Anti-bribery, sanctions and compliance in India

Full guide · Source-checked research98% of statements checked against a source107 checked against an official source34 checked against a secondary sourceChecked 2026-10-19Not yet professionally reviewed

• The Directorate of Enforcement under the Ministry of Finance enforces FEMA, including the foreign investment rules.

  Central rule.Department for Promotion of Industry and Internal Trade (DPIIT), Foreign Investment Facilitation Portal · checked 2026-10-18

• Commercial banks apply the Reserve Bank of India (Commercial Banks – Know Your Customer) Directions, 2025, shown as updated as on 1 October 2026.

  Separate KYC directions apply to small finance, payments, local area, regional rural and co-operative banks. Central rule (RBI).Reserve Bank of India · checked 2026-10-18

• On a personal data breach, a Data Fiduciary must notify the Data Protection Board and each affected Data Principal in the prescribed form and manner.

  Section 8(6) of the DPDP Act; in force from 13 May 2027.India Code (Legislative Department, Ministry of Law and Justice) · checked 2026-10-18

• The Schedule to the DPDP Act sets maximum penalties of Rs 250 crore for failing to take reasonable security safeguards, Rs 200 crore for failing to notify a breach, Rs 200 crore for breaching children's data obligations, Rs 150 crore for breaching significant data fiduciary obligations and Rs 50 crore for other breaches by a Data Fiduciary.

  Imposed by the Data Protection Board after inquiry; penalties apply once the relevant obligations commence (13 May 2027).India Code (Legislative Department, Ministry of Law and Justice) · checked 2026-10-18

• CERT-In issued cyber security directions on information security practices and the reporting of cyber incidents dated 28 April 2022, effective 60 days after issue.

  Issued under section 70B(6) of the Information Technology Act 2000; apply to service providers, intermediaries, data centres, body corporates and government organisations. Specific reporting deadlines not confirmed from an official page.Vikaspedia (Government of India portal, MeitY/C-DAC) · checked 2026-10-18

• Failure to notify a notifiable combination can attract a penalty of up to one per cent of the total turnover or assets, or of the value of the transaction, whichever is higher.

  Section 43A of the Competition Act as substituted by the Competition (Amendment) Act 2023.Competition Commission of India · checked 2026-10-18

• Giving or promising an undue advantage to another person with the intention of inducing or rewarding a public servant's improper performance of a public duty is an offence punishable with imprisonment of up to seven years, a fine, or both.

  Section 8, Prevention of Corruption Act 1988, as substituted in 2018. 'Undue advantage' means any gratification other than legal remuneration (section 2(d)). Central law.Legislative Department, Ministry of Law and Justice (India Code) · checked 2026-10-19

• The bribe-giving offence does not apply to a person who was compelled to give the undue advantage, provided that person reports the matter to the law enforcement authority or investigating agency within seven days of giving it.

  First and second provisos to section 8(1), Prevention of Corruption Act 1988. A separate exception covers a person acting after informing an investigating agency in order to assist its investigation. Central law.Legislative Department, Ministry of Law and Justice (India Code) · checked 2026-10-19

Read the full guide: Banking, foreign exchange and repatriation · Data protection, cyber security and digital compliance · Anti-bribery, financial crime and compliance governance