IT Governance & Compliance Reviews India: Who Needs It and Who Does Not
Whether IT Governance & Compliance Reviews India applies to a given business is the first thing worth settling, and it is where most of the early questions land. The questions below are the ones raised most often in practice; the full scope of the service is on the IT Governance & Compliance Reviews India page.
Is this review mandatory under Indian law, or is it a voluntary governance practice?
There is no single statute that mandates 'an IT Governance & Compliance Review' by that name for most companies. However, several underlying obligations effectively require the substance of what this review covers: for listed companies, Section 134(5)(e) of the Companies Act 2013 requires directors to state that internal financial controls are adequate and operating effectively, and for other companies the auditor reports on internal financial controls under Section 143(3)(i) (subject to exemptions for small companies, one person companies and certain private companies), and in both cases the controls that matter typically include IT general controls over financial systems; CERT-In's 2022 directions impose mandatory incident reporting obligations on a broad range of entities operating IT systems in India; the DPDP Act 2023, together with the DPDP Rules 2025 notified on 13 November 2025, imposes data-fiduciary obligations on entities processing personal data of individuals in India, with the core obligations being phased in and scheduled to take effect eighteen months after notification, around May 2027; and regulated entities (NBFCs, payment aggregators, and others) face specific RBI or SEBI IT governance and cybersecurity circular requirements. The review itself is not mandated by name, but the underlying compliance it verifies substantially is.
In practice: We are careful never to overstate a single blanket mandate — applicability depends heavily on your sector, whether you are a regulated entity, and your data processing profile. We map the specific obligations that actually apply to your business in the scoping stage rather than assuming a one-size-fits-all regulatory list.
What are CERT-In's cybersecurity incident reporting directions, and what is the six-hour rule?
CERT-In (the Indian Computer Emergency Response Team) issued directions in 2022 under Section 70B of the Information Technology Act 2000 that require a broad category of entities to report specified types of cybersecurity incidents to CERT-In within six hours of noticing the incident or being brought to notice of the incident, and to maintain certain logs for a prescribed retention period. The categories of reportable incidents include data breaches, ransomware attacks, unauthorised access to critical systems, and several other specified event types. This is a genuinely time-bound obligation — most organisations without a documented incident response plan have no practical way to identify, escalate, and report within that window.
In practice: We treat CERT-In readiness as a specific, testable item in our review — not a general awareness question. We ask: does your organisation actually know what constitutes a reportable incident, who is authorised to file the report, and what evidence needs to be preserved? Most businesses discover in this exercise that the answer is 'no one is quite sure,' which is precisely the gap the review is meant to surface before an actual incident forces the question.
What happens if the review finds a serious, urgent gap — do you wait until the final report to flag it?
No. If we identify a genuinely urgent gap during the review — for example, an active unpatched vulnerability in production, a completely absent access revocation process, or evidence of an unreported incident that may meet CERT-In's reporting threshold — we flag it immediately to management, not at the final report stage. Time-sensitive findings, particularly anything with a statutory reporting clock attached, are escalated as soon as identified.
In practice: We treat a potential CERT-In reporting-threshold event discovered mid-review as an immediate escalation, not a report-stage finding — the six-hour reporting clock does not pause for the convenience of our review timeline.
Who at PNPC actually delivers this review — is it the same team that does our statutory audit?
The engagement is led by a practising Chartered Accountant with experience across statutory audit, Internal Financial Controls testing, and technology governance, supported where needed by team members with hands-on IT and information security assessment experience. Where PNPC is also your statutory auditor, we coordinate (subject to the independence requirements applicable to statutory audit engagements) so that IT general control findings inform, rather than duplicate, the audit's own IFC testing.
In practice: Where independence rules require separation between the statutory audit team and an advisory engagement team for the same client, we structure the engagement teams accordingly and are transparent about that separation from the outset — this is a standard professional requirement, not a limitation specific to this service.
Can a small NGO or Section 8 company that handles donor and beneficiary data benefit from this review?
Yes, particularly where the organisation processes beneficiary personal data (which can include sensitive categories depending on the nature of the NGO's work) or handles donor payment information. NGOs are not exempt from DPDP Act obligations simply by virtue of their non-profit status where they process personal data as a data fiduciary, and donor and grant-funder due diligence increasingly asks about data protection practices. We scope these reviews proportionately to the NGO's actual scale and data sensitivity.
In practice: We have found that NGOs sometimes assume regulatory data protection obligations apply only to for-profit or large commercial entities — this is not a safe assumption under the DPDP Act's data-fiduciary framework, and we flag this explicitly during scoping conversations with non-profit clients.
Where this sits in the wider engagement
IT Governance & Compliance Reviews India rarely arrives on its own. The statutory basis and the current requirements are set out on the IT Governance & Compliance Reviews India service page, and the related services are grouped under Business Transformation.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On IT Governance & Compliance Reviews India we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.