What the Rules are and where section 79 comes in
The Rules were made under sub-section (1) and clauses (z) and (zg) of sub-section (2) of section 87 of the Information Technology Act, 2000, and they superseded the Information Technology (Intermediaries Guidelines) Rules, 2011. They have three Parts: a preliminary part, Part II on due diligence by intermediaries and grievance redressal, and Part III on a code of ethics for digital media, which covers publishers of news and current affairs content and of online curated content and is administered by the Ministry of Information and Broadcasting.
Section 79(1) of the Act says that an intermediary is not liable for third party information, data or communication link made available or hosted by it. The protection depends on conditions: under section 79(2) the intermediary must act as a conduit, must not initiate the transmission, select the receiver or select or modify the information, and must observe due diligence and the guidelines that the Central Government prescribes. Under section 79(3) the protection is lost if the intermediary has conspired, abetted, aided or induced the unlawful act, or if on receiving actual knowledge, or on being notified by the appropriate Government or its agency, it does not expeditiously remove or disable access to the material.
The Rules are the guidelines in section 79(2)(c). Rule 7 provides that where an intermediary fails to observe the Rules, section 79(1) shall not apply to it and the intermediary is liable to punishment under any law in force, including the Act and the Bharatiya Nyaya Sanhita, 2023.
How the Supreme Court read section 79
In Shreya Singhal v. Union of India, [2015] 5 S.C.R. 963, the Supreme Court held section 79 to be valid and read down section 79(3)(b). The Court held that actual knowledge means knowledge that a court order has been passed asking the intermediary to remove or disable access to certain material, and that the order, or the notification by the appropriate Government or its agency, must strictly conform to the subject matters laid down in Article 19(2) of the Constitution. The Rules were read down in the same way. Rule 3(1)(d) now follows that structure: actual knowledge arises only through a court order or a reasoned intimation from an authorised officer. The judgment is summarised on the page on cyber law cases.
Due diligence under rule 3
An intermediary must publish its rules and regulations, privacy policy and user agreement in English or a language of the Eighth Schedule to the Constitution, and must make reasonable efforts to keep users from hosting, displaying, uploading or sharing certain information. The list in rule 3(1)(b) includes information that belongs to another person, that is obscene, pornographic, paedophilic or invasive of another’s privacy, that is harmful to a child, that infringes intellectual property, that deceives about the origin of a message or knowingly communicates misinformation, that impersonates another person, that threatens the unity, integrity, defence, security or sovereignty of India, that contains a software virus, and that violates any law in force.
Rule 3(1)(d) is the takedown rule. As updated on 10 February 2026 it requires an intermediary on whose resource the information used to commit an unlawful act is hosted, displayed, published, transmitted or stored to remove or disable access to it within three hours of actual knowledge under section 79(3)(b) of the Act. Actual knowledge arises only through a court order or a reasoned intimation in writing from an officer authorised by order in writing and not below the rank of Joint Secretary to the Government of India or equivalent, or a Director where no officer of that rank is appointed. Where the police administration issues the intimation, the authorised officer must be not below the rank of Deputy Inspector General of Police. The intimation must state the legal basis, the provision invoked, the nature of the unlawful act and the specific URL or location, and such intimations are reviewed every month by an officer not below the rank of Secretary. The clause was substituted by G.S.R. 775(E) of 22 October 2025, with effect from 15 November 2025, and the period was reduced from thirty-six hours to three hours by G.S.R. 120(E) of 10 February 2026.
The same rule requires an intermediary to preserve removed information and associated records for one hundred and eighty days for investigation, to retain registration information for one hundred and eighty days after a registration is cancelled, to follow the reasonable security practices of the 2011 Rules, to report cyber security incidents to the Indian Computer Emergency Response Team, and to provide information or assistance to a lawfully authorised agency within seventy-two hours of an order in writing.
The timelines at a glance
The table gives the periods in the Rules as updated on 10 February 2026, with the periods that applied before the 2026 amendment where they changed.
| Duty | Rule | Now | Before |
|---|---|---|---|
| Take down unlawful information after actual knowledge | Rule 3(1)(d) | Three hours | Thirty-six hours |
| Acknowledge a complaint to the Grievance Officer | Rule 3(2)(a)(i) | Twenty-four hours | Twenty-four hours |
| Resolve a complaint | Rule 3(2)(a)(i) | Seven days | Fifteen days |
| Act on a request to remove content in the categories of rule 3(1)(b) | Rule 3(2)(a)(i), first proviso | Thirty-six hours | Seventy-two hours |
| Remove intimate or impersonating content on a complaint by the individual | Rule 3(2)(b) | Two hours | Twenty-four hours |
| Remind users of the rules and the consequences of breach | Rule 3(1)(c) | At least once every three months | At least once every year |
| Preserve removed information and associated records | Rule 3(1)(g) | One hundred and eighty days | One hundred and eighty days |
| Give information or assistance to a lawfully authorised agency | Rule 3(1)(j) | Seventy-two hours of the order | Seventy-two hours of the order |
| Appeal to the Grievance Appellate Committee | Rule 3A | Within thirty days; decided in thirty days | Within thirty days; decided in thirty days |
How a user complains
Every intermediary must publish the name and contact details of its Grievance Officer prominently, on the home page or the home screen of the app or on a page directly reachable from it, together with the way to make a complaint. The Officer must acknowledge a complaint within twenty-four hours and resolve it within seven days. A request to remove content in the categories of rule 3(1)(b) must be acted on as expeditiously as possible and resolved within thirty-six hours, except where it concerns content that belongs to another person, that infringes intellectual property, or that violates a law, for which the general period applies.
Rule 3(2)(b) gives an individual a faster route for the most harmful content. Within two hours of a complaint by the individual, or by a person on her behalf, the intermediary must take all reasonable and practicable measures to remove or disable access to content that exposes the private area, shows full or partial nudity, shows a sexual act, or is in the nature of impersonation in electronic form, including artificially morphed images. An intermediary must provide a mechanism to receive these complaints and let the person give the details needed. For the steps to take after sextortion or a morphed image, see the page on reporting a cyber crime online.
If the Grievance Officer decides against the complainant or the time passes, rule 3A allows an appeal within thirty days to a Grievance Appellate Committee, which is a body of a chairperson and two whole-time members appointed by the Central Government. The appeal is conducted entirely online and the Committee endeavours to decide it within thirty calendar days.
Synthetic and AI-generated content
The 2026 amendment added a duty for intermediaries whose resources can be used to create or share synthetically generated information, which rule 2 defines as audio, visual or audio-visual information artificially or algorithmically created, generated, modified or altered using a computer resource so that it appears real and depicts a person or event in a way that is or is likely to be perceived as indistinguishable from a natural person or real-world event. Routine editing, enhancement and similar good-faith changes that do not materially alter the substance are excluded.
Under rule 3(3) the intermediary must deploy reasonable technical measures to stop such information that violates the law, including child sexual abuse material, non-consensual intimate imagery, obscene or sexually explicit material, false documents or false electronic records, content on explosives or arms, and content that falsely depicts a natural person or a real-world event in a way that is likely to deceive. Other synthetic information must be prominently labelled and embedded with permanent metadata or another provenance mechanism, including a unique identifier, to the extent technically feasible, and the intermediary must not allow the label or metadata to be removed. A significant social media intermediary must also require users to declare whether information is synthetically generated and verify the declaration with technical measures before it is displayed.
Additional duties of large platforms
A significant social media intermediary, which is a social media intermediary above a user threshold that the Central Government notifies, must appoint a Chief Compliance Officer who is a key managerial personnel or senior employee resident in India, a nodal contact person for round-the-clock coordination with law enforcement agencies and a Resident Grievance Officer, and must publish a compliance report every month showing the complaints received and the action taken. A significant intermediary that provides messaging services must enable the identification of the first originator of information when a court or the competent authority under section 69 orders it, only for offences related to sovereignty, security of the State, public order, or rape, sexually explicit material or child sexual abuse material punishable with imprisonment of not less than five years, and only where less intrusive means are not effective. It is not required to disclose the contents of any message.
How current this text is
The Rules were first notified as G.S.R. 139(E) of 25 February 2021. The text summarised here is the consolidated version published by the Ministry of Electronics and Information Technology and updated on 10 February 2026, which includes the changes made by G.S.R. 794(E) of 28 October 2022, G.S.R. 275(E) of 6 April 2023, G.S.R. 775(E) of 22 October 2025 and G.S.R. 120(E) of 10 February 2026, as corrected by G.S.R. 148(E) of 26 February 2026. The Ministry has published draft amendments for comment, on 30 March 2026, including a further change to the labelling requirement in rule 3(3)(a)(ii), and a draft is not part of the Rules. A reader who needs the position on a particular date should check the Gazette notifications issued after 10 February 2026.
Frequently asked questions
What are the IT Rules 2021?
They are the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, made under section 87 of the Information Technology Act, 2000. Part II sets the due diligence that intermediaries such as social media platforms must observe and the grievance system they must run, and Part III sets a code of ethics for publishers of news and online curated content.
How quickly must a platform remove unlawful content?
Rule 3(1)(d) as updated on 10 February 2026 requires removal or disabling of access within three hours of actual knowledge. Actual knowledge arises only through an order of a court of competent jurisdiction or a reasoned written intimation from an authorised officer of the appropriate Government or its agency who is not below the rank of Joint Secretary or equivalent, or, where there is none, a Director.
How fast must a platform act on intimate images or impersonation?
Under rule 3(2)(b) the intermediary must, within two hours of a complaint by the individual or a person on her behalf, take all reasonable and practicable measures to remove or disable access to content that exposes the private area, shows full or partial nudity, depicts a sexual act, or is in the nature of impersonation in electronic form, including artificially morphed images.
What happens to an intermediary that does not follow the Rules?
Rule 7 provides that where an intermediary fails to observe the Rules, section 79(1) of the IT Act does not apply to it, and it is liable to punishment under any law in force, including the IT Act and the Bharatiya Nyaya Sanhita.
What if the grievance officer does not resolve my complaint?
Rule 3A lets a person who is aggrieved by a decision of the Grievance Officer, or whose grievance is not resolved within the period in the Rules, appeal to a Grievance Appellate Committee within thirty days. The appeal is conducted online and the Committee endeavours to resolve it within thirty calendar days.