India's rapid digitalisation has been accompanied by a steep rise in cybercrime and growing exposure of personal data, while the legal response remains divided between an ageing criminal-law framework and a newly operationalised data protection statute. This paper examines how the Information Technology Act, 2000, the Bharatiya Nyaya Sanhita, 2023, and the Digital Personal Data Protection Act, 2023 jointly address offences against digital systems and the protection of personal information. Drawing on scholarly and professional literature published mainly between 2023 and 2026, it reviews the constitutional basis of privacy, the structure of cybercrime regulation, and the design of the new data protection regime. The evidence indicates that recorded cybercrime has expanded considerably, whereas convictions, investigative capacity, and cross-border cooperation have not kept pace. The data protection framework is a notable advance, yet commentators criticise its wide state exemptions, the absence of a separate category for sensitive data, and its limited response to algorithmic harms. Because its core duties take effect only in 2027, its real-world effectiveness cannot yet be measured. The paper concludes that coordinated reform, stronger institutional capacity, and independent oversight are needed to reconcile security and privacy objectives.