH} = 17, {ECE,2003-04,MH} = 3 → k = 3; re-identification probability for an ECE target ≤ 1/3 ≈ 33%.
• Suppress the ECE rows or merge branch into "Circuit branches" → one class of 20, k = 20, probability ≤ 5%. Trade-off: each step reduces analytical utility - the positive-sum principle says design the release so that both the statistic and the privacy survive.

Example 4 - Differential privacy on a count query. A health app answers "how many users in Kerala reported dengue symptoms this week?" True count f(D) = 1,840. Count query sensitivity Δf = 1.

• ε = 1.0 → noise scale b = 1/1 = 1.0, standard deviation = 1.0 × √2 ≈ 1.41. A sample noise draw of +1.2 gives a published answer of 1,841 - highly accurate, weak formal guarantee.
• ε = 0.1 → b = 1/0.1 = 10, standard deviation ≈ 14.1. A sample draw of −23 gives 1,817 - noticeably noisier, much stronger guarantee.
• Privacy-loss ratio at ε = 0.1 is bounded by e^0.1 ≈ 1.105, i.e. any outcome's probability changes by at most about 10.5% whether or not one individual is in the dataset; at ε = 1.0 the bound is e¹ ≈ 2.718 (up to ~172% change). Lower ε, stronger privacy, lower utility.

Example 5 - Breach timeline arithmetic. A payments company's SOC confirms data exfiltration at 02:30 IST on Monday.

• CERT-In 6-hour report due by 08:30 IST Monday.
• Intimation to affected Data Principals: without delay - the design target is the same day, with the mandated content (nature and extent of the breach, likely consequences, mitigation measures, safety measures the user should take, and the contact point).
• Detailed report to the Data Protection Board due within 72 hours → by 02:30 IST Thursday, extendable on written request.
• RBI-regulated entities additionally report to the RBI under their own incident-reporting directions - a single incident, three or four clocks, which is exactly why the breach runbook is built at design time.

# Privacy-by-design checks wired into CI (illustrative)
RETENTION = {"otp_log": 7, "session": 90, "kyc_doc": 2555}   # days; kyc_doc = 7 years, statutory

def assert_minimal(fields_collected, fields_declared_in_notice):
    extra = set(fields_collected) - set(fields_declared_in_notice)
    assert not extra, f"collected beyond notice: {extra}"      # purpose limitation

def assert_retention(table, age_days):
    assert age_days <= RETENTION[table], f"{table} past retention"   # storage limitation

def default_consent_state():
    return {"marketing": False, "analytics": False, "profiling": False}  # privacy by default

Where it is used

• IT services and consulting GRC teams (TCS, Infosys, Wipro, HCLTech, Deloitte, EY, PwC, KPMG, Accenture): DPDP readiness assessments, data discovery and mapping, consent re-papering, DPA remediation for clients.
• Fintech, banking and insurance: consent artefacts in the RBI Account Aggregator ecosystem, card tokenisation, RBI payment-data localisation, SEBI cyber resilience filings, IRDAI policyholder data handling.
• Health-tech and hospitals: ABDM health IDs, consent-managed health records, de-identified datasets for research under the research exemption.
• Consumer internet, e-commerce, gaming and social media: age assurance and verifiable parental consent, three-year inactivity erasure for notified large platforms, removal of dark patterns under the CCPA 2023 guidelines.
• Job roles: privacy/GRC analyst, DPO office associate, data protection engineer, appsec engineer running DPIAs and LINDDUN threat models, SOC analyst owning the breach-notification runbook, internal auditor/independent data auditor, legal-tech and cyber law practice.
• Public sector and GovTech: DigiLocker, UIDAI-linked verification tokens, state service-delivery portals operating under the State-function legitimate use and notified exemptions.

Interview questions

• Q: Who is a Data Fiduciary and how does the role differ from a Data Processor? A: The Data Fiduciary determines the purpose and means of processing and carries the statutory duties; the Processor only processes on the Fiduciary's behalf under a valid contract, and the Fiduciary remains accountable for the Processor's acts.
• Q: What are the only lawful grounds for processing under the DPDP Act? A: Consent that meets the statutory test, or one of the listed "certain legitimate uses" such as State functions, legal compliance, medical emergency, disaster, or specified employment purposes - there is no general legitimate-interest balancing test.
• Q: Does the DPDP Act recognise sensitive personal data? A: No - it has a single category of digital personal data. The sensitive-personal-data concept lives in the SPDI Rules, 2011 under IT Act section 43A, which remain operative until 13 May 2027.
• Q: How does DPDP treat cross-border transfers compared with GDPR? A: DPDP permits transfers to any country except those the Central Government restricts by notification (a negative list); GDPR requires an adequacy decision or a transfer tool. Stricter sectoral rules, such as RBI's payment-data localisation, still override.
• Q: What must you do within 72 hours of a personal data breach? A: Give the Data Protection Board a detailed report - nature, extent, timing, cause, likely consequences, mitigation and remedial measures, and the findings about who caused it - extendable on request; affected Data Principals must be intimated without delay, and CERT-In separately within 6 hours for a reportable incident.
• Q: What extra obligations attach to a Significant Data Fiduciary? A: An India-based DPO reporting to the governing body, an independent data auditor, periodic (annual) DPIA and audit, verification that algorithmic software does not risk Data Principals' rights, and compliance with any restrictions on transferring specified data abroad.
• Q: What is a Consent Manager and why is it unique to India? A: An India-incorporated, Board-registered company accountable to the Data Principal that provides one interoperable platform to give, review, manage and withdraw consent across Fiduciaries; GDPR has no equivalent statutory intermediary.
• Q: Name Cavoukian's privacy-by-design principle that most often fails in practice, and why. A: "Privacy as the default setting" - products ship with analytics, profiling and marketing pre-enabled, which is both a dark pattern and a failure of the necessity-bound consent test.
• Q: How is pseudonymised data treated, and why does it matter? A: It remains personal data because re-identification is possible with the mapping key, so the full obligations apply; only genuinely irreversible anonymisation takes data out of scope.
• Q: A product manager wants to keep a user's contact list "for future features". How do you respond? A: Refuse at design stage: there is no specified present purpose, so consent cannot be informed or necessity-bound; it breaches purpose limitation and data minimisation, and in lending apps it is separately barred by RBI's digital-lending framework.
• Q: Can a Data Principal claim compensation under the DPDP Act? A: No - the Act provides only civil penalties payable to the Consolidated Fund of India; an individual's remedy for compensation lies elsewhere, for example under IT Act section 43A/43 while it is in force, consumer law or tort.
• Q: What is the rights-escalation path for a Data Principal? A: Use the Fiduciary's or Consent Manager's grievance redressal first, then complain to the Data Protection Board, then appeal to TDSAT within 60 days, and from there to the Supreme Court.
• Q: Explain ε in differential privacy to a non-specialist. A: It is the privacy budget bounding how much any single person's presence can change the published result - the probability of any outcome changes by at most a factor of e^ε, so a smaller ε means more noise and stronger privacy.

Common mistakes

• Treating the DPDP Act as fully in force today - the Fiduciary duties and the omission of IT Act section 43A apply only from 13 May 2027; until then section 43A and the SPDI Rules, 2011 are the operative standard, so answers must state the date rather than assume immediate effect.
• Importing GDPR concepts that DPDP does not have: sensitive personal data, legitimate interests as a ground, data portability, the right against automated decision-making, and a right to compensation.
• Confusing the clocks - quoting CERT-In's 6 hours as the DPDP deadline, or thinking the 72-hour Board report replaces intimation to affected individuals (both are required).
• Saying consent is enough on its own: consent is invalid to the extent it covers data not necessary for the stated purpose, so minimisation is a legal test, not a best practice.
• Calling pseudonymised, tokenised, masked or encrypted data "anonymous" and concluding it is out of scope.
• Reciting privacy by design as a policy slogan without naming a mechanism - DPIA, LINDDUN threat model, default-off toggles, retention jobs, DSAR workflow, processor contract.
• Mixing up institutions: the Data Protection Board adjudicates but does not make rules (the Central Government does), and appeals go to TDSAT, not a High Court writ as the first step.
• Assuming cross-border transfer is banned (it is permitted unless the country is notified) or that DPDP overrides RBI/SEBI/IRDAI localisation and sectoral rules (stricter sectoral rules prevail).

Related topics

Cyber law and the IT Act · IT governance, risk and compliance · Security standards: ISO 27001, NIST CSF and CERT-In directions · Cryptography and key management · Secure software development lifecycle and threat modelling · Cyber security careers and certifications