India’s CERT-In Rules Logging Time Sync and Registrar Obligations

In April 2022, India’s Computer Emergency Response Team, known as CERT-In, issued a set of directives that dramatically reshaped the compliance landscape for entities operating in India’s digital ecosystem, including registrars, hosting providers, virtual private network services, and other intermediaries. These rules, intended to bolster cybersecurity and incident response, highlight the increasingly interventionist role of states in regulating the naming and hosting infrastructure of the internet. For domain name registrars in particular, the obligations imposed by CERT-In touch not only on operational procedures but also on broader questions of privacy, sovereignty, and the relationship between national regulation and global multistakeholder norms. The rules regarding mandatory logging, time synchronization, and extensive reporting duties reflect India’s determination to centralize control over digital assets and activities, with significant implications for registrants, investors, and international businesses.

One of the most consequential aspects of the CERT-In directives is the requirement for detailed logging. Entities covered under the directives must maintain logs of system activities for a minimum of 180 days and, upon request, submit them to CERT-In. For registrars, this obligation extends to records of domain transactions, customer data, and potentially the resolution of disputes. The emphasis is on retaining forensic visibility over every action that could be linked to security incidents or cybercrime. The scope is broad, and the directives do not always specify the granularity of logging expected, leading to uncertainty about whether registrars must capture and retain not only transaction-level data but also administrative and operational metadata. From the government’s perspective, this creates a reservoir of evidence that can be drawn upon during investigations, but from the registrar’s perspective, it raises storage, privacy, and compliance costs that are difficult to absorb.

Closely tied to logging is the requirement for time synchronization. CERT-In has mandated that all covered entities synchronize their system clocks with those maintained by India’s National Informatics Centre or National Physical Laboratory, or, alternatively, with Network Time Protocol servers traceable to them. The reasoning behind this directive is straightforward: accurate and uniform timestamps are crucial for forensic correlation across logs from multiple entities. If a registrar’s logs say an incident occurred at 10:05:32 and an ISP’s logs say 10:06:00, investigators may face difficulty in piecing together the sequence of events. By mandating synchronization with a national standard, India seeks to ensure that investigators can rely on consistent timelines when reconstructing cyber incidents. Yet this technical requirement also has political undertones, as it anchors India’s digital infrastructure to domestically managed time servers, symbolically reinforcing the state’s authority over digital forensics. Critics worry that centralization of time sources could create vulnerabilities, either through technical misconfigurations or through the potential manipulation of time data by the authorities themselves.

Registrar obligations under the CERT-In rules go far beyond technical logging and synchronization. Registrars are now required to collect and maintain detailed customer information, including validated names, contact details, and in many cases, identification documents. The directives insist that this information be retained even after the domain registration has expired, for a period of five years. This obligation effectively transforms registrars into custodians of extensive registrant databases, raising concerns about data protection, misuse, and the administrative burden of compliance. For global registrars operating in India, this presents a clash with other privacy regimes such as the European Union’s GDPR, which emphasizes data minimization and the right to erasure. The retention requirements of CERT-In effectively override such principles within India’s jurisdiction, creating legal contradictions that multinational registrars must carefully navigate.

The mandatory incident reporting requirements also alter the role registrars play in India’s cybersecurity framework. CERT-In now obliges entities to report a wide array of incidents within six hours of detection, including data breaches, unauthorized access, malware attacks, denial-of-service incidents, and more. Registrars must therefore develop capabilities to monitor not only their own systems but also potentially suspicious patterns in domain registrations that could indicate abuse. This implicitly places registrars in a law enforcement-adjacent role, expanding their function from mere technical intermediaries into active surveillance and compliance agents. For many smaller registrars, lacking the resources of global giants, this represents a significant operational burden, forcing them to either invest in compliance infrastructure or exit the Indian market altogether.

The directives have sparked heated debate within India’s technology sector and internationally. Proponents argue that the rules are necessary in an era of escalating cyber threats, ransomware campaigns, and state-sponsored attacks. They highlight the importance of coordinated responses and centralized visibility, noting that India’s growing digital economy cannot afford prolonged vulnerabilities or opaque incident reporting. For a government managing the data of over a billion citizens and an expanding digital payments ecosystem, the case for stronger oversight is persuasive. Yet critics warn that the directives grant sweeping surveillance capabilities to the state, eroding privacy and chilling free expression. The combination of mandatory data retention, real-name registrant verification, and rapid reporting obligations creates a system where anonymity and independence online are significantly curtailed.

The global implications of India’s CERT-In directives are profound. As one of the world’s largest internet markets, India’s policies set precedents that other states may follow. If registrars and other intermediaries adapt their global systems to accommodate Indian rules, they may normalize practices of extensive logging and customer verification, effectively raising the baseline of global compliance. Conversely, if global actors resist, India may deepen its reliance on domestic providers more willing to accept the government’s terms, furthering trends toward digital sovereignty and decoupling. This tension mirrors broader geopolitical currents, where states seek greater control over internet infrastructure even at the cost of fragmentation. For investors in domain names and digital infrastructure, India’s rules represent a signal that market opportunities must be balanced against rising compliance risks.

The CERT-In directives also highlight the delicate interplay between technical requirements and political ambitions. Logging and time synchronization are presented as technical necessities, but they serve political functions as well, anchoring infrastructure within national control. Registrar obligations to verify and retain customer data align with broader state goals of surveillance and social management. The result is a regulatory framework that strengthens national capacity at the expense of the global, multistakeholder ethos that has historically defined domain governance. Whether this shift enhances security or erodes trust remains contested, but what is clear is that registrars are now at the frontline of India’s experiment in digital sovereignty.

Over time, the effectiveness of the CERT-In rules will depend on implementation. If the government uses its expanded visibility judiciously, focusing on genuine cyber threats and offering support to registrars, trust in the system may grow. If, however, the rules are weaponized for political surveillance, censorship, or arbitrary enforcement, registrars may face reputational damage and registrants may seek alternative pathways, such as foreign proxies or decentralized naming systems, to evade oversight. The balance between enforcement and restraint will determine whether India’s directives are seen as a model of cyber defense or as a cautionary tale of overreach.

Ultimately, India’s CERT-In rules on logging, time synchronization, and registrar obligations reflect the broader trajectory of internet governance in the twenty-first century. They are a manifestation of a state asserting sovereignty over its digital domain, demanding that intermediaries align their operations with national priorities. For registrars and investors, they underscore the need to treat regulatory landscapes not as afterthoughts but as central factors in domain strategy. The age when registrars could operate purely as neutral technical intermediaries is ending; in its place is an era where they are deeply entangled with national security imperatives, political control, and the shifting balance between global connectivity and territorial governance.

In April 2022, India’s Computer Emergency Response Team, known as CERT-In, issued a set of directives that dramatically reshaped the compliance landscape for entities operating in India’s digital ecosystem, including registrars, hosting providers, virtual private network services, and other intermediaries. These rules, intended to bolster cybersecurity and incident response, highlight the increasingly interventionist role of…