Firms cannot simply instruct their IT departments to procure a tool and consider the job done, says the law minister