Resources · Regulatory watch: India and South Asia
Compliance regulations in India 2026: where each rule stands and what it asks of you.
A short watch list of the Indian laws, regulator frameworks and schemes covered on this site, with the current status of each in one line and a link to the full page.
How to use this page
One status line per regulation, checked against the source
Indian compliance duties now come from several directions at once: a data protection law with a phased start, sector regulators rewriting their cybersecurity rules, sustainability reporting for listed companies and accreditation schemes for hospitals and laboratories. Each card below gives the status of one regulation or scheme as stated on its own page, and dates appear only where they were confirmed against the regulator’s own circular, notification or rules.
Treat the status line as a starting point, not legal advice. Regulators in India issue clarifications and extensions often, so check the latest circular or notification before you act, and talk to a Sterling consultant in Navi Mumbai if you want to map a rule to your own scope. This watch currently covers India; other South Asian markets are not yet carded.
Regulations and schemes
Eight regulations and schemes to watch in India
Privacy, financial-sector cybersecurity, sustainability reporting, medical devices, healthcare and laboratory accreditation. Each card opens the full page.
- DPDP Act 2023 Compliance Consulting (India)DPDP Rules notified 13 November 2025; the main obligations apply from May 2027, as notified.
- RBI and SEBI cybersecurity frameworks (India)RBI issued new directions for commercial banks and NBFCs on 31 July 2026; SEBI's CSCRF dates from 20 August 2024.
- SEBI Business Responsibility and Sustainability Report (BRSR) and BRSR CoreBRSR has been mandatory for the top 1,000 listed companies since FY 2022-23; BRSR Core assurance or assessment reaches them in FY 2026-27.
- Regulatory registration (SFDA, MOHAP/EDE, CDSCO, TGA, Health Canada)Under the Medical Devices Rules, 2017, an importer applies to the Central Licensing Authority (CDSCO) in Form MD-14; the import licence is granted in Form MD-15. Source: CDSCO — Medical Devices Rules, 2017: application and licence forms (MD-14, MD-15). Reviewed 4 October 2026.
- NABH (India)The 6th edition hospital standard, dated January 2025, is current, and NABH has issued an implementation plan for it.
- ISO/IEC 17025 accreditation in IndiaNABL requires at least one successful proficiency testing programme before it grants accreditation.
- PCI DSS compliance in IndiaA contractual standard enforced by card brands and acquirers, applied alongside RBI directions and the DPDP Act.
- ISO/IEC 27001 certification in IndiaCERT-In directions of 28 April 2022 require incident reports within six hours and 180 days of logs kept in India.
Status lines are updated when the page behind them changes. Sterling prepares organisations for these regimes; the regulator, accreditation body or assessor decides.
- 60+countries where Sterling has delivered certification
- 21countries with a Sterling office, eight regions, one coordinated team
- 2003the year the group began implementing ISO management systems; the same method, refined, since
- 8,100+client engagements across the group, from single-site SMEs to multinationals
FAQs
Questions about compliance regulations in India
What this watch covers and how to use it.
Which Indian regulations apply to my organisation?
It depends on your sector, your customers and the data you handle. The DPDP Act applies broadly to digital personal data, while the RBI and SEBI frameworks, BRSR, CDSCO registration and NABH apply to specific types of entity. A Sterling consultant can help you list the ones in scope.
How current are the status lines?
Each line is taken from the facts behind its page, and dates are shown only where they were checked against the regulator’s own publication. Indian regulators revise timelines by circular, so always confirm the latest notification before relying on a date.
Does Sterling certify or accredit organisations?
No. Sterling helps you build the controls, records and evidence. Regulators such as the Data Protection Board of India, RBI and SEBI, and bodies such as NABH and NABL, make their own decisions.
Talk to a consultant
Plan your compliance with India’s 2026 regulations with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice