FortiWeb for DPDP, RBI and SEBI compliance — the WAF as a regulatory control

India's compliance landscape changed the question. It's not "do you have a WAF?" — it's "can you prove the WAF was the safeguard you claim it was, with logs, with timestamps, with chain of custody?" The DPDP Act, CERT-In's 6-hour clock, RBI's Cyber Security Framework, SEBI CSCRF and PCI DSS 4.0 each touch web-app protection from a different angle — but the operational answer across all five converges on the same control: an enforceable WAF with auditor-quality logging. This guide maps each regulator's requirement to the FortiWeb feature that satisfies it.

DPDP Act 2023 — what it actually demands

The Digital Personal Data Protection Act doesn't name a specific control. It places a continuing obligation on every Data Fiduciary under Section 8(5) to take "reasonable security safeguards" against personal-data breaches — and backs it with a Schedule penalty of up to ₹250 crore per instance for failure of those safeguards.

For any Data Fiduciary operating internet-facing applications that touch personal data, the WAF is the operational control most directly addressing the attack vectors that lead to those breaches at scale. The DPDP Rules (notified 2025-26) clarify the breach-notification process; FortiWeb's Threat Analytics provides the detection-side signal that feeds it.

CERT-In Direction No. 20(3)/2022 — the 6-hour reporting clock

CERT-In's Direction (28 April 2022) mandates incident reporting within 6 hours of becoming aware of a defined list of incident classes — including data breaches, unauthorised access, identity theft, and ransomware. It also requires 180 days of ICT-system log retention within Indian jurisdiction, with time synchronised to NPL or NIC NTP servers.

FortiWeb's role in this chain:

• Detection — the WAF generates the attack-attempt signal that the SOC team triages and escalates within the 6-hour window.
• Logs — forwarded to FortiAnalyzer (cloud or on-prem) with India-region storage. 180-day rolling retention default; configurable for longer.
• Time sync — appliance NTP configured to NPL / NIC sources per the Direction.
• Evidence package — incident reports can be generated in CERT-In format from FortiAnalyzer / FortiSOC.

RBI Cyber Security Framework for Banks

RBI's framework (DBS.CO.CSITE.BC.No.4083, June 2 2016 and successor circulars covering UCBs / NBFCs by category) mandates web application protection for internet-facing apps. WAF is treated as a baseline control under the framework's "Network security" and "Application security" control sets.

SEBI Cybersecurity and Cyber Resilience Framework (CSCRF)

SEBI's CSCRF (consolidated 2024 framework) covers market infrastructure institutions, stock brokers, depositories, mutual funds, AIFs and other regulated entities. WAF protection scales by entity categorisation. Specific control mapping varies — Ogma maps your entity category to the applicable CSCRF control set.

PCI DSS 4.0 — Client-Side Protection (a 2025 sea-change)

IRDAI Information & Cyber Security Guidelines

IRDAI's guidelines for insurance-sector entities include web application protection and 24×7 monitoring as control-set requirements. WAF deployment is standard practice for insurer-facing portals + claims systems.

The control mapping in one table

Compliance-ready FortiWeb deployment patterns

FAQ

Related: Fortinet SOCaaS for India compliance · FortiWeb deployment models · FortiWeb Managed WAF