Resources Categories
INDUSTRY FACT FILE · MEDIA, ENTERTAINMENT & DIGITAL PLATFORMS
Industry Overview: Media, Entertainment and Digital Platforms in India
Who creates, distributes and monetises content in India, the obligations that apply, who buys cybersecurity and why each type of media business needs a distinct approach.
|
In this document 1. Why media and platform cybersecurity matters now 2. The ecosystem at a glance 3. Categories of media, entertainment and digital platform businesses 4. The regulatory, policy and standards framework at a glance 5. Government, regulatory and private participants 6. Who buys cybersecurity inside a media business or platform 7. Why each type of media business needs a different approach 8. How Codec Networks works with media, entertainment and platform businesses |
|
Sector scope Sector: broadcasters and distribution platforms, OTT streaming, news publishers, advertising technology, film and music production, gaming and esports, social and creator platforms. Primary service proposition: platform and API security, content protection, account security, privacy and brand monitoring. Telecom, retail, education and IT services have separate fact files. |
1. Why media and platform cybersecurity matters now
India's media and entertainment sector grew about 9 per cent to ₹2.78 trillion in 2025, according to the FICCI-EY Media & Entertainment Report published in March 2026. Digital media became the largest segment and the first to cross ₹1 trillion, digital advertising rose about 26 per cent to roughly two-thirds of all advertising revenue, and live events grew faster than any other segment. Around that core sit television broadcasters and the DTH and cable operators that distribute them, OTT services that stream live sport and original series to crores of viewers, news publishers whose audiences now arrive through apps and social feeds, advertising-technology firms that buy and sell attention in milliseconds, film and music studios with valuable catalogues, gaming and esports companies, and social and creator platforms that pay lakhs of creators.
|
₹2.78 trillion India's media and entertainment sector in 2025 (FICCI-EY) |
₹1 trillion+ Digital media revenue in 2025, now the largest segment |
₹22,400 crore Lost to piracy in India in 2023 (EY-IAMAI) |
6 hours To report cyber incidents to CERT-In |
The business now runs on software. Rights deals and scripts move through email and deal rooms; production and post-production run on shared drives, edit suites, VFX vendors and render farms; finished content passes through asset-management systems, encoding pipelines, digital rights management and forensic watermarking; distribution depends on playout servers, conditional access and subscriber management systems, CDNs, smart-TV and mobile apps and game servers; and revenue depends on subscriber and player accounts, payment integrations, ad servers, SDKs and audience data. Scale makes this exposure unusual. JioHotstar reported a record 6.12 crore peak concurrent viewers for the ICC Champions Trophy final in March 2025, so a login, payment or streaming failure on a big night happens in front of an audience the size of a large country.
The consequences are well documented. The EY-IAMAI piracy report estimated that piracy cost Indian entertainment about ₹22,400 crore in 2023, with about half of media consumers admitting to using pirated sources. Abroad, the Sony Pictures attack of November 2014, attributed by the FBI to North Korea, leaked unreleased films and executive email; the Twitch leak of October 2021, which the company traced to a server configuration error, exposed source code and creator payout data; Sinclair Broadcast Group confirmed in October 2021 that ransomware had disrupted local television stations across the United States; Roku said in April 2024 that about 576,000 accounts had been accessed through credential stuffing; and the Rhysida group leaked internal files from Sony's Insomniac Games studio in December 2023. At home, courts have repeatedly protected actors' personality rights against AI-generated misuse, beginning with Anil Kapoor's case in the Delhi High Court in September 2023.
In India the obligations are layered. CERT-In's Directions require cyber incidents to be reported within six hours and ICT logs to be kept for 180 days, and its 2025 audit policy guidelines expect risk-based independent audits. The IT Rules 2021 set due-diligence duties for intermediaries and a Code of Ethics for digital news and OTT publishers administered by the Ministry of Information and Broadcasting; an amendment in force since 20 February 2026 requires labelling of synthetically generated content and action on lawful takedown orders within three hours. TRAI's interconnection regulations require distributors' conditional access and subscriber management systems to be audited; the Cinematograph (Amendment) Act, 2023 created offences for unauthorised recording and exhibition of films; the Promotion and Regulation of Online Gaming Act, 2025, in force with its Rules since 1 May 2026, bans online money games and promotes e-sports and social games; the DPDP Act and Rules govern viewer, subscriber, player and children's data, with most obligations from May 2027; and listed media companies disclose cyber incidents under SEBI's LODR Regulations.
|
Key takeaway In media, cybersecurity protects the content, the audience and the brand at the same time. Release windows, live events, subscriber and player accounts, and the faces and voices of talent are all targets, so platforms, supply chains, accounts and reputations must be protected together. |
2. The ecosystem at a glance
Figure 1: India's media, entertainment and digital platforms ecosystem.
3. Categories of media, entertainment and digital platform businesses
|
Category |
Who they are |
Typical ownership |
Key regulatory basis |
|
Broadcasters and TV networks |
General entertainment, news, sports and regional channels with playout, newsrooms and ad sales |
Listed groups, private companies, public broadcaster |
MIB permissions; Cable Television Networks Act and Rules; CERT-In; SEBI LODR if listed |
|
Distribution platform operators |
DTH, multi-system operators, HITS and IPTV running conditional access and subscriber systems |
Listed and private companies, local cable operators |
MIB registration; TRAI interconnection and audit regulations; CERT-In; DPDP |
|
OTT streaming services |
Subscription, advertising-led and free streaming of film, series and live sport |
Broadcaster-owned, telecom-backed and global platforms |
IT Rules 2021 Code of Ethics (MIB); DPDP; CERT-In; Copyright Act |
|
News publishers |
Print, television and digital-only newsrooms, video and podcast networks |
Family-owned groups, listed companies, start-ups |
IT Rules 2021 Code of Ethics for digital news; Press Council norms; CERT-In; DPDP |
|
Advertising technology |
Ad servers, SSPs, DSPs, ad networks, measurement and audience-data platforms |
Indian and global technology firms, agency groups |
DPDP; IT Act; ASCI codes; client contracts; CERT-In |
|
Film and music production |
Studios, production houses, post-production, VFX, dubbing and music labels |
Private and listed companies, independent producers |
Copyright Act; Cinematograph Act as amended 2023; CBFC certification; CERT-In |
|
Gaming and esports |
Game developers and publishers, social and casual games, esports organisers and teams |
Venture-backed and listed companies, global studios |
Online Gaming Act 2025 and Rules 2026; DPDP incl. children; IT Rules; CERT-In |
|
Social and creator platforms |
Short-video, social, community, live-streaming and creator-monetisation platforms |
Indian and global platforms, many venture-backed |
IT Rules 2021 incl. significant social media intermediary duties; 2026 synthetic-content rules; DPDP; CERT-In |
4. The regulatory, policy and standards framework at a glance
|
Instrument or expectation |
What it means for media businesses and platforms |
|
CERT-In Directions (28 April 2022) |
Cyber incidents reported within six hours of noticing them; ICT logs kept for a rolling 180 days in India; clock synchronisation; designated point of contact |
|
CERT-In audit policy guidelines (25 July 2025) |
Risk-based, independent cyber audits covering infrastructure, cloud and applications, with closure of findings—relevant to platforms, broadcast IT and production networks |
|
IT Rules 2021 and amendments |
Intermediary due diligence, grievance redressal and added duties for significant social media intermediaries; a Code of Ethics and three-tier grievance structure for digital news and OTT publishers; from 20 February 2026, labelling of synthetically generated content and action on lawful takedown orders within three hours |
|
Cable Television Networks (Regulation) Act 1995 and Rules |
Programme and advertising codes, registration of operators and a three-tier grievance structure for television content added in 2021 |
|
TRAI interconnection regulations (addressable systems) |
Security and functional requirements for conditional access and subscriber management systems, fingerprinting and set-top boxes, with annual audits by BECIL or TRAI-empanelled auditors |
|
Copyright Act 1957 and Cinematograph (Amendment) Act 2023 |
Copyright and technological-measure protection; offences for unauthorised recording and exhibition of films with imprisonment of three months to three years and fines of up to 5 per cent of audited gross production cost; MIB nodal officers act on piracy complaints |
|
Promotion and Regulation of Online Gaming Act 2025 |
Ban on offering, advertising and processing payments for online money games; promotion of e-sports and online social games; Online Gaming Authority of India; Act and Rules in force from 1 May 2026 |
|
DPDP Act 2023 and DPDP Rules 2025 |
Notices, consent, safeguards, retention limits and breach intimation for viewer, subscriber, player and creator data; verifiable parental consent and no tracking or targeted advertising directed at children; most obligations from May 2027 |
|
SEBI LODR Regulations (listed companies) |
Cyber security incidents, breaches and loss of data disclosed in the quarterly corporate governance report since July 2023 |
|
How these apply Cyber obligations are cross-sector and depend on licence, registration, intermediary status, audience and listing; content, gaming and piracy laws apply to the businesses named in them. Confirm against the official instruments and your agreements. |
5. Government, regulatory and private participants
- The Ministry of Information and Broadcasting grants broadcast permissions, administers the Code of Ethics for digital news and OTT publishers, appoints anti-piracy nodal officers and blocked 18 OTT platforms for obscene content in March 2024.
- TRAI regulates broadcasting tariffs and interconnection and sets the audit regime for conditional access and subscriber management systems; BECIL and TRAI-empanelled auditors perform those audits.
- MeitY and CERT-In set intermediary duties, the 2026 synthetic-content rules and cyber obligations; the Online Gaming Authority of India, under MeitY, oversees online gaming from May 2026; the Data Protection Board will enforce DPDP.
- The Department of Sports is the nodal body for e-sports, recognised as part of multi-sport events in December 2022; CBFC certifies films.
- Broadcasters, DPOs, OTT services, publishers, studios, labels, gaming companies and platforms create and distribute content, backed by listed groups, telecom operators, global media companies and venture investors.
- Cloud, CDN, DRM, post-production, ad-tech and payment vendors carry content and audiences between them, and are often the weakest link in the chain.
6. Who buys cybersecurity inside a media business or platform
|
Stakeholder |
What they care about |
What they buy |
|
Board, CEO and CFO |
Revenue, release windows, advertiser and investor confidence, disclosure |
Board advisory, resilience programmes, crisis exercises |
|
CTO, CIO and CISO |
Platform, broadcast and cloud security, audits, vendor risk |
Audits, assessments, SOC, GRC programmes |
|
Head of broadcast operations and playout |
Uptime, signal integrity, playout and CAS security |
Broadcast network assessment, segmentation, recovery planning |
|
Product and engineering leads |
App, API, login and game-server security, release speed |
VAPT, DevSecOps, bot defence, cloud posture |
|
Content operations and anti-piracy teams |
Screeners, asset stores, vendors, DRM and leaks |
Content-security programme, vendor reviews, leak tracing |
|
Editors, newsroom heads and talent managers |
Source protection, journalist and anchor accounts, deepfakes |
Account hardening, brand monitoring, awareness |
|
Privacy, legal and ad-revenue teams |
Viewer, player and children's data, ad-tech consent, contracts |
DPDP programmes, SDK and ad-tech reviews |
7. Why each type of media business needs a different approach
|
Business type |
Highest-consequence risk |
Starting point for assurance |
|
Broadcasters and DPOs |
Ransomware taking channels off air; CAS and SMS compromise |
Segmentation of playout from IT, CAS and SMS audit readiness, SOC |
|
OTT streaming services |
Credential stuffing at live events, API data exposure, restreaming piracy |
Login and API testing, bot defence, DRM review, surge monitoring |
|
News publishers |
Deepfakes of anchors, account hijack, DDoS and defacement |
Account hardening, brand monitoring, web resilience, awareness |
|
Advertising technology |
Malvertising through partner tags, ad fraud, unlawful audience data use |
Tag and SDK governance, DPDP programme, API testing |
|
Film and music production |
Pre-release leaks through vendors and screeners; ransomware at post houses |
Vendor assessments, watermarking, asset-store controls, backups |
|
Gaming, esports and creator platforms |
Player data exposure, DDoS, cheating, creator account takeover, children's data |
Game and API testing, DDoS readiness, DPDP for minors, SOC |
8. How Codec Networks works with media, entertainment and platform businesses
Codec Networks is a CERT-In empanelled information security auditing organisation certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For media, entertainment and digital platform businesses we deliver web, mobile, smart-TV, API and game-server testing, credential-stuffing and bot-defence assessments, content supply chain and vendor reviews with DRM and watermarking checks, DPDP programmes for viewer, player and children's data, brand and deepfake monitoring with evidence for takedowns, CERT-In-aligned audits and TRAI audit readiness, and 24x7 managed SOC with surge cover for premieres and live events—planned around the release calendar and connected from finding to closure.
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. It is not legal or regulatory advice. Obligations differ by licence, registration, intermediary status, listing status, audience and contracts; confirm them against the official CERT-In, MeitY, MIB, TRAI, SEBI and Online Gaming Authority instruments and your own agreements.