Twelve Indian regimes and what each asks of your software

Authority: Ministry of Electronics and Information Technology (MeitY). Act text.

The Act covers digital personal data. It sets rules on consent, the purpose of collection, how long data is kept, and what each person may demand about their own data. The DPDP Rules, 2025 were notified in November 2025.

Brihat's design practice: consent is stored as a record with a time and a purpose, and erasure is built to reach reports, search indexes and backups too. The model carries retention and purpose limits from the start. The DPDP checklist for websites and forms covers the website side in full.

Authority: Reserve Bank of India. Master Direction, 10 April 2023, in force from 1 October 2023.

A regulated entity that hands IT work to a vendor keeps the responsibility. The Direction asks for audit rights over the provider and its sub-contractors, prior approval for sub-contracting, an exit strategy, and data stored in India as the entity's rules require.

For software:

• The supplier works in accounts the bank or lender owns, which keeps audit and exit possible.
• Every sub-processor is listed before the contract.
• Exit material (code, data, runbooks) is part of the delivery.

Authority: Reserve Bank of India. Circular of 6 April 2018.

Payment system providers must store the full data of each payment in India. Only the foreign leg of a transaction may also be stored abroad.

For software:

• The hosting region is chosen first.
• Backups, disaster-recovery copies and analytics copies of payment data stay in India too.
• A managed service whose regions you cannot see needs a separate check.

Authority: National Payments Corporation of India. NPCI.

A bank, payment service provider or app joins these rails through the sponsor bank or provider and follows NPCI's onboarding and testing steps. Brihat's experience is that reconciliation and dispute handling take most of the effort.

For software:

• The certification slot, not the build estimate, sets the launch date.
• Reconciliation and dispute flows are built in the first release.
• A change to a live integration can need fresh testing, so releases are planned around it.

Authority: GST Council and the tax authorities. Portals: e-invoice and e-way bill.

For e-invoicing, a business submits each B2B invoice to the Invoice Registration Portal, which returns an invoice reference number, a digitally signed e-invoice and a QR code. An e-way bill accompanies goods in transit.

For software:

• The invoice flow includes the portal round trip and a path for failure, so an invoice is never lost when the portal is slow.
• The e-way bill is generated at despatch and reconciled to the invoice.
• At volume, this is an integration with retries and reconciliation, not a form.

Authority: Department of Expenditure (GFR), Government e-Marketplace, and STQC, an office of MeitY.

The General Financial Rules set the buying procedure for central departments. Rule 149 makes buying through GeM compulsory for goods and services GeM lists (GFR 2017 as amended to July 2024, copy hosted by IIT Kanpur). STQC offers software testing, information security testing and website quality certification.

For software:

• The tender's evaluation scheme is read before the proposal is drafted.
• Security testing and audit trails are planned from the first design, because a citizen-facing system is checked before go-live.
• Hosting follows the department's MeitY policy.

Authority: NABH (under the Quality Council of India) and the National Health Authority, which runs ABDM.

NABH accredits hospitals; accreditation is voluntary. ABDM is the national digital health programme. What modern hospital management software must do in India covers the requirements.

For software:

• Patient records are complete and stay retrievable for the period the hospital's policy sets.
• ABHA linking and consent sharing sit beneath the patient record, not beside it.
• Reports an auditor asks for come out of the system.

See replacing a legacy HIS.

Authority: US Food and Drug Administration. 21 CFR 11.10.

Part 11 covers electronic records and signatures in FDA-regulated manufacturing, which includes export-facing pharma units. Section 11.10 asks for validated systems, secure time-stamped audit trails that do not hide earlier entries, and records kept retrievable for their whole retention period.

For software:

• Audit trails are designed in at the start.
• Each release logs its changes and the person who approved them.
• Validation evidence is delivered with the system.

Authority: International Financial Services Centres Authority, set up in 2020 and based at GIFT City. It took over work that RBI, SEBI, PFRDA and IRDAI had handled there.

For software:

• Reports go to IFSCA, in its formats and on its calendar, not to the mainland regulator.
• A mainland banking design needs checking line by line before reuse.
• Hosting and data-flow decisions follow IFSCA's rules.

Authority: State real-estate regulatory authorities under the Real Estate (Regulation and Development) Act, 2016.

Developers register projects and file periodic updates. Each state sets its own format and timing; one ICAI chapter guide describes quarterly updates under Section 11(1) (ICAI WIRC note).

For software:

• A developer in three states files into three portals.
• Construction progress, sales and finance data have to agree before filing.
• Every filed figure traces back to its records.

Authority: Central Electricity Authority and the Ministry of Power. The Revamped Distribution Sector Scheme (RDSS) funds prepaid smart metering and loss reduction; a Rajya Sabha answer of 10 March 2025 records its sanctions and targets.

For software:

• Meter data retention follows the metering rules.
• Loss-reduction claims need evidence the system can produce.
• Generation, transmission and billing figures have to reconcile.

Brihat's field-operations work for a state utility is described in the energy case study.

Authority: Ministry of Micro, Small and Medium Enterprises, under the MSMED Act, 2006, with Section 43B(h) of the Income-tax Act.

As summarised by ClearTax, Section 15 of the MSMED Act requires a buyer to pay a micro or small supplier by the agreed date, no later than 45 days under a written agreement and 15 days without one. Section 43B(h), added in 2023, ties the tax deduction to paying on time.

For software:

• Payables ageing tracks each supplier's current MSME class.
• Due dates come from the agreement on file.
• Reports list unpaid amounts to small suppliers.

Security review, dependency audit and a pen test sit in the Prove phase before launch. Data location and sector rules are settled in discovery. For Brihat's own posture, see trust and security.