Basics of Cyber Security — Explained

On this page

1. 1. Origin and Evolution of Cyber Security
2. 2. Cyber Threat Landscape in India
3. 3. Critical Information Infrastructure Protection (CIIP)
4. 4. Cyber Warfare Concepts
5. 5. Legal Framework: IT Act 2000 and Amendments
6. 6. Institutional Mechanisms
7. 7. Emerging Technologies and Security Challenges
8. 8. International Cooperation Frameworks
9. 9. Recent Policy Developments
10. 10. Vyyuha Analysis: India's Cyber Security Evolution
11. 11. Inter-Topic Connections
12. Major Cyber Incidents Affecting India (2020-2024):

Detailed Explanation

The digital revolution has fundamentally reshaped human society, bringing unprecedented connectivity and efficiency. However, this transformation has also opened up a new frontier for conflict and crime: cyberspace.

For India, a nation rapidly digitizing its economy and governance, the 'Basics of Cyber Security' is not just a technical subject but a critical pillar of its internal security architecture. Vyyuha's analysis reveals the interconnected nature of cyber security with national sovereignty, economic resilience, and social stability.

1. Origin and Evolution of Cyber Security

Cyber security, as a discipline, emerged alongside the development of computer networks. Early concerns focused on protecting mainframe systems from unauthorized access. The advent of the internet in the 1990s, and its subsequent commercialization, dramatically expanded the threat landscape.

From simple viruses and worms, threats evolved into sophisticated malware, ransomware, advanced persistent threats (APTs), and state-sponsored cyber espionage. India's journey in cyber security began with the recognition of the need for a legal framework, leading to the enactment of the Information Technology Act, 2000.

Initially, the focus was largely reactive, addressing cyber crimes as they emerged. However, with increasing digital adoption and a growing understanding of the strategic implications of cyberspace, India's approach has gradually shifted towards a more proactive and comprehensive strategy, culminating in the National Cyber Security Policy 2013 and the ongoing efforts towards a National Cyber Security Strategy 2020.

2. Cyber Threat Landscape in India

India faces a complex and evolving cyber threat landscape, characterized by a diverse array of actors and motivations. From a UPSC perspective, the critical examination point here is the multi-pronged nature of these threats and their potential to destabilize internal security. Major categories include:

State-Sponsored Attacks: — These are highly sophisticated attacks often aimed at espionage, sabotage, or intellectual property theft. India has been a target of such attacks, particularly from neighboring states, targeting critical infrastructure, defense networks, and government systems. The 2020 power grid attack, attributed to a Chinese state-sponsored group, is a prime example, highlighting vulnerabilities in operational technology (OT) systems.
Cyber Terrorism: — The use of cyberspace by terrorist organizations to spread propaganda, radicalize individuals, recruit members, plan attacks, and disrupt critical services. This directly impacts internal security, blurring the lines between physical and digital threats. The online radicalization efforts, often linked to groups like ISIS, pose a significant challenge. (Connects to and ).
Cyber Espionage: — Theft of sensitive government, military, or corporate information for strategic advantage. This can involve long-term infiltration of networks to exfiltrate data. India's defense research organizations and strategic industries are frequent targets.
Cyber Crime: — This constitutes the largest volume of cyber incidents, driven by financial gain. It includes:

* Ransomware: Malicious software that encrypts data and demands payment for its release. The AIIMS ransomware attack in 2022 crippled hospital operations for days, demonstrating the devastating impact on essential services.

* Phishing and Spear-Phishing: Deceptive communications designed to trick individuals into revealing sensitive information. Digital payment frauds are often initiated through such techniques. (Connects to ).

* Data Breaches: Unauthorized access to and exfiltration of data from organizations. Incidents involving major airlines and financial institutions have exposed millions of Indian citizens' personal data.

* Distributed Denial of Service (DDoS) Attacks: Overwhelming a system with traffic to make it unavailable. These can be used for extortion or as a diversion for other malicious activities.

Insider Threats: — Malicious or negligent actions by current or former employees who have legitimate access to an organization's systems. This remains a persistent and difficult-to-detect threat.

3. Critical Information Infrastructure Protection (CIIP)

Critical Information Infrastructure (CII) refers to those facilities, systems, and assets, physical or virtual, whose incapacitation or destruction would have a debilitating impact on national security, economy, public health or safety, or any combination thereof.

In India, sectors identified as CII include energy, transport, banking and finance, telecommunications, government, and strategic public enterprises. The National Critical Information Infrastructure Protection Centre (NCIIPC) is the nodal agency responsible for protecting India's CII.

Its mandate includes identifying CII, developing protection strategies, and responding to incidents. Protecting CII is paramount for national security, as disruptions can lead to widespread chaos, economic collapse, and loss of life.

The increasing convergence of IT (Information Technology) and OT (Operational Technology) in sectors like power grids and manufacturing makes these systems particularly vulnerable. (Connects to for communication network security challenges).

4. Cyber Warfare Concepts

Cyber warfare involves the use of cyber attacks by a nation-state against another nation-state to cause significant harm, disruption, or destruction. It is distinct from cyber crime, though the tools and techniques may overlap. Key aspects include:

Cyber Espionage: — Gathering intelligence on an adversary's military, economic, or political capabilities.
Cyber Sabotage: — Disrupting or destroying an adversary's critical infrastructure or military systems.
Cyber Propaganda/Influence Operations: — Manipulating public opinion or political processes through disinformation campaigns. (Connects to for the role of external state actors in cyber warfare).
Attribution Challenge: — Identifying the true perpetrator of a cyber attack is notoriously difficult, complicating retaliation and diplomatic responses. This ambiguity often allows state actors to operate with plausible deniability.

5. Legal Framework: IT Act 2000 and Amendments

India's primary legislation for cyber security is the Information Technology Act, 2000. It provides legal recognition for electronic transactions, electronic records, and digital signatures, and defines various cyber crimes. Key provisions include:

Section 43: — Penalties for damage to computer, computer system, etc. (e.g., unauthorized access, downloading, introduction of viruses).
Section 66: — Computer-related offenses (e.g., hacking, data theft, spreading malware).
Section 66A (Struck Down): — Punishment for sending offensive messages through communication service. Struck down by the Supreme Court in Shreya Singhal v. Union of India (2015) for violating freedom of speech.
Section 66B: — Punishment for dishonestly receiving stolen computer resource or communication device.
Section 66C: — Punishment for identity theft.
Section 66D: — Punishment for cheating by personation by using computer resource.
Section 66F: — Punishment for cyber terrorism.
Section 67: — Punishment for publishing or transmitting obscene material in electronic form.
Section 79: — Intermediary liability, providing safe harbor to intermediaries (like social media platforms) if they observe due diligence.

IT (Amendment) Act, 2008: This significantly strengthened the original Act, introducing new sections to address emerging cyber crimes like data theft, identity theft, and cyber terrorism. It also enhanced penalties and introduced the concept of 'reasonable security practices' for data protection.

Digital Personal Data Protection Act, 2023 (DPDP Act): This landmark legislation aims to provide for the processing of digital personal data in a manner that recognizes both the right of individuals to protect their personal data and the need to process such data for lawful purposes.

It introduces concepts like 'data fiduciary' and 'data principal,' mandates consent for data processing, and establishes the Data Protection Board of India. This Act significantly bolsters the legal framework for data privacy, which is intrinsically linked to cyber security.

(Connects to for constitutional provisions for digital rights).

6. Institutional Mechanisms

India has established several institutions to manage its cyber security posture:

Indian Computer Emergency Response Team (CERT-In): — The national nodal agency for responding to computer security incidents. Its functions include issuing alerts and advisories, handling incidents, vulnerability analysis, and promoting cyber security awareness. CERT-In acts as the first responder to major cyber incidents in India.
National Critical Information Infrastructure Protection Centre (NCIIPC): — Mandated to protect India's CII by monitoring, predicting, and responding to cyber threats to these vital assets.
National Cyber Security Coordinator (NCSC): — Located in the Prime Minister's Office, the NCSC coordinates all cyber security activities at the national level, working with various agencies and ministries.
Indian Cybercrime Coordination Centre (I4C): — Established by the Ministry of Home Affairs, I4C aims to provide a framework and ecosystem for law enforcement agencies to deal with cyber crimes in a coordinated and effective manner. It includes a National Cybercrime Reporting Portal and a Cybercrime Analytics Unit.
Cyber Cells in Police: — Specialized units within state police forces to investigate cyber crimes.

7. Emerging Technologies and Security Challenges

Rapid technological advancements introduce new vulnerabilities and expand the attack surface:

Internet of Things (IoT): — Billions of interconnected devices (smart homes, industrial IoT) often have weak security, making them easy targets for botnets and entry points into larger networks.
Artificial Intelligence (AI) and Machine Learning (ML): — While AI can enhance cyber defenses, it can also be weaponized to create sophisticated malware, automate attacks, generate deepfakes for disinformation, and bypass traditional security measures. The security of AI systems themselves (e.g., adversarial attacks) is also a concern.
5G Technology: — Its high speed, low latency, and massive connectivity enable new applications but also introduce new security challenges related to network slicing, supply chain integrity, and increased attack surface. (Connects to for technology and security nexus).
Quantum Computing: — While still nascent, quantum computing poses a future threat to current encryption standards, necessitating research into quantum-resistant cryptography.

8. International Cooperation Frameworks

Cyber threats are borderless, necessitating international cooperation. India engages in bilateral and multilateral dialogues on cyber security. Key aspects include:

Information Sharing: — Exchanging threat intelligence with friendly nations.
Capacity Building: — Assisting other nations in developing their cyber security capabilities.
Norms of Responsible State Behavior in Cyberspace: — India advocates for a rules-based order in cyberspace, emphasizing sovereignty, non-intervention, and peaceful resolution of disputes, often participating in UN Group of Governmental Experts (GGE) discussions.
Budapest Convention on Cybercrime: — While India is not a signatory, it often aligns with the principles of the convention in its domestic legislation and international cooperation efforts, particularly regarding mutual legal assistance.

9. Recent Policy Developments

India's cyber security policy landscape is dynamic:

National Cyber Security Policy 2013: — Focused on protecting information infrastructure, reducing vulnerabilities, and building capabilities. It laid the groundwork for a comprehensive approach.
National Cyber Security Strategy 2020 (Draft): — Aims for a more proactive and resilient approach, emphasizing critical infrastructure protection, cyber deterrence, skill development, and international cooperation. It seeks to create a secure and resilient cyberspace for citizens and businesses.
Data Protection Bill, 2023: — As discussed, this is a significant step towards a robust data governance framework.
Cyber Swachhta Kendra (Botnet Cleaning and Malware Analysis Centre): — Launched by CERT-In to provide free tools for citizens to secure their devices.

10. Vyyuha Analysis: India's Cyber Security Evolution

India's cyber security evolution, from the IT Act 2000 to the proposed National Cyber Security Strategy 2020, reflects a crucial shift from a largely reactive, law-and-order-centric approach to a proactive, multi-stakeholder, and resilience-focused paradigm.

Initially, the emphasis was on penalizing cyber crimes and providing legal validity to digital transactions. The 2008 amendment marked a recognition of the growing sophistication of threats. However, the true strategic pivot came with the National Cyber Security Policy 2013, which acknowledged cyberspace as a strategic domain.

The ongoing efforts towards a new strategy, coupled with the DPDP Act 2023, signify a mature understanding of cyber security as intrinsically linked to national security, economic growth, and individual rights.

The integration of cyber security with traditional internal security paradigms is evident in the establishment of I4C, the focus on CIIP, and the increasing collaboration between intelligence agencies and cyber experts.

For exam success, focus on the policy-implementation gap in areas like skill development, public-private partnerships, and effective attribution mechanisms, which remain critical challenges.

11. Inter-Topic Connections

Cyber-enabled Money Laundering: — The anonymity of cyberspace facilitates illicit financial flows, making cyber security crucial for combating money laundering. (Connects to ).
Digital Border Security: — Cyber threats can originate from across borders, necessitating robust digital defenses for border areas. (Connects to ).
Cyber Aspects of Terrorism: — Terrorist groups exploit digital platforms for recruitment, financing, and planning, making cyber security a key counter-terrorism tool. (Connects to ).
Online Radicalization: — Extremist ideologies spread through social media, requiring cyber security measures to monitor and counter propaganda. (Connects to ).
E-Governance Security: — The success of digital governance initiatives hinges on secure systems, protecting citizen data and ensuring service delivery. (Connects to ).
International Relations and Cyber Diplomacy: — Cyber security is a growing area of international cooperation and conflict, influencing India's foreign policy. (Connects to ).

Major Cyber Incidents Affecting India (2020-2024):

1
AIIMS Ransomware Attack (2022): — A major ransomware attack on the All India Institute of Medical Sciences (AIIMS) servers in Delhi crippled critical healthcare services for days, impacting patient care, appointments, and billing systems. It highlighted the severe vulnerability of critical healthcare infrastructure to cyber attacks and the need for robust incident response plans.
2
Power Grid Cyber Threats (2020-2021): — Multiple reports, including by Recorded Future, indicated that Chinese state-sponsored groups targeted India's power grid infrastructure, including load dispatch centers, during the India-China border standoff. While no major outages were officially attributed, these incidents underscored the persistent threat to Critical Information Infrastructure (CII) and the potential for cyber warfare to disrupt essential services.
3
SpiceJet Data Breach (2022): — A significant data breach exposed personal information of over a million passengers of the Indian airline SpiceJet, including names, phone numbers, and flight details. This incident highlighted the vulnerabilities in the aviation sector and the need for stricter data protection measures by private entities.
4
Jio Data Breach (2017, though impacts felt later): — While the incident itself was in 2017, the implications of a massive data breach affecting millions of Reliance Jio subscribers, with data allegedly sold on the dark web, continued to be a concern, emphasizing the scale of data at risk in India's digital ecosystem.
5
Cosmos Bank Cyber Attack (2018): — A sophisticated malware attack on Cosmos Bank, Pune, resulted in the theft of nearly Rs 94 crore through fraudulent ATM withdrawals and SWIFT transactions. This incident demonstrated the vulnerability of cooperative banks and the increasing sophistication of financial cyber crimes.
6
ISRO Cyber Espionage Attempts (Ongoing): — Indian Space Research Organisation (ISRO) has been a frequent target of cyber espionage attempts, often attributed to state-sponsored actors, seeking to steal sensitive technological and strategic information related to India's space program.
7
Digital Payment Frauds (Ongoing): — The rapid adoption of UPI and other digital payment methods has led to a surge in phishing, vishing, and smishing scams, where fraudsters trick users into revealing OTPs or PINs, resulting in significant financial losses for individuals. This is a pervasive threat affecting millions.
8
COVID-19 Related Cyber Attacks (2020-2021): — During the pandemic, there was a surge in cyber attacks exploiting public fear and reliance on digital communication. Phishing campaigns impersonating health organizations, ransomware attacks on hospitals, and scams related to vaccine registration were rampant, showcasing how global crises become opportunities for cyber criminals.

This comprehensive understanding of cyber security, its threats, legal underpinnings, and institutional responses, is crucial for any UPSC aspirant aiming to grasp the complexities of India's internal security challenges.

Often confused with

Side-by-side differences the UPSC paper likes to test.

Basics of Cyber Security vs Traditional Security vs Cyber Security Challenges

Open Traditional Security vs Cyber Security Challenges

Aspect	Basics of Cyber Security	Traditional Security vs Cyber Security Challenges
Threat Nature	Traditional Security (Physical)	Cyber Security (Digital)
Threat Nature	Tangible, visible, often localized (e.g., terrorism, insurgency, border conflicts).	Intangible, often invisible, global, and rapidly evolving (e.g., malware, ransomware, data breaches).
Response Mechanisms	Military, police, intelligence agencies, physical barriers, conventional warfare.	Technical defenses (firewalls, encryption), incident response teams (CERT-In), legal frameworks (IT Act), cyber diplomacy, digital forensics.
Legal Framework	National laws (IPC, UAPA), international treaties (Geneva Conventions), clear territorial jurisdiction.	IT Act, DPDP Act, often complex cross-border jurisdiction issues, attribution challenges, lack of universally accepted cyber norms.
Institutional Approach	Clearly defined roles for defense, home affairs, external affairs ministries; hierarchical structures.	Multi-stakeholder approach involving government, private sector, academia, international bodies; horizontal coordination required (NCSC, CERT-In, NCIIPC).
Impact Assessment	Direct physical damage, loss of life, territorial integrity, economic disruption (e.g., war, natural disaster).	Data theft, intellectual property loss, critical infrastructure disruption, economic espionage, reputational damage, privacy violations, potential for physical impact (e.g., power grid attack).
Attribution	Generally easier to attribute (e.g., state actors, known terrorist groups).	Extremely difficult to attribute due to anonymity, proxy servers, false flags, and sophisticated obfuscation techniques.

The distinction between traditional and cyber security challenges is fundamental for UPSC aspirants. Traditional security primarily deals with physical threats to a nation's sovereignty, territory, and population, employing conventional military and law enforcement responses.

Cyber security, conversely, addresses threats in the digital domain, which are often intangible, borderless, and rapidly evolving. While traditional threats are typically easier to attribute, cyber attacks pose significant challenges in identifying perpetrators due to their inherent anonymity.

The legal and institutional frameworks also differ, with cyber security requiring specialized technical expertise, international cooperation, and a multi-stakeholder approach that transcends conventional governmental silos.

Understanding this divergence is crucial for analyzing the integrated nature of modern internal security, where cyber threats can have profound physical and socio-economic consequences.

Why it is tested: Essential for Mains GS-III (Internal Security) to analyze the evolving nature of security threats, the need for integrated strategies, and the challenges in governance and response mechanisms in the digital age.

Basics of Cyber Security vs Cybercrime vs Cyber Warfare

Open Cybercrime vs Cyber Warfare

Aspect	Basics of Cyber Security	Cybercrime vs Cyber Warfare
Primary Actor	Cybercrime	Cyber Warfare
Primary Actor	Individuals, organized criminal groups, hacktivists (often non-state actors).	Nation-states or state-sponsored groups.
Motivation	Primarily financial gain, personal vendetta, notoriety, political activism (e.g., data theft, ransomware, fraud).	Strategic advantage, espionage, sabotage, disruption, propaganda, military objectives (e.g., disabling critical infrastructure, intelligence gathering).
Target	Individuals, businesses, financial institutions, often opportunistic.	Critical national infrastructure, government systems, military networks, defense industries, strategic targets.
Scale and Impact	Can be widespread, causing significant financial loss and data breaches, but typically localized in terms of strategic impact.	Potentially catastrophic, capable of causing widespread societal disruption, economic collapse, or even physical harm, impacting national security.
Legal Framework	Primarily domestic cybercrime laws (e.g., IT Act 2000), international cooperation for law enforcement.	International law (e.g., UN Charter, laws of armed conflict), cyber diplomacy, national security laws, often operates in a legal grey area.
Attribution	Challenging, but often leads to law enforcement investigations and arrests.	Extremely difficult and politically sensitive, often leading to diplomatic tensions or retaliatory cyber actions rather than arrests.

Cybercrime and cyber warfare, while both utilizing digital means, differ significantly in their actors, motivations, and scale of impact. Cybercrime is predominantly driven by financial gain or personal motives, perpetrated by non-state actors, and targets individuals or businesses.

Its legal framework is primarily domestic cyber law enforcement. Cyber warfare, conversely, is an instrument of state policy, conducted by nation-states or their proxies, with strategic objectives like espionage, sabotage, or disruption of an adversary's national capabilities.

The impact of cyber warfare can be devastating, affecting national security and critical infrastructure, and its attribution is fraught with geopolitical complexities. Understanding this distinction is vital for analyzing the diverse challenges to internal security and formulating appropriate national responses, from law enforcement to military deterrence.

Why it is tested: Crucial for Mains GS-III (Internal Security) to differentiate between various types of cyber threats, understand the actors involved, and analyze the strategic implications for national defense and foreign policy.

Questions students ask

7 answered on this topic.

What is the difference between cyber security and information security?

While often used interchangeably, cyber security and information security are distinct but overlapping concepts. Information security (InfoSec) is a broader discipline focused on protecting information, regardless of its format (digital or physical), from unauthorized access, use, disclosure, disruption, modification, or destruction.

It encompasses policies, procedures, and practices to ensure the confidentiality, integrity, and availability (CIA triad) of all information assets. Cyber security, on the other hand, is a subset of information security that specifically deals with protecting digital assets – computers, networks, programs, and data – from cyber threats.

It focuses on the technical aspects of safeguarding information in the digital realm. So, all cyber security is information security, but not all information security is cyber security. For UPSC, understanding this distinction helps in appreciating the comprehensive nature of data protection beyond just digital systems.

How does the IT Act 2000 address cyber crimes in India?

The Information Technology Act, 2000, along with its 2008 amendment, is the cornerstone of cyber law in India. It addresses cyber crimes by defining various offenses and prescribing penalties. Key provisions include Section 43, which deals with unauthorized access and damage to computer systems; Section 66, covering computer-related offenses like hacking and data theft; and Section 66F, which specifically defines and punishes cyber terrorism.

The Act also covers offenses like identity theft (Section 66C), cheating by personation (Section 66D), and publishing obscene material in electronic form (Section 67). Furthermore, it provides for the admissibility of electronic evidence and establishes the framework for digital signatures.

For UPSC, it's crucial to know the specific sections and how they are applied to different types of cyber crimes, as well as the evolution of the Act through amendments.

What is the role of CERT-In in India's cyber security framework?

CERT-In, the Indian Computer Emergency Response Team, is the national nodal agency for responding to computer security incidents. Established under Section 70B of the IT Act, 2000, its primary role is to enhance the security of India's internet domain.

Its functions include issuing alerts and advisories on the latest cyber threats and vulnerabilities, handling cyber security incidents, collecting and analyzing cyber threat intelligence, coordinating response activities, and promoting cyber security awareness among users.

CERT-In acts as the first point of contact for reporting cyber incidents and plays a critical role in mitigating their impact, making it a vital component of India's proactive cyber defense strategy. For UPSC, understanding CERT-In's mandate and operational functions is essential for questions on institutional mechanisms.

What are the major cyber threats facing India today?

India faces a multifaceted array of cyber threats. State-sponsored attacks, often from hostile foreign entities, target critical infrastructure, defense systems, and government networks for espionage and sabotage (e.

g., power grid attacks). Cyber terrorism, involving the use of digital platforms by extremist groups for propaganda, recruitment, and planning, poses a direct threat to internal security. Organized cybercrime syndicates are rampant, engaging in financial frauds (phishing, ransomware, digital payment scams), data breaches, and identity theft, impacting millions of citizens and businesses.

Emerging threats from technologies like AI (deepfakes, sophisticated malware) and IoT (vulnerable devices) further complicate the landscape. For UPSC, it's important to categorize these threats by actor (state, non-state, criminal) and motivation (espionage, financial gain, disruption) and provide relevant examples.

How does cyber security relate to national security and internal security?

Cyber security is inextricably linked to both national and internal security. In the modern era, national security extends beyond physical borders to encompass the digital realm. Cyber attacks can cripple critical national infrastructure (power grids, financial systems, communication networks), disrupt defense capabilities, and compromise sensitive government data, directly impacting a nation's sovereignty and strategic interests.

For internal security, cyber threats manifest as cyber terrorism, organized cybercrime, online radicalization, and the spread of disinformation, which can incite social unrest, undermine law and order, and cause economic instability.

A robust cyber security posture is therefore essential to protect citizens, maintain public order, ensure economic resilience, and safeguard national assets from both state and non-state actors operating in cyberspace.

Vyyuha's analysis emphasizes this holistic integration.

What is Critical Information Infrastructure (CII) and why is its protection vital?

Critical Information Infrastructure (CII) refers to those facilities, systems, and assets, whether physical or virtual, whose incapacitation or destruction would have a debilitating impact on national security, economy, public health or safety, or any combination thereof.

In India, sectors like energy, transport, banking, telecommunications, and government are designated as CII. Its protection is vital because disruption to CII can lead to catastrophic consequences: a power grid failure can cause widespread blackouts, a banking system collapse can trigger economic crisis, and a telecommunications outage can paralyze emergency services.

The National Critical Information Infrastructure Protection Centre (NCIIPC) is the nodal agency for its protection. Safeguarding CII is a top priority for internal security, as it directly impacts the functioning of the state and the well-being of its citizens.

What is the significance of the Digital Personal Data Protection Act, 2023?

The Digital Personal Data Protection Act (DPDP Act), 2023, is a landmark legislation that provides a comprehensive legal framework for the processing of digital personal data in India. Its significance lies in establishing clear rights for individuals (data principals) regarding their personal data and imposing strict obligations on entities (data fiduciaries) that process this data.

The Act mandates consent for data processing, outlines data breach notification requirements, and introduces significant penalties for non-compliance. Crucially, it establishes the Data Protection Board of India as an independent regulatory body.

For UPSC, this Act is vital as it operationalizes the fundamental right to privacy (as affirmed in Puttaswamy judgment) in the digital sphere, enhances data security, and aligns India with global data protection standards, thereby strengthening the overall cyber security ecosystem by promoting responsible data handling.