CERT-In, DPDP and AI agents

The question What do India's rules mean for agent activity and prompts?

The CERT-In Directions in brief

CERT-In issued its Directions on 28 April 2022 under section 70B(6) of the IT Act, 2000, and they took effect 60 days later. They bind service providers, intermediaries, data centres, government organisations and every body corporate. CERT-In's FAQ quotes the IT Act: a body corporate means any company, and includes firms and sole proprietorships.

Three duties shape how you handle agents:

• Clocks. Sync all ICT system clocks to the NTP servers of NIC or NPL, or to a source that does not deviate from them.
• Reporting. Report the incident types listed in Annexure I to CERT-In within 6 hours of noticing them.
• Logs. Enable logs of all ICT systems and keep them securely for a rolling 180 days, within Indian jurisdiction.

The FAQ adds more detail. Record the time zone with each timestamp. Copies of logs may also sit outside India, if you can produce them to CERT-In in reasonable time. Breaking a direction can bring up to a year in prison, a fine of up to ₹1 lakh, or both, under section 70B(7). The FAQ says CERT-In will use that power reasonably, when non-compliance is deliberate.

An agent incident is a cyber incident

Annexure I lists the incidents you must report. Three fit agent failures closely: unauthorised access to IT systems or data, data breach and data leak. Item xx goes further. It covers attacks or suspicious activity affecting systems or applications related to artificial intelligence and machine learning.

Picture two common failures. An injected instruction makes an agent send a customer file to an outside server. CERT-In's FAQ defines a data leak as the release of sensitive data to an untrusted environment, so that fits. In the second, an agent uses a token it found to wipe a production database. That is an unauthorised change to data, which sits inside CERT-In's definition of a cyber security incident.

GIRD's incident dossier lists 38 publicly reported coding-agent incidents from 2023 to August 2026, from leaked keys to deleted production databases. Prompt injection and agent goal hijack explains how the first kind of failure starts.

The six-hour clock starts when you notice the incident, or when someone brings it to your notice. The FAQ lets you report what you know within that time and send the rest later. Any entity that notices an incident must report it, and a contract cannot move that duty to someone else.

Agent actions belong in your ICT logs

CERT-In's FAQ gives examples of the logs it means: firewall, SIEM, application, proxy and VPN logs, and event logs of critical systems. It says the list is not exhaustive, and that successful and unsuccessful events should both be recorded.

Agents act on the laptops and servers those logs cover. But most of those logs record the employee's account, not the agent acting under it. When CERT-In asks for logs, you need entries that name the agent, the person, the action and the decision. What an audit trail for AI agents must show lists the fields.

Prompts with personal data fall under the DPDP Act

The Digital Personal Data Protection Act, 2023 defines processing to include collection, use, sharing and “disclosure by transmission”. So a prompt that carries a customer's name, phone number or Aadhaar number to a model API is processing. If that data leaks by accident and its confidentiality is compromised, that is a personal data breach under section 2(u).

The Act puts these duties on your company as the Data Fiduciary:

• Purpose. Consent covers only the personal data needed for the specified purpose (section 6(1)).
• Processors. You stay responsible for processing done on your behalf, and may use a Data Processor only under a valid contract (sections 8(1) and 8(2)). A model provider that processes prompts for you is likely one.
• Safeguards. Take reasonable security safeguards to prevent a personal data breach (section 8(5)). The penalty for failing can reach ₹250 crore.
• Breach intimation. Tell the Data Protection Board and each affected person about a breach (section 8(6)). The penalty for failing can reach ₹200 crore.
• Erasure. Erase personal data once the purpose is served, unless a law requires you to keep it (section 8(7)).

Timing matters. A Gazette notification dated 13 November 2025 brought the definitions and the Data Protection Board into force at once. Most duties, including all of section 8, start eighteen months after publication, so in May 2027.

The DPDP Rules, 2025, dated the same day, run on the same clock for these duties. Rule 6 sets minimum safeguards: masking or tokenising personal data, access control, and logs with monitoring and review to detect unauthorised access. It also requires keeping those logs, and the personal data, for one year. Rule 7 says to tell affected people without delay and send the Board a detailed report within 72 hours. Rule 8(3) adds one year of processing logs, including processing your Data Processor does for you.

If the government notifies you as a Significant Data Fiduciary, Rule 13(3) adds a duty that reaches agents. You must check that algorithmic software you use to handle personal data is not likely to put people's rights at risk.

Banks, NBFCs and SEBI entities have extra rules

On 31 July 2026, RBI repealed its earlier IT governance and cybersecurity directions for commercial banks, including the November 2023 Master Direction. The replacement, the Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026, took effect on issue. RBI issued matching directions for small finance banks, payments banks, urban co-operative banks, NBFCs, credit information companies and all-India financial institutions.

For commercial banks, the new directions are specific:

• Every application or system that can reach critical or sensitive information must keep audit trails (paragraph 93).
• Logs must carry what uniquely identifies each event, such as the date, timestamp and source and destination addresses (paragraph 94).
• Audit trails must be detailed enough to serve as forensic evidence and support non-repudiation (paragraph 95).
• The security operations centre must be able to establish who did what, when and how (paragraph 220).
• Cyber incidents must be reported on RBI's DAKSH platform within six hours of detection, and CERT-In notified too (paragraph 182).

SEBI's Cybersecurity and Cyber Resilience Framework of 20 August 2024 sets similar duties for regulated entities. Incidents covered by the CERT-In Directions go to SEBI and CERT-In within 6 hours, with details on SEBI's portal within 24 hours. Entities should collect logs from every source, including audit trail logs. Retention must follow government rules such as the IT Act, the DPDP Act and CERT-In's directions. Market infrastructure institutions and qualified regulated entities must also write procedures for generative AI security.

What evidence to keep

Taken together, the rules point to a short list. Have it ready before an incident, not after.

• An inventory of every agent, MCP server and model in use, each tied to a person and a team.
• Entries for each agent action that name the agent, the person, the action, the target and the decision.
• Timestamps from synced clocks, with time zones, kept for a rolling 180 days, and one year for personal data processing logs from May 2027.
• For prompts, a record of the personal data found and what happened to it, without copying the raw values.
• A contract with each model provider that processes personal data for you.
• A six-hour incident runbook, with breach notices drafted for affected people and the Board.

Anything in a file an agent reads can end up in a request. In GIRD's 19-day case study, four named keys left inside ordinary agent requests. Personal data can travel the same path. Where AI agents leak your keys traces that path.

This article explains the rules as published. It is not legal advice.