EMERGING CYBERSECURITY THREATS AND LEGAL CHALLENGES IN INDIA

THE REDWOOD JOURNAL  Website: www.the redwood journal.com VOLUME:-5 ISSUE NO:-5 , SEPTEMBER 7, 2026  ISSN (ONLINE):- 3139-7360  Email: theredwoodjournal@gmail.com  Digital Number : 2025-23534643  CC BY-NC-SA  Authored By:- Shambhavi Singh Amity Law School, Amity University Patna, Bihar   EMERGING CYBERSECURITY THREATS AND LEGAL CHALLENGES IN INDIA DOWNLOAD FULL PAPER :- EMERGING CYBERSECURITY THREATS AND LEGAL CHALLENGES IN INDIA Abstract  India now lives much of its life online. We pay through UPI, bank on our phones, file government forms from home and see doctors over video calls. That shift has opened real opportunities, but it has also handed criminals, hostile states and opportunists a much larger target. Ransomware, phishing, identity theft, financial fraud, AI-enabled scams and deepfakes are no longer rare events. They affect national security, the economy and ordinary people’s privacy. The country’s legal response rests mainly on the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023, institutions such as CERT-In, and a patchwork of directions and policies. That foundation matters, but newer technologies have exposed gaps in accountability, coordination between agencies, protection of critical infrastructure, privacy and day-to-day enforcement. This article traces how India’s cybersecurity framework developed, looks at the threats that now shape it, examines data protection, compares India with the EU, Singapore and Japan, and ends with practical reforms for a framework that is comprehensive, adaptable and respectful of rights. Keywords: Cybersecurity, Cyber Law, Information Technology Act 2000, Artificial Intelligence, Deepfakes, Data Protection, Digital Privacy, Cybercrime, Digital Forensics, Critical Infrastructure   Introduction Digital technology has changed how India works. Digital payments, online banking, e-commerce, e-governance, health technology and everyday communication have boosted the economy, made public services easier to reach and put information within almost everyone’s grasp. But the more we depend on digital infrastructure, the more exposed we become. Individuals, businesses and government bodies all face growing cyber threats. Cybersecurity means protecting computer systems, networks, devices and information from unauthorised access, misuse, damage, disruption or destruction. It is no longer only a technical matter. It touches national security, economic development, privacy, public safety and constitutional rights. India’s main law in this field is the Information Technology Act, 2000. It was written mainly to give legal recognition to electronic records and transactions and to deal with certain offences involving computers and networks. Since then, artificial intelligence (AI), the Internet of Things (IoT), cloud computing, blockchain, cryptocurrency, 5G and quantum computing have introduced risks the original drafters could not fully have foreseen. Over the years India has built a set of institutions to respond: the Indian Computer Emergency Response Team (CERT-In), the National Cyber Security Coordinator (NCSC), the National Critical Information Infrastructure Protection Centre (NCIIPC), the Defence Cyber Agency and the National Cyber Security Policy, 2013. The Digital Personal Data Protection Act, 2023, followed by the Digital Personal Data Protection Rules, 2025, is the latest major addition. Still, laws alone do not make a country secure. Results depend on how well institutions coordinate, how prepared the technology is, whether enforcement agencies have the capacity to act, and how aware the public is. India’s challenge is to protect digital systems and personal information without choking innovation or trampling constitutional freedoms. 1.1 The problem Despite the progress, cyber threats keep growing in sophistication. Existing provisions may not fully answer problems raised by AI-generated deepfakes, automated attacks, ransomware, cross-border crime and attacks on critical infrastructure. Scattered institutional responsibilities, a shortage of technical expertise, difficulty in collecting digital evidence and privacy concerns make enforcement harder still. The central question is this: is India’s current cybersecurity framework equipped to handle emerging threats while keeping a fair balance between national security, individual privacy and technological growth? 1.2 What this article sets out to do Trace how cybersecurity law and policy have evolved in India. Identify emerging threats, especially AI-enabled crime and financial fraud. Assess how far the DPDP Act, 2023 protects digital privacy. Pinpoint legal, institutional and enforcement gaps. Examine the challenges posed by new technologies. Show why digital forensics and skilled professional’s matter. Suggest legal and policy reforms. 1.3 Questions explored Is the IT Act, 2000 enough to deal with emerging threats? What legal problems arise from AI-enabled crime and deepfakes? How well does the DPDP Act, 2023 protect privacy and personal data? What are India’s main institutional and enforcement challenges? Which reforms would build a truly comprehensive framework? 1.4 Method The study is doctrinal and analytical. It draws on secondary sources: statutes, government policies, official notifications, court decisions, research articles, books, reports and international legal frameworks. It looks closely at the IT Act, 2000 and the DPDP Act, 2023, studies India’s institutions, and compares selected features with the EU’s GDPR, Singapore’s PDPA and Japan’s cybersecurity framework. The approach is qualitative, aimed at spotting legal gaps and proposing workable reforms. 2. How India’s Cyber Framework Evolved India’s cyber regulation has grown hand in hand with information technology and online commerce. The IT Act, 2000 laid the foundation by recognising electronic records and electronic signatures and by creating offences such as unauthorised access and damage to computer systems. The Information Technology (Amendment) Act, 2008 strengthened the law. It added or revised provisions on identity theft, cheating by personation, violation of privacy, cyber terrorism and intermediary liability. After that, the country developed specialised institutions and policies for incident reporting, cyber defence and critical infrastructure protection. Milestone What it did IT Act, 2000 Foundation of India’s cyber-law framework IT Amendment Act, 2008 Added offences and broadened the framework National Cyber Security Policy, 2013 Set a wider vision for securing cyberspace CERT-In National agency for responding to cyber incidents NCIIPC Protects critical information infrastructure DPDP Act, 2023 Statutory framework for processing digital personal data DPDP Rules, 2025 Detailed rules to implement the data-protection framework   In short, India has moved from regulating electronic transactions and cyber offences towards a broader system that covers digital security, privacy and national cyber preparedness. 3. The Threats We Face Today Technology is moving fast, and so are the people who abuse it. The threats below can hit individuals,