Cybersecurity as a Fiduciary Duty in Corporate Governance: Directors' Obligations Regarding Corporate Data Breaches in India

As Indian companies rely more and more on digital technology, Cybersecurity has grown from a technical concern into a key component of corporate governance. Corporate data breaches can cause business disruption, compromise of personal data, loss of investor confidence, and regulatory and financial liabilities. This article examines whether cybersecurity ought to be a fiduciary duty of directors in India. This article examines various provisions of the Companies Act, 2013, the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023, directions issued by the Indian Computer Emergency Response Team (CERT-In), and the Securities and Exchange Board of India (SEBI). Even though Indian law contains no explicit provision making cybersecurity a fiduciary duty, directors are subject to several duties that can be used to hold them accountable, including the duty of care, the duty of diligence, the duty of risk management, and the duty of legal compliance. It can therefore be concluded that effective corporate governance will require proportionate cybersecurity measures to be in place, clear records of directors' involvement, timely reporting of incidents, and transparent disclosure.