Law / regulation
DPDP Act (India)
India's data protection law for digital personal data, made operational by the DPDP Rules, 2025, which come into force in phases until May 2027.
Hi, I'm Pharos Click me Tap me to see what I do Understand the rules.
Cybersecurity · AI Governance · Privacy
Understand the rules.
Master the risks.
Build trust.
MajorCyber™ is an independent knowledge platform that explains security, AI governance and privacy frameworks in clear language, with every claim traced to its official source.
13 full guides 26 profiles Drag the globe to spin it · tap or click a label to open its page · arrow keys move between labels
Focus areas
Six disciplines, one connected body of knowledge
Governance sets direction. Testing, awareness, intelligence and operations show whether it holds up in practice.
-
Governance, Risk & Compliance
How security programmes are governed, how risk is assessed and treated, and how frameworks turn into evidence.
-
Security Awareness Training
Building awareness programmes that change behaviour — and meet the training expectations written into major frameworks.
-
Penetration Testing
How authorised security testing is scoped, governed and reported, and how findings feed risk decisions.
-
Phishing Simulation Campaigns
Running ethical, consent-based phishing simulations that measure risk without punishing people.
-
Threat Intelligence
Turning threat information into decisions: intelligence requirements, sources, analysis and sharing.
-
Security Operations (SOC)
How security operations centres detect, triage and respond — and the reporting duties that follow an incident.
Compliance Academy
Start with the frameworks people ask about most
Each guide explains what the framework is, who it applies to, what it requires and what evidence looks like.
Law / regulation
EU AI Act
The European Union's binding, risk-based law for AI systems and general-purpose AI models, with obligations that vary by risk level and by role.
Law / regulation
GDPR
The EU's comprehensive data protection law, setting principles, lawful bases, individual rights and accountability duties for anyone processing personal data in its scope.
Certifiable standard
ISO/IEC 27001
The international, certifiable standard for building, running and continually improving an information security management system (ISMS).
Certifiable standard
ISO/IEC 42001
The first certifiable international standard for an AI management system (AIMS): how an organisation governs the AI systems it develops, provides or uses.
Voluntary framework
NIST CSF 2.0
NIST's voluntary, outcome-based framework for understanding, assessing, prioritising and communicating cybersecurity risk, organised into six functions including the new Govern function.
Cyber Intelligence
What changed, and what does it mean?
Short, sourced briefings on regulatory developments, enforcement and incidents, with clear next steps.
All briefings-
DPDP Rules: Consent Manager Provisions Commence in November 2026
One year after India notified the DPDP Rules 2025, Rule 4 on Consent Managers comes into force. Core Data Fiduciary obligations follow eighteen months after publication, in May 2027.
-
EDPB Publishes a Statement on the Data Protection Risks of Smart Glasses
The EDPB set out preliminary, non-binding views on smart glasses: wearers, makers and app providers can all be GDPR controllers, and bystanders need clear warning when recording is possible.
-
Dutch DPA Fines Uber EUR 824,990,000 Over Automated Driver Deactivations
The Dutch data protection authority fined Uber for unlawful solely automated decision-making and weak transparency under GDPR Articles 22 and 13. Uber has appealed.
-
EDPB Adopts Guidelines 04/2026 on When to Impose GDPR Fines
The EDPB adopted draft guidelines on when authorities should fine rather than use other corrective powers under the GDPR. Public consultation runs until 13 November 2026.
AI Governance & Privacy
AI and personal data are now governed by law, not just good intentions
The EU AI Act's obligations are phasing in, India's DPDP Rules reach their main compliance date in 2027, and certifiable standards such as ISO/IEC 42001 and ISO/IEC 27701 give organisations a way to organise the work. Our guides separate what is binding from what is voluntary.
Explore AI governance & privacy- DPDP Act (India) India's data protection law for digital personal data, made operational by the DPDP Rules, 2025, which come into force in phases until May 2027.
- EU AI Act The European Union's binding, risk-based law for AI systems and general-purpose AI models, with obligations that vary by risk level and by role.
- GDPR The EU's comprehensive data protection law, setting principles, lawful bases, individual rights and accountability duties for anyone processing personal data in its scope.
- ISO/IEC 42001 The first certifiable international standard for an AI management system (AIMS): how an organisation governs the AI systems it develops, provides or uses.
- ISO/IEC 27701 The international standard for a privacy information management system (PIMS). Since its 2025 edition it can be implemented and certified on its own, without ISO/IEC 27001.
- NIST AI RMF NIST's voluntary framework for managing the risks of AI systems, organised around four functions: Govern, Map, Measure and Manage.
- APPI Japan's data protection law, administered by the Personal Information Protection Commission, with mandatory breach reporting and cross-border transfer rules.
- CCPA / CPRA California's consumer privacy law, giving residents rights over their personal information and imposing duties on businesses that meet its thresholds.
- Kenya Data Protection Act Kenya's comprehensive data protection law, enforced by the Office of the Data Protection Commissioner, with registration and 72-hour breach notification.
- LGPD Brazil's general data protection law, closely modelled on the GDPR and enforced by the national data protection authority, the ANPD.
- NDPA Nigeria's data protection law, which established the Nigeria Data Protection Commission and set duties for data controllers and processors.
- PDPA (Singapore) Singapore's main personal data protection law, administered by the Personal Data Protection Commission, including mandatory breach notification.
- PIPA (South Korea) South Korea's comprehensive data protection law, overseen by the Personal Information Protection Commission and substantially amended in 2023.
- PIPEDA Canada's federal private-sector privacy law, built on ten fair information principles and overseen by the Office of the Privacy Commissioner of Canada.
- PIPL China's comprehensive personal information law, in force since November 2021, with strict rules on consent, sensitive information and cross-border transfers.
- POPIA South Africa's data protection law, built on eight conditions for lawful processing and enforced by the Information Regulator.
- Privacy Act 1988 (Australia) Australia's federal privacy law, built on 13 Australian Privacy Principles and the Notifiable Data Breaches scheme, administered by the OAIC.
- Privacy Act 2020 (New Zealand) New Zealand's privacy law, built on information privacy principles, with mandatory notification of serious privacy breaches, overseen by the Privacy Commissioner.
- Saudi PDPL Saudi Arabia's comprehensive personal data protection law, supervised by the Saudi Data and Artificial Intelligence Authority (SDAIA).
- UAE PDPL The UAE's federal personal data protection law, with separate regimes in financial free zones such as DIFC and ADGM.
- UK GDPR The United Kingdom's data protection framework: the retained GDPR plus the Data Protection Act 2018, enforced by the Information Commissioner's Office.
Insights & Resources
Latest explainers and guides
AI governance
Standards, Frameworks and Laws: Reading AI Governance Requirements Correctly
ISO/IEC 42001, the NIST AI RMF and the EU AI Act are often mentioned together. One is a certifiable standard, one a voluntary framework, one binding law — and that changes everything.
Practical guide
Breach Notification Clocks Compared: GDPR, India's DPDP Rules and HIPAA
72 hours, 'without delay', 60 days: how breach notification deadlines, thresholds and recipients differ under GDPR, the DPDP Rules 2025 and HIPAA — and how SOC teams should prepare.
Technical explainer
Penetration Test Scoping and Rules of Engagement: What a Good Test Plan Covers
Authorised penetration testing starts long before the first scan. What to agree on scope, authorisation, rules of engagement, reporting and retesting — and what frameworks like PCI DSS expect.
Comparison
SOC 2 vs ISO/IEC 27001: What Each One Actually Proves
SOC 2 is an attestation report; ISO/IEC 27001 is a management-system certification. How they differ in scope, evidence, audience and effort, and when you need both.
Recently reviewed
Checked against official sources
Every guide shows when it was last reviewed. These are the most recent.
- APPI Enacted in 2003; major amendments took effect in 2017 and April 2022, and further reform has been under review.
- CCPA / CPRA In force; CPPA regulations on automated decision-making technology, risk assessments and cybersecurity audits were adopted in 2025 with phased dates.
- CERT-In Directions In force since 28 June 2022, with FAQs issued by CERT-In clarifying scope.
- Cyber Resilience Act In force since 10 December 2024. Vulnerability and incident reporting applies from 11 September 2026; most other duties from 11 December 2027.
- DORA Applies since 17 January 2025, with detailed rules in regulatory and implementing technical standards.
- Essential Eight Maturity Model updated periodically by ASD; non-corporate Commonwealth entities are required to implement it under the Protective Security Policy Framework.
Behind MajorCyber™
Built by a practitioner, for practitioners
MajorCyber™ was founded by Major Shubham Sharma ("Sam"), a former Indian Army officer and cybersecurity GRC practitioner who holds the CISSP, CCSP and ISACA AAISM certifications and is a BSI-certified ISO/IEC 27001 Lead Implementer. The platform exists to make complex security, AI and privacy requirements understandable, accurately and without hype.