Cybersecurity Law and Critical Information Infrastructure: Regulatory Gaps in The Indian Framework

Abstract

India's digital infrastructure has expanded at an unprecedented pace, rendering critical information infrastructure (CII) encompassing power grids, financial systems, telecommunications networks, healthcare platforms, and government databases acutely vulnerable to sophisticated cyber threats. Despite a legislative framework anchored in the Information Technology Act, 2000, as amended in 2008, and institutional mechanisms such as the National Critical Information Infrastructure Protection Centre (NCIIPC) and the Computer Emergency Response Team-India (CERT-In), the Indian cybersecurity regulatory architecture is characterised by structural lacunae, ambiguous sectoral delineation, inadequate enforcement mechanisms, and a pronounced implementation deficit. This article undertakes a doctrinal and comparative analysis of the existing legal framework governing cybersecurity and CII protection in India, critically evaluating the definitional architecture of 'critical information infrastructure' under Section 70 of the IT Act, the scope and constitutionality of the CERT-In Directions 2022, the absence of a comprehensive standalone cybersecurity legislation, and the fragmented sectoral approach of sector-specific regulators. Drawing on comparative insights from the United States, the European Union, the United Kingdom, and Australia, the article identifies five principal regulatory gaps: absence of a unified cybersecurity statute, inadequate incident reporting and sanction mechanisms, insufficient protection for state and local government infrastructure, underdeveloped public-private