QUANTUM-RESISTANT INFRASTRUCTURE: LEGAL IMPERATIVES FOR POST- QUANTUM CRYPTOGRAPHY UNDER INDIA'S CYBER LAW FRAMEWORK

Abstract

The progress in quantum computing technology creates a risk to India's digital security systems which depend on asymmetric cryptography because it enables attackers to collect encrypted Aadhaar and banking and critical infrastructure data for future decryption. The Information Technology Act, 2000 permits digital signature use under Section 5 but fails to require post-quantum cryptography (PQC) implementation which leaves systems exposed until NIST establishes quantum-resistant algorithm
standards. The Digital Personal Data Protection Act 2023 requires organizations to implement "reasonable security practices" but it does not provide protection against quantum threats which creates problems for evidence collection in Bharatiya Sakshya Adhiniyam 2023 because quantum-vulnerable records that have been tampered with will not be admitted as evidence. This article investigates the statutory deficiencies which exist in IT Rules 2021 and CERT-In directives while showing how India approaches cybersecurity protection differently from the EU NIS2 and US Quantum Computing Cybersecurity Preparedness Act systems. The article proposes three legislative changes which include (i) PQC migration timelines for critical sectors; (ii) risk-based audits; and (iii) liability for non-compliance. India can establish itself as a leader in quantum-resilient cyber law by combining neuro-technology data protection which is susceptible to quantum decryption with existing space cybersecurity regulations. Cybercrime conviction rates will remain low because they stay below 10% while cyber threats continue to rise unless legislators implement new cybercrime laws. This research connects doctrinal examination with policy support to create a quantum-secure digital ecosystem for India.