The explosive growth of digital technologies in India has made the country extensively dependent upon cyberspace for communication, trade, governance, and the operation of critical infrastructure. While this has propelled economic growth and digital inclusion, it has also made people, organizations, and the state vulnerable to an extensive range of cyber threats from ransomware and phishing to AI-generated deepfake scams, vulnerabilities in IoT, and cross-border cyberattacks. Comprehensive legal and regulatory regimes backed by effective enforcement tools are needed to counter such threats. In this research, the three significant pillars of India’s cybersecurity governance are assessed: the Information Technology (IT) Act, the developing Data Protection Bill, and guidelines provided by the Indian Computer Emergency Response Team (CERT-In). The IT Act, 2000, and subsequent amendments formed the cornerstone of India’s cyber law regime, mainly aimed at electronic transactions, digital signatures, and cybercrime. Nevertheless, there are gaps in addressing new-age threats and the complexities of jurisdiction relating to such trans-boundary crimes. The Data Protection Bill that is set to be legislated is expected to ensure data protection, promote accountability among data fiduciaries, and safeguard individual privacy. Nonetheless, the bill faces opposition due to extensive exemptions available to government bodies and the challenge of balancing innovation and regulation. CERT-In guidelines provide technical guidance, reporting requirements for any cyber security threats, and coordinate the national response in case of a cyber disaster. There are nevertheless issues pertaining to enforcement, compliance, and institutional capability. This paper through the analysis of the merits, demerits, and complementarities of these measures has revealed some of the progress and gaps in the Indian cyber security framework. It is clear that whereas much has been achieved, future cyber threats require a more flexible, dynamic, and globalized approach. Recommendations have been made to ensure legal provisions are updated with emerging technologies, enhancing the institutional capabilities of CERT-In, and finding the right balance in the Data Protection Bill.