Privacy Map

India. Sectoral privacy. Rules (subordinate legislation)

IT Rules 2021Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021

In force
Partly verifiedMedium confidence. 'DPO required' reflects grievance officer duty for all intermediaries and Chief Compliance Officer/nodal/resident grievance officer for SSMIs. Original 2021 notification date from general knowledge.

§1Summary

Synopsis

Due-diligence code for intermediaries conditioning the IT Act s79 safe harbour: published terms, grievance officers, takedown on lawful orders and, for significant social media intermediaries, India-resident compliance officers and originator traceability for messaging. 2026 amendments require labelling and provenance metadata for AI-generated content and much faster removal.

Key themes
  • intermediary liability
  • safe harbour
  • grievance redress
  • content takedown
  • traceability
  • synthetic media labelling
  • deepfakes
Unique features

Mandatory permanent metadata/provenance identifiers on AI-generated content and 2-3 hour takedown windows; SSMIs must obtain and verify user declarations about synthetic content.

SaaS relevance

Any SaaS hosting or transmitting user content for Indian users is an intermediary and must meet due diligence (grievance officer, 7-day grievance resolution, takedowns) to retain safe harbour; AI content tools must label outputs.

§2Obligations

Extraterritorial
Yes
Breach notification
None (cyber incidents via CERT-In)
DPO
Conditional
Cross-border transfers
None
Maximum penalty
Loss of s79 safe harbour; liability under IT Act and other laws

§3Dates

Key dates
  • Adopted
  • In force
  • Amended 2022, 2023; Amendment Rules 2025 (notified Oct 2025, effective 2025-11-01) tightened takedown-notice authorisation; Amendment Rules 2026 (notified 2026-02-10, effective 2026-02-20) added synthetically generated information (SGI) labelling and cut takedown timelines (3h for court/government orders, 2h for non-consensual intimate/deepfake sexual content).

§4Text and authority

Text
Authority
Ministry of Electronics and Information Technology (MeitY)

§5Where it applies

Domestic law of
India

§6Sources and verification

Sources consulted
Verification

Medium confidence.

Partly verifiedMedium confidence. 'DPO required' reflects grievance officer duty for all intermediaries and Chief Compliance Officer/nodal/resident grievance officer for SSMIs. Original 2021 notification date from general knowledge.