Technology law in India is best understood as a small shelf of statutes standing in front of a very large and constantly rearranged cabinet of rules. A reader who opens the statute book expecting to find the law that governs a social media platform, a blocked website, a tapped telephone call or a leaked database will usually leave with the wrong answer, because the operative obligation in each of those cases sits not in an Act of Parliament but in rules, directions or notifications made under one. The Acts supply the skeleton: a general statute for electronic records and computer offences, a statute for the national identity number, a statute for personal data, a statute for telecommunication services, and a regulator’s statute that holds the telecom settlement together. The flesh, and most of the muscle, is delegated legislation, and it changes by notification in the Gazette rather than by debate in Parliament.

That single structural fact explains nearly every confusion the field produces. Examination candidates memorise the Information Technology Act, 2000 and then cannot locate the grievance officer a platform must appoint, because that duty was created by rules in 2021 and amended by rules in 2022. Businesses instruct counsel to read the data protection statute and then miss the incident reporting duty that binds them within six hours, because that duty was imposed by directions issued by the computer emergency response team under a different section of a different instrument’s logic. Journalists report that Parliament has tightened the law on online news when in fact Parliament has done nothing of the kind and a ministry has amended a rule. The discipline this guide teaches is therefore a routing discipline: for any technology law question, identify the class of question first, then find the instrument that actually governs it, then check whether that instrument is an Act, a rule made under an Act, a direction issued under a rule’s parent section, or a judgment that has read the whole arrangement down. The findable artifact in the middle of this guide, a table that routes eight standard questions to their governing instruments, is the field in one glance.

The claim that organises everything that follows can be stated plainly. The statute is the smaller half of Indian technology law. The general statute at the field’s centre has been amended substantively once in a quarter of a century, while the rules made under it have been replaced wholesale, amended in part, stayed by courts, and supplemented by directions, and an entire second layer of data protection law has been switched on by notification in stages. A reader who follows Parliament to understand this field will miss almost everything that has actually changed in it. A reader who follows the Gazette will not. The series to which this guide belongs has repeatedly found operative Indian law hiding in delegated instruments, in commencement notifications never issued and in rules that quietly replace the scheme a statute announces. In technology law the displacement is close to total, and it is the reason the same parent statute has been able to govern first a dial-up economy of internet cafes and digital signature certificates and then a smartphone economy of streaming video, instant payments and platform power, without Parliament rewriting it.

None of this means the Acts are unimportant. It means their importance is of a particular kind. The Acts decide who may make the rules, which body enforces them, what the maximum penalty architecture looks like, and where the constitutional limits run. The Constitution decides whether any of it survives challenge. The courts, in a series of interventions that this guide treats at headline level because specialist articles own them, have repeatedly supplied the procedural safeguards that the statutes omitted and have struck or read down the parts of the structure that crossed the constitutional line. What follows takes the layers in order: the constitutional floor, the short shelf of statutes, the deep cabinet of rules, the regulators who work the machinery, the reach of the whole apparatus beyond India’s borders, the powers of the state that attract the hardest argument, the Bills that were never enacted, the debate about governing a fast field by notification, and finally a method for navigating the field that a compliance officer, a researcher or an examination candidate can reuse.

The constitutional floor beneath technology law in India

Every technology law question in India is, at one remove, a question about three constitutional provisions and one entry in the Union List. The first is the guarantee of freedom of speech and expression in Article 19(1)(a), read with the exhaustive list of grounds on which that freedom may be restricted by law in Article 19(2): the sovereignty and integrity of India, the security of the State, friendly relations with foreign States, public order, decency or morality, contempt of court, defamation and incitement to an offence. The list matters because it is closed. When the Supreme Court struck down the offence of sending offensive messages through a communication device, the decisive point was that the provision’s categories, grossly offensive, menacing, annoying, inconvenient, did not correspond to any head in Article 19(2) and could not be saved by relabelling them as public order. Every content regulation in the rules layer, from blocking directions to the digital media ethics code, is ultimately tested against that closed list, and the recurring judicial question is whether a restriction dressed as procedure is in substance a restriction on speech that must find its warrant in Article 19(2) or fall.

The second provision is Article 21, the guarantee that no person shall be deprived of life or personal liberty except according to procedure established by law. A nine judge bench of the Supreme Court held in the Puttaswamy judgment of August 2017 that privacy is protected as an intrinsic part of the right to life and personal liberty and as part of the freedoms guaranteed by Part III, overruling the contrary suggestions in the older eight judge and six judge decisions. Privacy in that holding is not a single interest but a family of them: bodily integrity, decisional autonomy, and informational privacy, the last of which is the branch that governs data. The judgment also supplied the test by which a privacy invasion is justified, a proportionality inquiry asking whether the measure rests on law, pursues a legitimate aim, bears a rational connection to that aim, and is necessary in the sense that no equally effective and less restrictive alternative exists, with procedural safeguards against abuse. That test, owned in this series by the article on the Puttaswamy judgment, is the standard against which the Aadhaar architecture was measured in the second Puttaswamy decision, against which interception regimes are defended, and against which the exemptions in the data protection statute will be argued. The third provision is quieter: Article 19(1)(g), the freedom to practise a profession and carry on a trade or business, which is the ground on which platforms, internet service providers and app developers challenge obligations that make their business model unlawful or unviable, and which featured in the challenges to the prohibition style directions and to internet suspensions.

The competence question, who may legislate at all, is answered by Entry 31 of the Union List in the Seventh Schedule, which gives Parliament exclusive power over posts and telegraphs, telephones, wireless, broadcasting and other like forms of communication. The closing words, other like forms of communication, have carried the entry from the telegraph wire to the internet without amendment, and together with the residuary power in Article 248 and Entry 97, which assigns to Parliament every matter not enumerated in the State or Concurrent Lists, they explain why technology legislation in India is almost entirely Union legislation. A computer network is not an entry in any list; the lists were written before it existed. Parliament’s authority over the field is therefore doubly founded, on the communications entry for networks and carriage and on the residuary entry for the rest, and state legislatures have almost no room to make technology statutes of their own, though, as a later section shows, they retain a large operational role through the police power.

Two consequences of this constitutional floor deserve emphasis before the statutes are reached. The first is that internet restrictions are constitutional events, not administrative weather. When the Supreme Court considered the communications restrictions imposed in Jammu and Kashmir in Anuradha Bhasin in January 2020, it held that the freedom of speech and expression and the freedom of trade through the internet enjoy constitutional protection, that restrictions must satisfy the proportionality standard, that orders suspending services must be published and reasoned, and that an indefinite suspension is impermissible. The second is that the floor is policed by courts working case by case, because the statutes themselves contain few internal safeguards of the kind the Constitution demands. The pattern recurs throughout this guide: a power is conferred in broad terms by an Act, exercised through rules, and disciplined, if at all, by a judgment that reads in the safeguards of publication, necessity, proportionality and review. A reader who knows only the constitutional floor will understand the arguments in every technology dispute in India, even before opening a single statute.

The historical sequence: four settlements in a century and a half

The field’s structure becomes intelligible when it is read as a sequence of settlements, each struck for the technology of its moment and each leaving deposits the next had to work around. The first settlement was the telegraph settlement of the colonial state. The Indian Telegraph Act, 1885 vested in the government the exclusive privilege of establishing telegraphs and the power to license others to do so, and armed it with the interception power on the occurrence of a public emergency or in the interest of public safety that later jurisprudence would spend a century disciplining. The Indian Wireless Telegraphy Act, 1933 added a possession offence for wireless apparatus, completing a framework whose unit of regulation was the instrument and whose instinct was control of the means of communication by licence. That framework governed, almost unamended in conception, the arrival of the telephone exchange, the mobile phone and the internet service provider, because the statutory word telegraph was read, by amendment and interpretation, to cover every successive apparatus. The longevity is itself the lesson: a definition drafted for wires carried the field until 2023 because Parliament repeatedly chose to stretch the old statute rather than write a new one, a preference for continuity over codification that the field has never lost.

The second settlement was the electronic commerce settlement of 2000. By the late nineteen nineties the policy problem had changed character. India had software exporters, a growing outsourcing industry and a government committed to electronic governance, and the obstacle was not control but validity: an electronic record was not obviously a document, an electronic signature was not obviously a signature, and a contract concluded by an exchange of data messages was not obviously enforceable. The statute of 2000 answered with the technique of functional equivalence, borrowed from the United Nations model law: an electronic record satisfies a legal requirement of writing if it is accessible for subsequent reference, an electronic signature satisfies a requirement of signature if it meets the reliability conditions, and the originator, the addressee, the time of dispatch and the time of receipt are all fixed by deeming rules. Around that core the statute amended the Indian Evidence Act, 1872 to admit electronic records through a certification regime, amended the Bankers’ Books Evidence Act, 1891 and the Reserve Bank of India Act, 1934, and left the criminal law of computers as a modest schedule of offences and compensations at the margin. Read against its moment, the Act of 2000 was a trade and governance statute with a security appendix, and its institutional imagination was correspondingly narrow: a Controller of Certifying Authorities, a Cyber Regulations Advisory Committee, and an appellate tribunal for the Controller’s orders.

The third settlement was the security settlement of 2008, and it reversed the proportions. The amendment of that year, moved through Parliament in days in the aftermath of a terrorist attack and debated scarcely at all, kept the commercial core and rebuilt everything around it: the intermediary safe harbour in its modern form, the interception and blocking powers with their rules to follow in 2009, the compensation liability for negligent handling of sensitive personal data, the catalogue of offences addressed to the communication device, and the statutory charter of the emergency response team. From 2009 the centre of gravity of the information technology statute sat not in its first chapters, on validity, but in its later ones, on power. The litigation settlement that followed belongs to the same period and completes it: in 2015 the Supreme Court struck down the speech offence the amendment had created and read the safe harbour into constitutional shape, and in 2017 the privacy judgment rebuilt the foundation under the whole structure. By the end of that decade the field had acquired, largely from the courts, the constitutional discipline its statutes lacked.

The fourth settlement is the platform and data settlement, and it is the only one of the four that Parliament did not make. Between 2011 and 2025 the operative law of platforms, of content, of incident response and of personal data was written by the executive: intermediary guidelines in 2011 replaced by the far larger rules of 2021, ethics codes for digital media in the same instrument, appellate committees in 2022, incident directions in 2022, and the data rules of 2025 switching on, in tranches, the one major statute of the period that Parliament did enact, in 2023, alongside the telecommunications statute of the same year that finally retired the telegraph settlement. The sequence explains the present map. Two of the field’s four settlements were legislative, one was substantially judicial, and the fourth, the one under which the field is actually lived, was administrative. A thematic guide exists to make that distribution visible, because no statute book, organised Act by Act, will show it.

The liberalisation decade: how the state stopped being the only network

Between the telegraph settlement and the commerce settlement lies a decade that a purely statutory history understates, because its instruments were policies and licences rather than Acts, and it is the decade in which the field’s modern shape was decided. Public internet access arrived in India in August 1995 through the state carrier, and the National Telecom Policy of 1994 had already opened basic services to private licensees, breaking the department’s monopoly in principle before the technology made the break real. The consequences arrived in sequence. Private licensees required a regulator that was not also their competitor and licensor, and after the courts and the sector had exposed the cost of the department’s triple role, the statute of 1997 created the Authority; the disputes between the new private operators and the state required a tribunal, and the amendment of 2000 supplied it by dividing the Authority’s functions. The New Telecom Policy of 1999 then moved the sector from fixed licence fees to revenue sharing, rescuing an industry the first settlement had nearly bankrupted, and the whole rearrangement was accomplished by policy statements, licence amendments and two statutory interventions, a rehearsal for the field’s later preference for governing by instrument below the level of the Act. The decade also fixed the field’s jurisdictional instincts: that carriage is a Union subject worked by a specialist regulator, that the department licenses and the Authority regulates and the Tribunal decides, and that the private network is the normal case and the state network the exception, propositions so settled by 2000 that the commerce statute could be written for a field of private actors without anyone remarking on the reversal from 1885, when the private telegraph was the exception the state tolerated. The statutes on the shelf are unintelligible without this decade, because the institutions that work them, and the assumptions about who provides networks and who merely governs them, were formed in it. It also supplies the guide’s recurring caution in historical form: the decisive instruments of the decade included a policy, a licence condition and a revenue sharing migration package, none of them legislation, and a history of Indian technology law confined to its Acts would record the decade as nearly empty, which is the opposite of the truth.

The short shelf: the statutes of technology law in India

The statutory layer of the field consists, in the main, of five instruments, and the first discipline of the subject is to know what each of them is for and what each conspicuously does not do. The oldest and most general is the Information Technology Act, 2000, Act 21 of 2000, which received assent in June 2000 and came into force on 17 October 2000. It was drafted on the foundation of the Model Law on Electronic Commerce adopted by the United Nations Commission on International Trade Law in 1996, and its original centre of gravity was commercial: to give legal recognition to electronic records and electronic signatures so that contracts, filings and documents would not fail for being paperless, to facilitate electronic governance, and to amend the evidence, banking and penal statutes so the recognition held across the legal system. Around that commercial core it built a small set of computer offences and a compensation regime for unauthorised access and data damage, and it created a Controller of Certifying Authorities to license the bodies that issue signature certificates.

Which single statute is the general technology law of India?

The Information Technology Act, 2000 is the general statute of the field. As amended in 2008, it is the instrument that recognises electronic records and signatures, creates the computer offences, houses the intermediary liability settlement, and confers the interception and blocking powers, and it is the parent Act under which most of the operative rules are made.

The Act a reader meets in practice is, however, largely the Act as rebuilt by its one great amendment. The Information Technology (Amendment) Act, 2008, enacted as Act 10 of 2009 after receiving assent on 5 February 2009 and brought into force on 27 October 2009, was passed by Parliament in the weeks after the Mumbai terrorist attacks of November 2008 and at speed, and it changed the parent statute’s character. It moved the signature regime from digital signatures to the broader, technology neutral idea of electronic signatures. It rewrote the intermediary provision, Section 79, into the safe harbour form the field still argues about. It inserted the interception, monitoring and decryption power in Section 69 and the blocking power in Section 69A. It inserted Section 43A, which made a body corporate that is negligent in maintaining reasonable security practices with sensitive personal data liable to pay compensation, and thereby created the hook on which India’s first data protection rules were hung. It added offences addressed to identity theft, impersonation, privacy violation and cyber terrorism, and it gave statutory recognition to the Indian Computer Emergency Response Team. The depth of all of this, provision by provision, belongs to the statute’s own pillar in this series, the complete guide to the Information Technology Act, 2000, and to the amendment article that follows it; the point for the map is that the 2008 amendment is the moment the e-commerce statute became the speech, security and surveillance statute as well, without changing its name, its number or its commercial opening chapters.

How many times has the IT Act been substantially amended?

Once. The amendment of 2008, brought into force in October 2009, is the only rebuilding the Act has received. Later changes have been marginal, and the most consequential later event in the Act’s life is a subtraction it has not yet undergone: the data protection statute of 2023 provides for the omission of Section 43A when its amendment provision commences.

The second statute on the shelf answers a different question, not what the law of electronic activity is but who a person is to the state when transacting with it. The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016, Act 18 of 2016, gave a statutory basis to the Aadhaar number, a twelve digit unique identity number issued by the Unique Identification Authority of India, which had been enrolling residents since 2009 on executive authority alone. The Act of 2016 regularised the Authority, defined enrolment and authentication, confined the purposes for which the number could be demanded, and attached offences to the misuse of identity information; the constitutional challenge to the whole architecture, and the Supreme Court’s answer upholding the statute in part while striking down or reading down several of its provisions, is one of the set pieces of Indian public law. The detail belongs to the explainer on the Aadhaar Act, 2016; for the map, Aadhaar matters as the field’s identity layer, the instrument to consult when the question is authentication, and as the standing example of a technology programme that ran for years before its statute arrived, reversing the usual sequence.

The third statute is the field’s newest general law and its second centre of gravity. The Digital Personal Data Protection Act, 2023, Act 22 of 2023, which received assent on 11 August 2023, is India’s first freestanding data protection statute, built on a deliberately spare architecture of consent and specified legitimate uses, obligations on the data fiduciary who determines the purpose and means of processing, rights for the data principal whose data it is, a new enforcement body in the Data Protection Board of India, and penalties calibrated in crores rather than in prosecutions. Its relationship with the older law is transitional and, for a period, doubled: the compensation provision of the information technology statute under which the 2011 security practices rules were made continues until the new Act’s amending provision, which omits that section, is brought into force, and the new Act itself commences in stages by notification rather than all at once. The statute’s own treatment in this series, the guide to the Digital Personal Data Protection Act, 2023, owns its provisions; here it is enough to fix its place as the instrument that governs the processing of digital personal data, a subject the older Act touched only through a negligence based compensation clause and a set of rules.

The fourth statute is the youngest and, in one respect, the most dramatic, because it is the field’s great repeal. Telecommunications in India was governed for nearly a century and a half by the Indian Telegraph Act, 1885 and, for wireless apparatus, by the Indian Wireless Telegraphy Act, 1933, two colonial instruments whose licensing concept, the telegraph, had been stretched to cover the telephone, the mobile network and the internet itself. The Telecommunications Act, 2023, Act 44 of 2023, which received assent in December 2023, replaced them: Section 60 of the new Act repeals the Indian Telegraph Act, 1885 and the Indian Wireless Telegraphy Act, 1933, subject to savings for licences, assignments and actions taken under the repealed law, and the new statute rebuilds the sector on an authorisation model, under which an entity that wishes to provide telecommunication services or establish a network takes an authorisation from the Centre rather than begging a licence under a Victorian definition, with spectrum assigned in the main by auction and, for specified purposes, administratively. The full account of that rebuilding, and of the new Act’s own interception and emergency powers, belongs to the explainer on the Telecommunications Act, 2023, which owns the repeal sentence in this series; the map needs only the routing fact, that questions about providing telecom services, spectrum, right of way for networks and the obligations of carriers go to the 2023 Act and not to the statute book’s oldest survivor.

The fifth instrument is the regulator’s charter. The Telecom Regulatory Authority of India Act, 1997, Act 24 of 1997, created the Telecom Regulatory Authority of India as the sector’s specialist regulator, with recommendatory functions on licensing and technology and regulatory functions on tariffs and interconnection, and, by an amendment in 2000 that split the Authority’s adjudicatory role away, created the Telecom Disputes Settlement and Appellate Tribunal as the forum for disputes between licensor and licensee, between service providers, and between providers and groups of consumers, and as the appellate body for the sector. The telecommunications statute of 2023 amended this Act’s framework rather than repealing it, so the institutional pair of Authority and Tribunal survives the change of the substantive law, a continuity worth noticing in a field where the ground rules are otherwise so mobile. Around these five instruments sit older and adjacent statutes that a complete map should acknowledge without mistaking for the core: the Cable Television Networks (Regulation) Act, 1995 for cable services, the Cinematograph Act, 1952 for film certification, the general penal and procedural codes that supply offences the technology statutes do not, and the sectoral laws of banking, payments and securities whose regulators write technology rules of their own. The shelf is short. Everything else in the field is rules.

Inside the general statute: a chapter map in prose

Because the information technology statute is the field’s parent instrument, a reader needs its internal geography, and the geography explains the field’s later growth. The opening chapters perform the validity settlement: definitions, the recognition of electronic records and electronic and digital signatures, the attribution and dispatch and receipt rules for electronic records, and the provisions for electronic governance, filing, retention and audit in government. The middle chapters build the signature infrastructure and its regulator, the Controller of Certifying Authorities, the licensing of certifying authorities and the duties of subscribers, a part of the Act that consumed much of its original length and operates quietly beneath the economy’s document flows. Then come the chapters the field actually litigates: the regulation of certifying authorities gives way to the chapter on duties of subscribers, the chapter of penalties and compensation headed by Section 43, the chapter of offences headed by the tampering and computer related offence provisions and containing the speech offence that was struck down, the safe harbour chapter in substance if not in arrangement, and the closing chapters on the powers of interception, blocking and monitoring, on critical information infrastructure, which empowers the Centre to declare protected systems whose unauthorised access is an offence of a graver order, on the emergency response team, and on the rule-making powers themselves. The Act’s own order is thus a fossil record: commerce first, crime and power later, and the rules, hung on sections distributed across that record, inheriting its priorities. A reader who opens the Act expecting the platform rules to be near the intermediary section will find the section and nothing else, the rules being elsewhere entirely, in a Gazette notification the Act does not print. That experience, repeated by every newcomer to the field, is the human form of this guide’s thesis.

The statute’s silences are as significant as its contents, and the map should mark them. The Act contains no general right to privacy and no general data protection code, which is why the subject had to be bolted on in 2008 as a compensation clause and finally legislated separately in 2023. It contains no law of platform content as such, no classification regime for streaming, no ethics code for news, all of which arrived by rule in 2021. It contains nothing addressed to artificial intelligence, to algorithmic recommendation, to the dark patterns of interface design that consumer law has since taken up by its own rules under the consumer protection statute, or to the governance of non-personal data, which a government committee proposed to regulate and no statute has. It does not create the field’s appellate tribunal in its modern form, that having been rearranged by a finance Act, nor does it house the identity system, the payments system or the health data system that run on its validity provisions. The parent Act is therefore best pictured not as the field’s code but as its trellis: the structure on which a quarter century of rules, directions, sectoral codes and judgments has grown, in directions the trellis’s makers did not plant.

The working concepts: the definitions that do the routing

In a field organised by instrument, the definitions are the switches, because which regime governs a dispute usually turns on which defined term captures the actor or the act. Five concepts do most of the switching, and each is defined in a different place, which is itself a map lesson. The intermediary is the information technology statute’s central figure: an entity that, on behalf of another person, receives, stores or transmits an electronic record or provides a service with respect to it, a definition whose illustrations run from telecom and network service providers through web hosts, search engines, online marketplaces and payment systems to cyber cafes. The breadth of the definition is the reason the safe harbour in Section 79 and the diligence rules beneath it reach so far into the economy, and the reason a business that thinks of itself as a retailer or a broadcaster discovers that, for a class of questions, the law treats it as a conduit for other people’s content. The second concept is the pair at the heart of the data statute: the data principal, the individual to whom personal data relates, and the data fiduciary, the person who determines the purpose and means of processing it, with the data processor acting on the fiduciary’s behalf. The fiduciary concept, borrowed from the language of trust but stripped of most trust law, is what allocates the statute’s obligations, and the boundary between fiduciary and processor, both defined in the Act of 2023 and glossed in its rules, is the first question in most data disputes.

The third concept is the electronic record itself, defined in the information technology statute in terms of data and images generated, sent, received or stored in electronic form, and paired with the electronic signature that replaced the narrower digital signature in 2008; between them they carry the validity settlement of the year 2000 into every contract, filing and notice in the economy. The fourth is the pair of terms on which the telecommunications statute of 2023 is built, telecommunication, the transmission of messages by wire, radio, optical or electromagnetic systems, and the telecommunication service and network through which it is provided, defined so that the authorisation regime attaches to the service and not to the Victorian apparatus. The definitional choice was the reform: where the telegraph statute had licensed an instrument, the new statute authorises an activity, and the argument about whether internet based communication services fall within the activity is an argument about these definitions, conducted in consultations and submissions because the Act’s text is where the question will be decided. The fifth concept is the consent manager of the data statute, a registered entity accountable to the data principal through which consent may be given, managed, reviewed and withdrawn, an institutional invention without real parallel elsewhere in Indian law, whose operating rules arrive with the second tranche of the 2025 commencement.

Two consequences follow from the definitional map. The first is that classification disputes are the field’s characteristic litigation posture: whether a marketplace is an intermediary for the goods sold on it, whether a messaging service must trace an originator, whether a body is a fiduciary or only a processor, whether a communication application is a telecommunication service. Each dispute is, on its face, about a definition, and in substance about which regime, with which obligations and which regulator, captures the defendant. The second is that the definitions are amended at different speeds. The statutory definitions move only when Parliament acts; the thresholds and glosses that give them practical content, the user number that makes an intermediary significant, the classes of fiduciary notified as significant with added obligations, move by notification, so that even the switches of the system are partly in the rules layer, and a classification answer that was right when a commentary was printed may be wrong when the dispute arrives.

The enforcement architecture: compensation, offences and penalties

A field map that stopped at instruments and institutions would still leave the working question unanswered: when something goes wrong, what kind of proceeding follows, before whom, and with what consequence. The technology statutes answer that question in three different idioms, and the differences are a reliable guide to the era of each statute. The information technology statute works in the oldest idiom, a deliberate split between compensation and crime. The acts of interference it catalogues in Section 43, unauthorised access, downloading, introducing a contaminant, damaging a system, disrupting service, denying access, assisting another to do any of these, are framed as civil wrongs attracting compensation, adjudicated not by the ordinary courts in the first instance but by adjudicating officers appointed under the statute, officers of the state information technology administration, with jurisdiction over claims up to a ceiling of five crore rupees fixed by the section itself and the civil courts taking the larger claims. The same conduct, when done dishonestly or fraudulently, crosses into the criminal chapter and becomes an offence punishable with imprisonment, investigated by the police in the ordinary way. The architecture expresses a judgment of the year 2000 about computer misuse: that most of it is a matter of loss to be paid for, and only the dishonest core of it is crime. Around that split the statute builds the standard machinery, compounding of contraventions, penalties for failures such as a company’s default in furnishing information to the Controller or the emergency response team, and a residuary penalty provision for contraventions no other clause captures.

The data protection statute works in a second idiom, the regulatory penalty. It creates almost no offences at all. Breach of its obligations by a data fiduciary is met by monetary penalties imposed by the Data Protection Board after inquiry, expressed in the statute’s schedule in sums that run to two hundred and fifty crore rupees for the failure to maintain reasonable security safeguards, with the Board directed to weigh the nature, gravity and duration of the breach, the type of data affected, the repetitive character of the conduct and the gains made or losses avoided. The model is the modern regulatory one familiar from securities and competition law: a specialist board, a digital by design proceeding, penalties calibrated to turnover scale harm rather than to moral fault, and appeals to a tribunal. The contrast with the parent field is instructive and deliberate. Where the statute of 2000 criminalised the misuse of computers by individuals, the statute of 2023 declines to criminalise the misuse of data by companies and prices it instead, on the theory that the defendant’s conduct is commercial and the deterrent should be financial.

The telecommunications statute works in a third idiom, mixed and older in feel: criminal offences for the unauthorised provision of services and for unlawful interception, civil penalties and adjudication for breaches of authorisation conditions, and an adjudicating officer and appellate structure borrowed from the sector’s existing tribunal arrangement. The Aadhaar statute, for its part, protects the identity system primarily through offences, unauthorised access to the central database, impersonation at enrolment, disclosure of identity information, with penalties of imprisonment and fine, reflecting its character as the defence of a single state asset. The map value of the comparison is practical. The same real world event, a hospital database copied and offered for sale, engages the compensation and offence provisions of the information technology statute, the penalty schedule of the data statute once in force for the fiduciary’s defaults, the incident directions of the emergency response team, and, if a carrier’s network was the route, nothing in the telecom statute at all. Routing the event correctly across the three idioms is the skill the field demands, and it cannot be got from any one statute’s text.

One more feature of the enforcement architecture deserves a place on the map, because it is where readers most often misjudge the field: the near absence of private litigation as its engine. The compensation route under the information technology statute exists and has produced adjudicating officer orders, but the volume is small beside the scale of computer misuse, and the data statute gives the individual rights against the fiduciary that are enforced, in the main, by complaint to the Board rather than by suit. The field’s real enforcement energy sits with the state: with the police working the offences, with the ministries working the rules, and with the platforms themselves, whose grievance machinery under the Rules of 2021 disposes of more technology disputes in a month, by volume, than every forum in this section combined. A map of Indian technology law that showed only courts and tribunals would misrepresent where the law is applied, which is, overwhelmingly, inside the compliance departments of the intermediaries the rules conscript.

The rules layer: where the operative law of technology sits

To understand the rules layer, a reader first needs the mechanics of rule-making itself, because the mechanics explain the mobility. The information technology statute, like most Indian statutes, confers rule-making power on the Central Government in a general provision, Section 87 in that Act, and the rules made under it take effect on publication in the Official Gazette, subject to being laid before Parliament, which may modify or annul them but in practice almost never does. The consequence is a legislative process measured in weeks rather than sessions, staffed by the ministry rather than by Parliament, and concluded by notification rather than by vote. Every one of the field’s operative regimes has been built this way, and each deserves to be fixed on the map with its parent section, because the parent section is what a court examines when the rule is challenged.

The first regime a compliance reader meets is the oldest of the modern set. Section 43A of the information technology statute, inserted in 2008, made a negligent body corporate liable to compensate for wrongful loss caused by failure to maintain reasonable security practices in handling sensitive personal data, and under it the Centre made the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Those rules defined the sensitive categories, passwords, financial information, health conditions, biometric information and others, prescribed the security standards a body corporate was expected to maintain, and regulated collection, disclosure and transfer. For more than a decade this modest apparatus, a compensation clause and a single set of rules, was the whole of India’s enacted data protection law, a fact worth dwelling on because it shows how much of the field’s history is the history of rules carrying weight their parent clause was never designed to bear. The rules were made to be replaced by the 2023 data statute and its own rules, and the transition between the two regimes, clause by clause, is a subject the data protection articles own.

The second regime governs the platforms. The intermediary settlement in Section 79 of the information technology statute gives an intermediary, the entity that receives, stores or transmits electronic records on behalf of another, an exemption from liability for third party content, conditional on observing due diligence as prescribed. What due diligence means has never been in the Act. It was first prescribed by the Information Technology (Intermediaries Guidelines) Rules, 2011, and then, a decade later, by their wholesale replacement, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, notified on 25 February 2021. The 2021 Rules are the field’s central example of legislation by notification. They oblige every intermediary to publish its rules, to appoint a grievance officer and to resolve complaints within fixed timelines. They create a heavier tier, the significant social media intermediary, identified by a user threshold of fifty lakh registered users notified by the Centre, and load it with additional duties: a chief compliance officer, a nodal contact person and a resident grievance officer in India, monthly compliance reports, and an obligation, in its original contested form, to enable traceability of the first originator of a message. And in their third part they step outside the intermediary framework altogether, subjecting publishers of online curated content, the streaming services, and publishers of news and current affairs content to a code of ethics and a three tier grievance structure whose apex sits in the Ministry of Information and Broadcasting. None of that architecture is in the parent Act, which speaks of intermediaries and due diligence and says nothing about news publishers or film classification; it exists because a rule said so. An amendment in October 2022 added Grievance Appellate Committees, appointed by the Centre, to hear appeals from the decisions of platforms’ grievance officers, inserting the state into the appellate chain of private content moderation. When a dispute arises about a takedown, a suspension or a grievance unanswered, the analysis of the Shreya Singhal judgment and free speech is where this series keeps the constitutional reading of the intermediary settlement, for it was that judgment which held that the safe harbour’s knowledge condition could be triggered only by a court order or a government direction under the blocking power, and not by private complaint alone.

The third and fourth regimes are the state’s eyes and hands. The blocking power in Section 69A of the information technology statute, exercisable where the Centre is satisfied it is necessary in the interests set out in that section, which track the Article 19(2) grounds, is operated through the Information Technology (Procedure and Safeguards for Blocking for Access of Information by Public) Rules, 2009. Those rules route a blocking request through a designated officer and an inter-ministerial committee, provide for an emergency route with post-decisional confirmation, require the originator or intermediary to be heard where identifiable, and then, by a confidentiality rule, forbid disclosure of the requests and the directions themselves, which is why lists of blocked sites surface through leaks and litigation rather than through publication. The interception power in Section 69 is operated through the Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009, which confine the direction to competent authorities at the Centre and the states, require reasons recorded in writing, set destruction schedules for intercepted material, and provide for a review committee of senior officials, a structure consciously modelled on the safeguards the Supreme Court had devised in the nineteen nineties for telephone tapping under the Telegraph Act in the PUCL case. Both regimes share the family trait: the Act confers the power in a page, and the rules decide how, by whom, with what record and with what review it is actually used.

Does a blocked website get a court hearing in India?

Not before the block takes effect. Blocking under Section 69A runs through an executive committee under the rules of 2009, the affected party is heard where identifiable, and the confidentiality rule keeps the direction itself undisclosed. The hearing a blocked publisher actually gets is a later one, in a writ petition before a High Court.

The fifth regime arrived not as rules at all but as directions, which is a step further down the ladder of legislative formality. The Indian Computer Emergency Response Team, CERT-In, is the agency designated by Section 70B of the information technology statute for cyber security incident response, and sub-section (6) of that section empowers it to issue directions to service providers, intermediaries, data centres, body corporates and government organisations. On 28 April 2022 CERT-In issued directions under that power, effective from 27 June 2022, that rewired the incident side of the field: specified classes of cyber incident must be reported to CERT-In within six hours of being noticed, logs of information and communication technology systems must be retained for a rolling period of one hundred and eighty days, system clocks must be synchronised to the Network Time Protocol servers of the National Informatics Centre or the National Physical Laboratory, and data centres, virtual private server and cloud providers and virtual private network services must maintain validated subscriber and usage records for five years. A company’s most time critical technology law obligation is thus found neither in a statute nor in rules laid before Parliament, but in directions issued by an agency under a single sub-section, which is the purest illustration in the field of the article’s central claim.

The sixth regime is the newest, and it shows the technique reaching maturity. The data protection statute of 2023 was enacted in August of that year and then waited, because its own commencement clause left the bringing into force of its provisions to notification. The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025, and with them the commencement notifications that switch the Act on in tranches: the institutional provisions at once, the consent manager provisions after a year, and the substantive obligations of data fiduciaries, with the rights of data principals and the penalty schedule, in May 2027. A statute passed by Parliament in 2023 therefore becomes the working law of data in 2027, on dates fixed by the executive, under rules written by the executive, in a sequence that no reader of the Act alone could discover. Between the 2011 security practices rules that governed data under the old dispensation and the 2025 rules that govern it under the new one lies the whole method of the field: replace the rule, not the Act, and let notification do the work of legislation.

Who watches the rule makers: the thin oversight of delegated law

The rules layer’s legitimacy depends on its controls, and the map should state honestly how thin most of them are. The formal control is parliamentary laying: rules under the information technology statute are to be laid before each House for a total of thirty days, during which either House may agree to modify or annul them, and Parliament maintains a committee on subordinate legislation charged with examining whether delegated power has been exercised within its bounds. The practical record is that annulment is a rarity across Indian delegated legislation generally, that the laying period commonly runs without debate on the instrument at all, and that the committee’s scrutiny, though real, is retrospective and recommendatory. The second control is consultation, which has hardened by practice rather than by statute into an expectation that draft rules of consequence will be published for comment; the field’s own history shows both the practice working, in the data rules that moved between a draft in January 2025 and notification in November of that year after thousands of submissions, and the practice failing, in the broadcasting draft circulated to a selected list and withdrawn amid objections to the selection. The third control is the judicial one, the vires and proportionality review already described, which is effective but slow, retrospective and dependent on a petitioner with standing and resources. The fourth control is the simplest and the most neglected: the rule must be published to bind at all, in the Gazette, and the field’s compliance industry exists in part because the raw material of the law, notifications scattered across years of Gazettes, is genuinely difficult to assemble into a current text. Oversight of the rules layer is thus real at the edges, judicial and journalistic, and weak at the centre, parliamentary, and that distribution is the institutional fact beneath the debate the next sections conduct.

The churn of the rules: drafts, amendments and litigation

The rules layer is not only deep; it is unstable in a way the statute layer is not, and a complete map records the movement as well as the position. Consider the biography of a single regime, the intermediary rules. The guidelines of 2011 were a short instrument, largely concerned with the content categories an intermediary’s user agreement should forbid and with a thirty six hour window for acting on a complaint from an affected person, a mechanism whose private trigger the Supreme Court later held could not be reconciled with the safe harbour as the Court read it. In December 2018 the ministry published draft amendment rules that proposed to oblige intermediaries to enable traceability of originators, to take down content within twenty four hours on official or court direction, and to incorporate locally, and those drafts were consulted on, criticised and never notified in that form; yet their substance returned, enlarged, in the Rules of 2021, which dropped the draft’s twenty four hour figure for the grievance clock into days and hours of their own and added the significant intermediary tier and the digital media code. The Rules of 2021 were then amended in October 2022, when the appellate committees arrived and the content categories a user complaint could invoke were expanded, and amended again in April 2023, when the fact check unit provision was inserted, the provision the Bombay High Court held unconstitutional the following year. In five years the governing instrument for the largest platforms on earth, in their largest market by users, was a draft, a replacement, two amendments and a court order. No Act in the field has lived at anything like that tempo, and a compliance calendar in this field is accordingly a calendar of notifications.

The litigation that surrounds the rules is part of the map and not an interruption of it. The traceability obligation in the Rules of 2021, requiring a significant social media intermediary providing messaging services to enable identification of the first originator of a message on court or competent authority order, was challenged by WhatsApp in the Delhi High Court on the ground, in substance, that compliance would require breaking end to end encryption for all users and would fail the privacy judgment’s proportionality test; the challenge stands as the field’s emblematic unresolved case, in which the vires question about rules and the constitutional question about privacy arrive in the same petition. The digital media part of the Rules drew challenges from publishers and journalists’ and editors’ bodies in several High Courts, and the transfer of those challenges and their consolidation has itself been litigated. The position a reader must hold is therefore double: the Rules of 2021 are in force and are complied with daily by every platform of consequence, and substantial parts of their design remain under constitutional challenge, with individual provisions stayed or struck. Both halves are the law of the field. A guide that reported only the text would overstate the settlement of the subject; a guide that reported only the challenges would understate the obligations that, stayed provisions apart, bind in the meantime.

The same tempo marks the smaller regimes. The security practices rules of 2011 were issued under a provision, Section 43A, that required a body corporate’s negligence to be shown before compensation followed, and the rules’ definition of reasonable practices referred out to international standards and to codes self written by industry, so that the operative standard in a data case for over a decade was a standard the statute had outsourced twice over. The blocking rules of 2009 have been stable in text and unstable in use, their confidentiality rule sustaining a practice of unpublished directions whose scale becomes visible only when a platform publishes a transparency report or a petitioner obtains an order in a specific case. The emergency response directions of 2022 were preceded by rules of 2013 governing the team’s own functions, which the directions did not replace but supplemented, so that the incident regime is itself layered, rules about the agency beneath directions by the agency. Layering within layering is the field’s normal condition, and it is the practical reason the routing discipline matters more here than in fields where the statute can be read once and relied on.

Which instrument governs: the routing table

The table below is the guide in miniature. Each row begins with the question a reader actually brings, and routes it to the instrument that governs it, the authority that administers that instrument, and the forum in which a dispute about it is fought. The discipline it teaches is to resist the gravitational pull of the general statute: for most rows, the governing instrument is not the Information Technology Act itself but a rule, a direction or a specialist statute standing beside it.

The question	The governing instrument	The authority	The forum
Is an electronic record or signature legally valid?	Information Technology Act, 2000, recognition and signature provisions, with the electronic signature rules	Controller of Certifying Authorities	Civil courts and the sectoral forum for the underlying transaction
Has a computer offence been committed, hacking, identity theft, impersonation?	Information Technology Act, 2000, offence provisions, read with the general penal code	State police and prosecution	Criminal courts of the state where the offence is tried
Is a platform liable for content its users posted?	Section 79 of the Information Technology Act, 2000, as read down in Shreya Singhal, with the Intermediary Guidelines and Digital Media Ethics Code Rules, 2021	Ministry of Electronics and Information Technology; Grievance Appellate Committees for moderation appeals	High Courts on writ; civil courts for the underlying claim
Can content or a website be taken down or blocked?	Section 69A and the Blocking Rules, 2009, for state blocking; the Rules of 2021 for platform grievance takedown	Designated officer and committee under the 2009 Rules; the intermediary’s grievance officer in the first instance	High Courts on writ against blocking; Grievance Appellate Committees against platform decisions
Can a communication be intercepted or monitored?	Section 69 of the Information Technology Act, 2000 and the Interception Rules, 2009; Section 20 of the Telecommunications Act, 2023 for telecom networks	Home departments at the Centre and in the states; review committees of senior officials	High Courts and the Supreme Court on constitutional challenge
Has personal data been misused or a database leaked?	Digital Personal Data Protection Act, 2023 and the Rules of 2025, replacing the Section 43A and Rules of 2011 regime as commencement proceeds	Data Protection Board of India	The Board, with appeals to the Telecom Disputes Settlement and Appellate Tribunal
Must identity be authenticated, and by what number?	Aadhaar Act, 2016 and the regulations of the Unique Identification Authority of India	Unique Identification Authority of India	High Courts; the Authority’s own grievance machinery in the first instance
May a company provide a telecom service, and on what spectrum?	Telecommunications Act, 2023, with the Telecom Regulatory Authority of India Act, 1997 for regulation	Department of Telecommunications as authorising licensor; the Authority as regulator	Telecom Disputes Settlement and Appellate Tribunal

One field, many regulators

A map of instruments is only half the routing problem, because each instrument is worked by an institution and the institutions overlap. The Ministry of Electronics and Information Technology is the field’s administrative centre: it owns the information technology statute, makes its rules, supervises CERT-In and the Controller of Certifying Authorities, and wrote the data protection statute and its rules. The Department of Telecommunications owns the carriage side, administering the telecommunications statute, granting authorisations and assigning spectrum, while the Telecom Regulatory Authority of India, created by the statute of 1997, regulates tariffs and interconnection and recommends on licensing and technology from a position of statutory independence that governments have tested and courts have policed. The Ministry of Information and Broadcasting, a ministry whose technology connection is historical rather than technical, found itself in charge of the third part of the 2021 Rules, the ethics code for digital news and streaming, because the subject matter of content descends from its broadcasting charge rather than from the electronics ministry’s. The Unique Identification Authority of India administers identity. The Data Protection Board of India, constituted under the 2023 statute and operationalised by the 2025 Rules, is the field’s youngest institution, a digital first adjudicatory body whose orders are appealable not to a general appellate tribunal of its own but to the telecom tribunal, which has become, by accretion, the field’s appellate workhorse: the Finance Act of 2017 had already merged the Cyber Appellate Tribunal, once the information technology statute’s own appellate forum, into the same Telecom Disputes Settlement and Appellate Tribunal. A reader with a grievance must therefore solve two routing problems, the instrument and the institution, and the second is frequently the harder.

Where do telecom disputes go in India?

To the Telecom Disputes Settlement and Appellate Tribunal, created under the telecom regulator’s statute of 1997. It hears disputes between the licensor and licensees, between service providers, and between providers and consumer groups, and it also hears appeals from the Data Protection Board and inherited the work of the former Cyber Appellate Tribunal.

Enforcement on the ground belongs, as so often in Indian law, to the states. The offences in the information technology statute are investigated by the state police, through the cyber cells and specialised economic offences wings that state governments have built at very uneven speeds, and prosecuted in state courts; the Union statute supplies the offence definitions but no Union police force to work them. State governments also appear in the field as rule takers and as policy makers of a softer kind, issuing their own information technology and electronics policies, offering incentives, constituting state level emergency response arrangements, and, in the interception regime, as one of the two levels of competent authority. The federal shape of the field is thus asymmetrical: legislation is a Union monopoly, administration is shared, and investigation is a state function, a division that a reader must hold in mind when a single incident, a fraud run from three states against victims in five, has to be routed through institutions that were not designed as one system.

The gaps and overlaps inside the field

A thematic guide owes its reader the places where the map’s lines cross or fail to meet, because those are the places where cases are lost. The first overlap is between the technology statute and the general criminal law. The computer offences of the information technology statute sit beside the offences of the penal code, cheating, criminal breach of trust, forgery, defamation, which prosecutors charge alongside them, and the relationship between the special statute and the general code has generated its own jurisprudence, including the holding that the special statute’s bail and offence scheme does not silently displace the general law for the same facts. The second overlap is internal to the state’s content powers and has been noticed already: a piece of content can be attacked through a blocking direction under Section 69A, through a user complaint and platform grievance under the Rules of 2021, through a court order in a civil suit which the safe harbour, as read down, obliges the intermediary to honour, and through prosecution of the speaker, and the four routes proceed independently, on different records, at different speeds, with different rights of audience for the person affected. Practitioners choose among them strategically; a map that showed only one would mislead.

The third feature is a genuine gap, and it is the field’s most remarked one: the space where a general law of privacy tort and of platform responsibility for non-content harms would sit. The data statute governs digital personal data and leaves non-digital data, and much non-personal data, outside itself; the information technology statute’s privacy offence reaches a person who, in breach of a lawful contract, discloses information and a person who captures or transmits an image of a private area without consent, provisions aimed at specific wrongs rather than at a general wrong of privacy invasion; and the common law of privacy damages in India remains thin beside the constitutional right’s grandeur, a disjunction between the right’s public law stature and its private law remedies that the privacy judgment itself acknowledged. The fourth gap is institutional: the field has no single regulator and no prospect of one, and the seams show when an incident crosses regimes, as a deepfake video does, engaging the platform rules, the criminal law of impersonation and obscenity, the election law’s own silence-period and disclosure rules when an election is on, and the grievance machinery of three ministries. The fifth feature is temporal and has run through this guide: at any moment, some part of the field is in transition between an old instrument and its replacement, between the rules of 2011 and those of 2025 for data, between the telegraph framework and the authorisation framework for carriage, and the savings and commencement provisions that manage those transitions are part of the operative law and must be read with the same care as the substantive provisions they connect.

Naming these features is not a counsel of despair about the field. Every mature legal field has overlaps, and most have gaps at the points where technology or commerce has moved first. The point is narrower and more useful: in Indian technology law the overlaps and gaps are not defects in an otherwise statutory scheme; they are the predictable product of the scheme’s method, in which Parliament legislates late and generally, the executive fills the space quickly and particularly, and the courts correct at the margin. A reader who expects the field to behave like a code will be perpetually surprised by it. A reader who expects it to behave like an accretion, layers deposited by different institutions at different speeds for different purposes, will find that its surprises become predictable, which is the most a guide can honestly promise.

The sectoral overlay: the field beyond the technology statutes

The five statutes and their rules do not exhaust technology law in India, because every sectoral regulator writes technology rules under its own statute, and for a business in a regulated sector those rules are usually the ones with teeth. The Reserve Bank of India, acting under the payment systems and banking statutes, has built a body of directions on digital payments, on the outsourcing of information technology services by banks and payment companies, on tokenisation of card transactions and on the storage of payment data within India, a localisation direction of 2018 that did more to shape the architecture of Indian fintech than any provision of the information technology statute. The Securities and Exchange Board of India maintains a cyber security and cyber resilience framework for market intermediaries and exchanges under the securities laws. The insurance regulator imposes information and cyber security guidelines on insurers. The health sector’s digital mission has produced its own consent and data architecture for health records under executive policy, awaiting and partly anticipating statutory form. None of these instruments appears in a technology statute, and all of them are technology law in the only sense that matters to the entities they bind.

The overlay explains a recurring feature of compliance practice in India: the same database may be governed simultaneously by the data protection statute’s general obligations, by a sectoral regulator’s stricter and more specific directions, and by the emergency response team’s incident directions, with different reporting clocks running to different authorities for the same event. A payment company’s breach is a matter for the central bank’s reporting framework within hours, for the emergency response team within six hours under the directions of 2022, and for the Data Protection Board under the statute of 2023 once its breach provisions are in force, and the three duties differ in content, in threshold and in consequence. The field’s map, to be usable, must therefore be drawn in two dimensions: the horizontal layer of the general technology statutes and rules, and the vertical layer of the sectoral codes that descend on particular industries. The general guide owns the horizontal layer. The vertical layer belongs to the finance, health and sectoral articles elsewhere in this series, and the reader with a sectoral question should route to those after fixing the general position here.

A second overlay, quieter but pervasive, is the law of evidence and of government process that makes electronic activity legible to the state. The certification regime for electronic records, first built into the Indian Evidence Act, 1872 and carried into its successor code, decides whether the printout, the log file and the screenshot can be proved in court at all, and more technology litigation has turned on the certificate than on any offence definition. The electronic governance provisions of the information technology statute, on the legal recognition of electronic filing, electronic service of notices and retention of records in electronic form, are the statutory basis on which the state’s own digitisation rests, from the income tax portal to the digital locker. These provisions attract little argument and less commentary, but they are load bearing: remove them, and the visible field of platforms and data would float free of the legal system’s ability to see it.

The reach of the field beyond India’s borders

A technology statute that stopped at the frontier would govern very little, because the services it addresses are routinely operated from elsewhere. The information technology statute answers the problem in its opening provisions. Section 1(2) extends the Act to the whole of India and provides that, save as otherwise provided, it applies also to an offence or contravention committed outside India by any person, and Section 75 makes the condition precise: the Act applies to an offence or contravention committed outside India by a person of any nationality if the act involves a computer, a computer system or a computer network located in India. The location of the machine, not the nationality of the actor or the incorporation of the company, is the jurisdictional hook. The data protection statute uses a different and broader hook, applying to processing of digital personal data outside India where the processing is in connection with an activity related to offering goods or services to data principals within India. Between the two provisions, the field asserts jurisdiction over the foreign platform with Indian users, the foreign processor holding Indian data, and the foreign attacker who reaches an Indian system, which is why the compliance departments of companies with no Indian office at all maintain Indian technology law files.

Assertion is not enforcement, and the honest map records the gap. Extradition is slow, evidence held abroad moves through mutual assistance channels slower still, and the practical instruments by which Indian law reaches a foreign platform are the obligations of the rules layer applied at the point of Indian presence: the resident compliance officers and grievance officers the 2021 Rules demand of significant social media intermediaries, the local incorporation and record keeping expectations that have grown around the payments and data rules of other regulators, and, behind them all, the blocking power, which needs no foreign cooperation at all because it operates on access within India. The constitutional and statutory claim is universal; the working machinery is territorial. Both halves of that sentence belong on the map, because disputes in this field are usually won and lost on the second.

Which technology law governs a phone call tapped by the police?

Interception sits in two instruments, not one. For information generally, Section 69 of the Information Technology Act, 2000 and the Interception Rules of 2009 govern directions to intercept, monitor or decrypt. For telecommunication services and networks, the Telecommunications Act, 2023 carries its own interception and suspension powers in Section 20.

Data localisation and the politics of where data sits

No question in the field has travelled further, from draft clause to diplomatic argument and back, than the question of where data about Indians must physically be stored, and the itinerary is a compact history of the field’s method. The Srikrishna committee’s draft of 2018 proposed that a copy of all personal data be kept on servers in India and that specified critical personal data be processed only in India. The Reserve Bank of India, moving first and by direction under its own statute, required in April 2018 that all payment system data be stored only in India, a direction whose deadline the global card networks met with difficulty and publicity, so that the country’s operative localisation law for its most sensitive commercial data was for years a central bank circular and not a parliamentary text. The Bill of 2019 carried localisation duties of its own, the joint committee’s report widened their logic, and then the Act of 2023 abandoned the architecture entirely in favour of a negative list: data may flow freely except to countries the Centre notifies as restricted. The movement across five years, from mirror copies and hard localisation in drafts, through a sectoral direction that simply imposed it, to a permissive statute with a notification based exception, shows every instrument in the field’s repertoire being used for the same policy in turn, and shows the final settlement being, characteristically, a power to notify: the statute does not say where data must sit, it says who may decide, by notification, where data may not go. A reader tracking the substance through the texts alone, without the itinerary, would see three incompatible positions and miss that they are one argument conducted by different instruments over time.

The localisation debate also marks the field’s intersection with trade and foreign policy, a dimension a purely domestic map can miss. Data flow commitments appear in trade negotiations, the adequacy of a country’s protection regime is assessed by partners whose companies must send it data, and the extraterritorial provisions noticed earlier are read abroad as the assertion they are. India’s position, that processing connected with offering goods and services to persons in India attracts Indian law wherever it occurs, is the standard position of every major data jurisdiction and is not the assertion that draws objection; the objections have fastened on the breadth of state exemptions and on the independence of the enforcement board, questions that return to the constitutional layer where this guide began. The point for the map is that the field’s boundary is not the territory. It is the data principal, the user and the machine located in India, and the instruments are drafted to those hooks.

The powers of the state, and the safeguards the courts supplied

Three instruments of state power dominate argument in this field, and they are habitually confused with one another. Blocking, under Section 69A, prevents public access to information and is directed at the intermediary or agency hosting it. Interception, under Section 69 and, for telecom networks, under the 2023 statute, acquires the content of communications in transit or stored form, and is directed at surveillance of identified targets. Takedown through the intermediary grievance route, under the 2021 Rules, is formally private: a user complains, the platform acts under its own terms as the Rules require it to maintain them, and the state’s hand appears only in the appellate committee and in the standards the Rules impose. The three powers have different triggers, different records and different constitutional exposures, and analysis that merges them, usually under the single word censorship or the single word surveillance, misdescribes all three.

What the three share is a history of judicial supplementation. The blocking power survived challenge in Shreya Singhal substantially because the rules of 2009 supplied a committee, a hearing and a reasoned order, and the Court read the power against those safeguards and against the Article 19(2) grounds the parent section recites. The interception regime borrowed its safeguards from the telephone tapping jurisprudence under the Telegraph Act, in which the Supreme Court, faced with a power and no procedure, had itself prescribed the procedure of written orders by senior officers and review by committee until rules were framed. The privacy judgment then placed the whole family of powers under the proportionality standard. The pattern is one of the field’s structural findings: the statutes confer power in general words, the rules add some procedure, and the courts supply the constitutional discipline from outside the instrument, so that a reader who wants to know what the law of interception actually requires must read a statute, a rule book and at least two judgments together. No single document in the field is self sufficient, which is precisely the condition that makes a routing guide necessary.

The fourth power: suspending the network itself

Beside blocking, interception and takedown stands a fourth instrument of state power that a complete map must place, because it is the most drastic of the set and the one under which the largest number of citizens has experienced technology law directly: the suspension of telecommunication services themselves, the internet shutdown. For most of the field’s history the power had no dedicated instrument at all and was exercised through orders under the criminal procedure code addressed to the public, until the Centre framed the Temporary Suspension of Telecom Services (Public Emergency or Public Safety) Rules, 2017 under the Telegraph Act, creating a regime of written directions by the competent authority at the Centre or in a state, confirmation at the highest level of the home administration, and review by a committee of senior officials within days. The telecommunications statute of 2023 absorbed the substance of the power into its own scheme, carrying in Section 20 the authority to take possession of, suspend or intercept on grounds of public emergency and public safety that its predecessor had housed in the telegraph framework.

The constitutional discipline of the power is again judicial in origin. In Anuradha Bhasin the Supreme Court held that suspension orders must state reasons, must be published so that they can be challenged, must satisfy proportionality, and cannot be indefinite; it declined, however, to convert those disciplines into a requirement of prior judicial approval, leaving the executive’s order subject to review after the event and to the review committee the rules provide. The result is the field’s characteristic distribution of labour once more: a power conferred and structured by subordinate instruments, exercised frequently and locally, and disciplined by standards that live in a judgment. Shutdowns also expose the federal seam in the field with unusual clarity, because the direction issues in practice from state home departments responding to local disorder, under a Union statute and Union rules, against networks operated by companies answerable to a Union licensor, a distribution of roles that no single provision states and that a reader can assemble only from the rules, the statute and the case together. The point for the map is the same as for the other three powers: identify the instrument precisely, because the remedy, the review and the record all differ according to which of the four powers has actually been used.

The judicial layer: the field’s third legislator

It has been said at several points that the courts supplied what the statutes omitted, and the claim deserves its own section, because the judicial layer is not a commentary on the field but a constituent part of it, with its own texts that a practitioner reads as law. The foundation stone is the pair of decisions on the telegraph power in the nineteen nineties, in which the Supreme Court, asked to discipline telephone tapping under a colonial statute that conferred the power and prescribed no procedure, held the power itself valid against the privacy claim as the Constitution was then understood and then wrote the procedure into the law from the bench: orders only by the home secretary level, reasons recorded, a defined duration, and review by a committee of the cabinet secretary and law and telecom secretaries. The interception rules of 2009 under the information technology statute are that judgment, codified by the executive a decade later, which is the clearest instance in the field of a court functioning as the first drafter and the ministry as the second.

The second stratum is the speech settlement of 2015. Shreya Singhal did four things that together amount to a constitution for online speech in India, and the specialist article owns their detail: it struck down Section 66A in its entirety for vagueness and overbreadth and for the chilling effect of a provision under which the merely annoying message was a crime; it drew, for the first time in Indian free speech law at this level, the line between discussion and advocacy, however offensive, and incitement, which alone the state may reach; it upheld the blocking power precisely because the rules of 2009 built a committee, a hearing and a reasoned order around it; and it read down the safe harbour so that an intermediary’s obligation to remove content arises only on a court order or a government direction under the blocking provision, converting what had been a private notice and takedown free for all into a state accountable process. Every one of those four holdings is a load-bearing part of the working law, and none of them is in a statute.

The third stratum is the privacy settlement of 2017 and its application to the identity system in 2018, which together fixed the standard, proportionality with procedural safeguards, by which state data practices are judged, upheld the Aadhaar architecture in its core subsidy and tax uses, struck its extension to bank accounts and mobile connections as disproportionate on the instruments then used, read down the metadata and retention provisions, and left the money bill question, whether the Aadhaar statute could constitutionally have been passed by the Lok Sabha alone, decided by the majority and doubted in a later reference that keeps the doctrinal question alive. The fourth stratum is the suspension jurisprudence of 2020, already noticed, which subjected the shutdown power to publication, reasons, proportionality and review. The fifth stratum is being laid down in the challenges to the Rules of 2021 and may in the end be the most consequential, because it will decide the vires question on which the field’s administrative method depends. A reader adding the strata together sees the pattern that defines the field’s public law: the judiciary is not external to this body of law, arriving to correct it from outside. It is one of the three institutions that make it, and its output, the reported judgment, is the layer in which the constitutional limits of the other two are stored.

What Parliament has not enacted

The gaps in the statutory shelf are as instructive as its contents, because three major attempts to legislate the field afresh have failed to reach the statute book, and the failures are why the rules layer carries so much weight. The first is the data protection Bill that preceded the 2023 Act. A committee of experts chaired by Justice B. N. Srikrishna reported in July 2018 with a draft Bill; the Personal Data Protection Bill, 2019 was introduced in the Lok Sabha in December 2019 and referred to a joint committee of Parliament, whose report of December 2021 proposed extensive change, including widening the Bill beyond personal data; and on 3 August 2022 the government withdrew the Bill altogether, announcing that a wider legal framework would follow. Justice Srikrishna had himself described the 2019 Bill’s exemptions for state agencies as capable of turning India into an Orwellian state, and the withdrawal closed a five year legislative effort whose history this series keeps in its own article. The Act that eventually emerged in 2023 was a different and leaner text, and it arrived without the committee architecture its predecessor had accumulated.

The second failure is the field’s missing centre. A wholesale replacement of the information technology statute, publicly discussed by the Ministry of Electronics and Information Technology under the working title of a Digital India Act, has been the subject of ministerial speeches and stakeholder consultations, and was trailed as the vehicle that would finally legislate for platforms, for online harm and for emerging technologies directly. It has not been introduced in Parliament. The consequence is the one the debate section below takes up: the subject matter that a replacement statute would have addressed, platform obligations, digital media ethics, fact checking, appeals from moderation, is being governed instead by amendments to rules made under a statute enacted for electronic commerce in the year 2000.

The third failure is the broadcasting proposal. A draft Broadcasting Services (Regulation) Bill was placed in the public domain by the Ministry of Information and Broadcasting on 10 November 2023, proposing to consolidate the law for broadcasting services and to extend a regulatory framework to broadcasting over the internet, including streaming services; a later version circulated to selected stakeholders in 2024 widened the draft’s treatment of digital news broadcasters and online creators and drew sharp objection from media bodies, including the Editors Guild of India and DigiPub, and from civil liberties organisations, which objected both to the substance and to a consultation conducted through watermarked copies shared with some stakeholders and not others. On 12 August 2024 the Ministry withdrew the draft, announced that a fresh draft would follow detailed consultations, and in the event none was introduced. The episode is a compressed lesson in the field’s politics: legislating for online content in a Bill invites a public fight the government may not want, while regulating the same content by rule, under the information technology statute, is quieter, faster and, until a court intervenes, nearly as effective. The unenacted Bills are therefore not absences in the map. They are the explanation of its shape.

The legislative record in more detail: what the failures contained

The three failures repay a closer reading, because what each contained explains what the rules layer had to improvise. The Srikrishna committee’s draft of 2018 proposed a data protection authority with adjudicatory and rule-making arms, a consent architecture with data principal rights of access, correction, portability and erasure, graded obligations rising to data audits and impact assessments for significant fiduciaries, and a scheme of penalties expressed as proportions of worldwide turnover, the regulatory idiom the period favoured. The Bill introduced in 2019 kept much of the structure and added what the committee had not proposed, including a wide exemption for state agencies on grounds the committee’s chairman then publicly criticised, and a reach into non-personal data that the joint committee’s report of 2021 extended further, together with social media regulation proposals that belonged, in substance, to a different statute. The Bill that died in August 2022 was thus not one Bill but three projects wearing one title: a privacy statute, a state access statute and a platform statute. The Act of 2023 is intelligible only against that history: it is the first of the three projects, separated from the other two and enacted alone, while the second continues under the older powers and the third is administered through the Rules of 2021. The legislative failure and the administrative improvisation are the same fact seen from two sides.

The Digital India Act consultations tell a parallel story in a lighter key. The ministry’s public presentations of the proposal sketched principles rather than clauses: openness and safety and trust as organising commitments, a graded and principles based approach to platforms, new offences for the harms of the platform era, and a regulator fitted to the subject. Industry and civil society responded in the consultation rooms with the predictable and opposed anxieties, the one fearing the compliance load of a new statute, the other fearing that a statute drafted in the ministry’s image would constitutionalise the rule-based regime it replaced. The proposal’s stall cannot be assigned to a single cause on any public record, and this guide does not assign one. What can be said structurally is that a replacement statute is the one instrument in the field that cannot be produced by the field’s usual method: it requires a Bill, a session, a debate and a vote, and every interest the rules layer has accommodated without a vote would have to be re-argued in public. The incentive to postpone it is built into the method itself, and the postponement is therefore data, not accident.

The argument about governing a fast field by rule

The strongest case for the method this guide has described is a practical one, and it deserves to be put at its strongest. Technology changes faster than legislation; a statute that specified security standards, reporting timelines or content categories in its own text would be obsolete before the ink dried and could be repaired only when Parliament found time. Delegated legislation lets the law track the subject: when a new class of incident emerged, the emergency response team could impose a reporting duty in weeks; when the grievance machinery of platforms proved inadequate, an appellate tier could be added by amendment of rules in a single notification; when data protection finally moved, commencement could be phased so that obligations bit in an order industry could meet. The Ministry of Electronics and Information Technology, defending the Rules of 2021 in court and in Parliament, has made the connected legal argument: the Rules operationalise the due diligence condition that Section 79 itself attaches to safe harbour, and the rule-making power in Section 87 extends to the matters the Rules contain, so the technique is not an evasion of the statute but its intended working. On this view, the statute supplies the principles and the sanctions, and the rules supply the specification, which is how a modern regulatory state is supposed to divide labour.

The strongest case against is constitutional rather than practical, and it is made, among others, by the Internet Freedom Foundation, whose co-founder Apar Gupta has argued in print and in litigation support that the Rules of 2021 exceed the parent Act: that Section 79 confers an immunity and prescribes the diligence that preserves it, but does not authorise a licensing style regime for intermediaries, still less a code of ethics for news publishers, a subject the information technology statute nowhere addresses; that obligations such as traceability alter the architecture of private communication in ways a rule should not be able to reach; and that the appellate committees place the executive inside disputes between citizens and platforms. The Editors Guild of India has made the parallel argument for the press, challenging the application of the ethics code to digital news as regulation of journalism by a ministry without a parliamentary mandate. The courts have not resolved the whole argument, but they have resolved pieces of it in the critics’ favour: the Bombay High Court stayed the operation of the code of ethics provisions for digital media in August 2021, and in 2024 the same court held unconstitutional the amendment that would have empowered a government fact check unit to flag content concerning the business of the Centre, the kind of content based obligation the critics say a rule cannot invent. The pattern of the decided pieces supports a measured verdict, and this guide gives it: rule-making is the right technique for the field’s technical specification and the wrong one for its speech settlement. Security practices, incident timelines, log retention and the mechanics of grievance handling are properly rule work. The conditions on which speech may be blocked, publishers overseen and platforms made answerable are constitutional settlements, and when they are made by notification they are made without the debate, the committee scrutiny and the opposition amendments that are Parliament’s contribution to legitimacy, and they return, case by case and stay by stay, to be unmade by courts. The Digital India Act matters, in the end, less for what it might contain than for what its non-introduction concedes: that the settlement Parliament has not made is being administered by the executive in the meantime.

The middle position: disciplining the rules without abandoning them

Between the ministry’s defence of the method and the critics’ constitutional objection there is a middle position with its own named adherents, and a stance charter that omitted it would misdescribe the debate. Its argument accepts that the specification of a fast field must be delegated and attacks instead the procedure by which the delegation is exercised. The government’s own pre-legislative consultation policy of 2014 committed departments to publishing draft legislation, and by extension the thinking runs to major rules, with explanatory material and time for comment, and commentators on administrative law in India have repeatedly proposed converting that commitment from policy into discipline for the rules that carry the heaviest obligations: mandatory consultation with a published response to comments, commencement deferred by a fixed interval after notification so that compliance is possible, systematic post-legislative scrutiny of rule sets by the parliamentary committee with power to require the ministry to justify a rule’s parentage section by section, and sunset clauses under which major rule regimes expire unless re-notified after review. The Rules of 2021 are the standing exhibit for each proposal: a regime of that consequence, the argument runs, should not be able to arrive complete on a February afternoon, bind from the following quarter, and meet its first structured public examination in a courtroom. The ministry’s answer, that consultation on the data rules of 2025 shows the system learning, and the critics’ answer, that consultation without a duty to answer it is theatre, frame the question the field’s next statute, if it comes, will have to decide: not whether India governs technology by rule, which it will, but under what procedural law the rules themselves are made.

The recurring proposal to consolidate, and why it recurs

Every few years the field produces a proposal to end its own untidiness: to consolidate the technology statutes into a single digital code, to merge the regulators, or at least to gather the rules into one instrument that a reader could hold. The proposal has obvious attractions and a consistent record of non-adoption, and the reasons for both belong in a thematic guide. The attraction is the reader’s experience this guide began with: a body of law whose operative content is scattered across five statutes, a dozen rule sets, agency directions and sectoral codes imposes search costs on everyone, on the startup that cannot price its obligations, on the citizen who cannot find the remedy, on the official who administers one layer without sight of the others. Consolidation promises a single text, a single commencement, a single amendment process, and the discipline that drafting one text imposes on the drafter, who must reconcile the blocking power with the takedown power because they sit in adjacent chapters.

The obstacles are institutional, and they are the same institutions the map has described. A consolidated code would have to be owned by someone, and the field’s subjects are divided among ministries, electronics, telecommunications, information and broadcasting, home affairs for the security powers, finance for the payments layer, whose jurisdictions a code would redistribute; it would have to settle questions, on platform liability, on state access, on the ethics of digital news, that the present arrangement leaves deliberately unsettled and administrable; and it would freeze, at the moment of enactment, arrangements whose chief virtue for their administrators is that they can be changed by notification next month. The recurring proposal therefore functions in the field’s discourse less as a programme than as a measure of dissatisfaction, rising whenever a rule change has been especially contested and subsiding when the administrative method reasserts its convenience. The honest assessment for the reader is that the field will be consolidated, if at all, statute by statute, as the telecommunications consolidation of 2023 suggests: a sector at a time, when the old text has become unusable, rather than by a single codifying act. Until then, the map is the code, and learning to read the field as a map, instruments and institutions and their seams, is the substitute the reader actually has.

The professions the rules created: compliance officers, auditors and data officers

A body of law can be measured by the occupations it calls into being, and by that measure the rules layer is the field’s great employer. The Rules of 2021 require every intermediary to maintain a grievance officer and the significant intermediaries to maintain a chief compliance officer, personally answerable in the scheme’s design for the platform’s compliance, a nodal officer in round the clock coordination with law enforcement, and a resident grievance officer, so that a statute which never used the phrase compliance officer has populated the country with them. The data statute creates its own offices: the data protection officer that a significant data fiduciary must appoint, answerable to its board and resident in India, the consent managers registered with the Data Protection Board, and the auditors and assessors whom the rules engage for the data protection impact assessments and periodic audits that the significant fiduciary tier must undergo. The emergency response framework sustains an empanelled profession of information security auditors, listed by CERT-In, whose audits are the currency in which organisations demonstrate the reasonable security practices the older rules demanded. Around these named offices stands the larger penumbra of the field’s practice: the technology practices of the law firms, the in-house policy teams of the platforms, the trust and safety operations that work the grievance machinery, and the academic and civil society organisations that litigate and annotate the rules.

The professional layer is not decoration on the legal structure; it is part of how the law works, and it explains two of the field’s behaviours. The first is the speed with which a notification becomes practice: a rule that creates an office creates, within months, a profession with an interest in the office’s continuation and a body of practical knowledge about what the rule means, which feeds back into the next consultation as the most informed commentary the ministry receives. The second is the field’s characteristic mode of interpretation. Where a statute is ambiguous, courts resolve it in litigation; where a rule is ambiguous, it is resolved in the first instance by the compliance profession’s collective practice, by the FAQs and clarifications the issuing agency publishes, the emergency response team’s frequently asked questions on its 2022 directions being a worked example, in which the agency glossed its own instrument’s reporting classes, timelines and log requirements in question and answer form that practitioners treat as part of the instrument. A researcher who reads only the Gazette text of the directions, without the glosses the agency issued upon them, will misstate what the directions are understood to require. The map of this field therefore has a human layer, and the reader who wants to know what a rule means should ask, as one of the first questions, who has been appointed to live under it and what they have collectively settled that it says.

The infrastructure layer: identity, payments and the state’s own platforms

Beneath the regulatory field sits a constructive one, easy to overlook because it argues less: the layer of digital public infrastructure that the state itself built on the statutes’ validity provisions, and which generates a steady body of subordinate law of its own. The identity layer has been described. The payments layer rests on the Payment and Settlement Systems Act, 2007, under which the Reserve Bank authorises and oversees payment systems, and beneath that statute sits the network of directions and frameworks within which the Unified Payments Interface and its operator function. The document layer rests on the information technology statute’s electronic governance provisions and the digital locker rules made under them in 2016, which give documents issued into a citizen’s digital locker the same legal standing as physical originals for the purposes the rules specify, a small instrument that quietly re-papered the citizen’s dealings with the state. The consent layer of the financial sector, the account aggregator framework built by the Reserve Bank’s directions from 2016, created licensed entities through which financial information moves between institutions only on the customer’s consent, an architecture whose design the data statute’s consent manager institution resembles and partly generalises.

The infrastructure layer matters to the map for two reasons. The first is legal: each of its components required a statutory hook, and the hooks are the unglamorous provisions, validity of electronic records, authority to frame rules for electronic governance, the payments statute’s authorisation power, without which the platforms would be executive projects of doubtful compulsion. The second is analytical: the infrastructure is the strongest exhibit in the case, noticed in the debate section, for the Indian state’s preferred method in this field. Where another jurisdiction might have legislated a digital identity and payments framework as a single code, India built the components under existing statutes and rules, at speed, and legislated afterwards where it legislated at all, the Aadhaar Act arriving seven years after enrolment began. The pattern of act first, statute later, which the identity section recorded, is the field’s method applied to construction as well as to regulation, and it produces the same consequence for the reader: the working law of the infrastructure lives in its frameworks, directions and rules, and the statutes arrive, when they arrive, to ratify a going concern.

The citizen’s side of the map: the remedies actually used

The routing table earlier in this guide is written from the top down, instrument by instrument. The same field seen from the citizen’s side looks different, and a complete guide should draw it once from that direction, because the remedies a person actually uses are rarely the ones a statute index would suggest. A person defrauded online meets the field first not as a statute but as a telephone number and a portal: the national helpline for reporting financial cyber fraud and the National Cybercrime Reporting Portal, operated through the Indian Cyber Crime Coordination Centre established under the Ministry of Home Affairs, which route the complaint to the state police who alone can investigate the offence. A person whose content is removed, or whose complaint about another’s content is ignored, meets the field as the platform’s grievance officer and then the appellate committee of the Rules of 2022 amendment. A person whose data is misused meets it, under the dispensation being brought into force, as a complaint to the data fiduciary and then to the Data Protection Board, in proceedings designed to be digital from the first filing. A consumer cheated by an online seller meets it in the consumer commissions under the consumer protection statute, whose own rules of 2020 for electronic commerce impose duties on marketplaces and sellers that sit entirely outside the technology statutes. In each case the remedy lives in a different instrument from the one that defines the wrong, and the citizen’s difficulty is not the absence of remedies but the routing among them, which is why helplines, portals and grievance officers, the field’s least statutory furniture, carry so much of its practical weight.

Two features of the citizen’s map deserve emphasis. The first is speed: the remedies that matter most in fraud are measured in minutes, because the money moves, and the state’s answer has been to build reporting channels whose function is to trigger the banking system’s freeze machinery before the trail cools, a recognition that in this field the remedy is often an operational act rather than an adjudication. The second is the asymmetry of the record. Blocking directions are confidential, platform grievance statistics are published by the platforms themselves, the appellate committees publish little, and the citizen navigating the field works with less information about how the machinery has treated others than in almost any comparable area of law. The transparency reports of the large platforms, published under commercial and regulatory pressure rather than under any Indian statute’s command, are for many questions the only public dataset the field produces. A guide that pretended otherwise would misdescribe the citizen’s position, which is that of a person with real rights, real forums and an incomplete view of both.

The open questions: what the map cannot yet settle

A guide that presented this field as settled would fail its reader at exactly the points where advice is most often sought, so the open questions are collected here, stated structurally, as matters whose resolution will change the map when it comes. The first is the vires of the Rules of 2021 in their full extent: the challenges are pending in the High Courts and their consolidation and hearing have their own procedural history, and until they are decided the platform and digital media regime operates under a cloud that is real but partial, individual provisions stayed, the structure standing. The second is traceability, which concentrates the vires question and the privacy question in a single obligation and on which a decision either way will require the losing side’s part of the field to be rebuilt. The third is the money bill question left open by the doubt expressed about the Aadhaar decision’s reasoning and the reference that followed it, a constitutional loose end under the identity layer. The fourth is the data statute’s own unwritten chapter: the exemptions for the state on grounds of sovereignty and public order are the provisions on which the statute’s proportionality will be tested when a case comes, and the significant fiduciary notifications and the Board’s early enforcement practice will fix positions that the text leaves open. The fifth is the authorisation boundary of the telecommunications statute, whether the communication services of the internet layer are within the Act’s activity based definitions, a question being fought in consultation papers and submissions because the answer decides whether the platform economy’s carriage is licensed by the telecom licensor or governed only by the technology rules. The sixth is the replacement statute itself: whether a Digital India Act or its successor in title is introduced, and if introduced whether it legislates the speech settlement or ratifies the administrative one, is the largest single unknown in the field. Each of these is stated here without a prediction, because the field’s history punishes prediction, and because the reader’s need is not a forecast but a correct account of which parts of the map are drawn in ink and which in pencil.

A note on sources: reading a field that will not sit still

The practical scholarship of this field differs from the scholarship of a settled one, and a guide should pass on the conventions. The primary text of an Act is stable and citable in the ordinary way, in the bare Act as published and as amended, and the reader’s first discipline is to cite the Act as amended, because the information technology statute in its original 2000 text is a museum piece that still circulates in quotation. The primary text of a rule is a Gazette notification, cited by its number and date, and the consolidated rule, the text as amended from time to time, is an editorial construction, by the ministry, by a publisher or by a firm’s knowledge department, whose accuracy the reader must sample against the notifications themselves. Judgments are cited in the ordinary way, with the caution the field forces: a proposition in a 2015 judgment about the intermediary rules describes the rules of 2011 and the Act as then read, and applying it to the rules of 2021 requires the further step of asking whether the later instrument changed the position the judgment stated. Agency glosses, the FAQs, clarifications and frameworks the regulators publish, are not law and are occasionally disowned, and are also, as the last section argued, part of the working material without which the law cannot be stated accurately. The honest citation practice of the field is therefore layered, like the field: statute for the power, notification for the obligation, judgment for the limit, gloss for the practice, and a date attached, in the reader’s own notes, to every proposition drawn from the moving layers. This guide has been written on that convention throughout, naming the instrument and the year for every operative proposition, and a reader who adopts the convention will find that the field’s famous instability becomes manageable, because what moves is identified as moving, and what is fixed, the constitutional floor and the statutory skeleton, is identified as fixed.

How to navigate the field

The working method this guide recommends can be reduced to a sequence, offered as general legal information and not as advice on any individual case, for procedures in this field carry timelines that are unforgiving of delay. Begin with the question type, not with a statute: validity, offence, liability, removal, interception, data, identity, carriage. The routing table above takes each type to its instrument. Read the instrument’s current text, and in this field current has a technical meaning: rules are replaced and amended by notification, so the text to trust is the consolidated rules as last amended in the Gazette, not the version in a commentary, a coaching note or a compliance manual of even a few years ago. Identify the institution that works the instrument and the forum that reviews it, because the remedy usually lives there and not in the provision that created the right. Keep the constitutional floor in view, because the decided challenges in this field have turned on it more often than on statutory construction. Teams that maintain this map for a business or a newsroom often keep it as a living deck that is revised each time a notification lands, and keeping the map in a presentation that a team can revise together, opened through an online PowerPoint viewer, is a practical way to keep the routing table and the rule changes in one place. Finally, treat every confident statement about this field, including the ones in this guide, as dated by the last notification: the map is stable in its structure, constitutional floor, short statutory shelf, deep rules layer, and perishable in its detail, which is the honest condition of the subject.

The method bears differently on the three readers this guide set out to serve, and it is worth stating the application plainly. For the business and compliance reader, the discipline is calendrical: the obligations that carry clocks, the six hour incident report, the fifteen day grievance resolution, the monthly compliance report, the five year record, live in instruments that change by notification, so the compliance function in this field is a subscription to the Gazette and to the regulators’ circulars, and a contract, a privacy notice or an internal playbook drafted against the rules of one year is a liability in the next. For the researcher, the discipline is archival: the interesting questions in this field, why the delegation took the shape it did, which of the consultation drafts survived into the notified rules, what the courts have done to the design, are answered in the drafting record, in the sequence of drafts, notifications, stays and judgments, and the scholar who reads only the final text of a rule will miss the negotiation the text conceals. For the examination candidate, the discipline is one of proportion: the statutes supply the examinable skeleton, the Acts and their amendments, the constitutional provisions and the leading judgments, and the rules supply the illustrations that distinguish a strong answer, the named rule set, the parent section, the timeline, deployed at the point where the question turns from what the law is to how it actually operates. Each reader is reading the same field. Each is reading a different layer of it first, and the mark of having understood the field is knowing which layer one’s own question lives in before reaching for a text.

The verdict on the whole field follows from its structure. Indian technology law works, in the sense that every standard question has an answer somewhere in its instruments, and it works untidily, in the sense that the answer is rarely where an uninstructed reader looks, is usually in a subordinate instrument, and has a habit of moving. The statutes, amended once in a generation, provide the frame and the sanctions; the rules, replaced as often as the technology requires, provide the law in action; the courts provide, after the event, the constitutional corrections. A reader who holds those three sentences holds the field, and can find, for any question the digital economy asks, the instrument that governs it.

One last observation belongs in a guide of this kind, because it is the point on which the field’s critics and its administrators silently agree. Both sides of the debate conducted above, the ministry that defends governing by rule and the foundations and editors who challenge it, conduct the argument in the vocabulary this guide has used throughout: parent sections and vires, notifications and commencement tranches, grievance tiers and review committees. Nobody in the argument proposes that the field return to the telegraph statute’s world, and nobody proposes that Parliament draft the security standards itself. The disagreement is about the location of a boundary, between specification and settlement, inside a method both sides accept. That is why the field rewards the reader who learns its structure rather than its headlines: the structure is where the argument is, and where the next change, whether it arrives as a notification next month or as a statute next decade, will announce itself first to the reader who knows which instrument to watch. The statutes will be found on the shelf where this guide left them. The law will be found, as it has been found for a quarter of a century, one layer down.

The companion articles in this cluster take the map’s regions one at a time: the general statute and its amendment, the free speech judgment, the identity statute and the privacy judgment, the data statute and its long legislative history, the telecommunications statute and its regulator. This guide’s work is the connective tissue among them, and it should be read, and re-read, as the cluster’s index: when a specialist article states a proposition that seems to float free of the field, the routing that locates it, the instrument, the parent section, the authority, the forum, will be found here. The field will have moved by the time the cluster is complete, because the field always moves. The map’s claim is only that it will have moved along the lines drawn here, by notification in the rules layer, by judgment in the constitutional layer, and, on the evidence of a quarter of a century, only rarely and lastingly by Act of Parliament.

Frequently Asked Questions

Q: Which laws govern technology in India?

A small number of Acts and a large body of rules made under them. The general statute is the Information Technology Act, 2000, as amended in 2008, which recognises electronic records and signatures, creates the computer offences, and houses the intermediary, interception and blocking powers. Beside it stand the Aadhaar Act, 2016 for identity, the Digital Personal Data Protection Act, 2023 for personal data, the Telecommunications Act, 2023 for telecom services, and the Telecom Regulatory Authority of India Act, 1997 for the sector’s regulator and tribunal. Most operative obligations sit in the rules: the intermediary and digital media rules of 2021, the blocking and interception rules of 2009, the security practices rules of 2011, the emergency response directions of 2022 and the data protection rules of 2025.

Q: Which constitutional provisions apply to the internet?

Three provisions do most of the work. Article 19(1)(a) guarantees freedom of speech and expression, and Article 19(2) lists the only grounds on which it may be restricted, which is why content regulation must be traceable to one of those heads. Article 21 protects life and personal liberty, and the nine judge bench in the Puttaswamy judgment of 2017 read privacy into it, supplying the proportionality test applied to surveillance, identity and data measures. Article 19(1)(g) protects the freedom to carry on a trade or business, the ground used by platforms and providers challenging obligations. Competence to legislate comes from Entry 31 of the Union List, covering telephones, wireless, broadcasting and other like forms of communication, reinforced by the residuary power.

Q: Who regulates what in Indian technology law?

The Ministry of Electronics and Information Technology administers the information technology statute, the data protection statute and their rules, and supervises the emergency response team, CERT-In, and the Controller of Certifying Authorities. The Department of Telecommunications administers the telecommunications statute, grants authorisations and assigns spectrum, while the Telecom Regulatory Authority of India regulates tariffs and interconnection and recommends on licensing. The Ministry of Information and Broadcasting administers the digital media ethics code in the third part of the Rules of 2021. The Unique Identification Authority of India runs Aadhaar, and the Data Protection Board of India enforces the data statute. Police investigation of the offences belongs to the states, and appeals cluster in one tribunal, the Telecom Disputes Settlement and Appellate Tribunal.

Q: Which technology statutes have been repealed or replaced?

The field’s great repeal is recent. The Telecommunications Act, 2023 repealed the Indian Telegraph Act, 1885 and the Indian Wireless Telegraphy Act, 1933, the two colonial statutes under which telephony, mobile networks and the internet itself had been licensed, replacing a licensing regime built on the concept of the telegraph with an authorisation regime, and saving licences and actions taken under the old law. Within the information technology statute, replacement has happened one level down rather than to the Act itself: the intermediary guidelines rules of 2011 were replaced wholesale by the Rules of 2021, and the data protection rules of 2011 are being displaced by the data protection statute of 2023 and its rules of 2025 as the commencement of that Act proceeds in stages.

Q: What is the Digital India Act proposal?

It is the working title for a proposed wholesale replacement of the Information Technology Act, 2000, publicly discussed by the Ministry of Electronics and Information Technology through ministerial statements and stakeholder consultations. The proposal was presented as the vehicle that would legislate directly for the subjects the parent Act never contemplated when it was enacted for electronic commerce: platform obligations and accountability, online harm, digital media and emerging technologies such as artificial intelligence. No Bill under that name has been introduced in Parliament, so there is no enacted text, no committee report and no commencement date. Its importance is diagnostic. Until a replacement is introduced, the subjects it was meant to cover continue to be governed by rules made under the statute of 2000.

Q: How much technology law sits in rules rather than statutes?

Most of the operative law. The general statute has been amended substantively once, in 2008, while the rules beneath it have been replaced or rewritten repeatedly: intermediary obligations were recast in 2021 and amended again in 2022, the data protection rules of 2011 are giving way to those of 2025, and the incident reporting duties that bind every company were imposed in 2022 by directions of the emergency response team rather than by rules at all. The duties a platform, a data fiduciary or an internet company actually performs day to day, the grievance officers, the compliance reports, the six hour incident clock, the log retention periods, are found in subordinate instruments. The statutes supply powers, penalties and institutions; the specification of conduct sits below them.

Q: Does Indian technology law apply to foreign companies?

Yes, on hooks the statutes state expressly. The information technology statute extends to the whole of India and, by Section 75, applies to an offence or contravention committed outside India by a person of any nationality if the act involves a computer, computer system or computer network located in India. The data protection statute applies to processing outside India where it is connected with offering goods or services to data principals in India. The Rules of 2021 impose their heaviest duties on significant social media intermediaries serving Indian users and require resident compliance and grievance officers in India. Enforcement against a company with no Indian presence is harder than assertion of jurisdiction, and in practice the blocking power and the obligations attached to Indian operations do the reaching.

Q: Which technology bills were never enacted?

Three failures shape the field. The Personal Data Protection Bill, 2019 was introduced, examined by a joint committee of Parliament which reported in December 2021 with extensive proposed changes, and then withdrawn by the government in August 2022; a leaner and different statute followed in 2023. The Digital India Act, the proposed replacement for the information technology statute, has been discussed and consulted on but never introduced. The Broadcasting Services (Regulation) Bill was published as a draft in November 2023, recirculated in a widened form to selected stakeholders in 2024, and withdrawn in August 2024 with a promise of fresh consultation that produced no introduced Bill. Each failure left the subject to be governed, in the meantime, by rules under older statutes.

Q: What is the difference between an Act and the rules made under it in technology law?

An Act is enacted by Parliament after debate and vote in both Houses and assent; rules are made by the executive under a power the Act itself confers, take effect on publication in the Gazette, and are laid before Parliament, which may modify or annul them but in practice rarely does. The Act fixes the power, the penalty ceiling and the institution; the rules fix the conduct: timelines, forms, thresholds, officers to be appointed and reports to be filed. A rule cannot exceed its parent Act, and courts test challenged rules against the parent section that authorises them, which is the ground on which parts of the Rules of 2021 have been stayed or struck. In this field the practical consequence is that the Act changes once a generation while the rules change whenever the ministry notifies.

Q: Which rules govern social media platforms in India?

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, made under the information technology statute and notified in February 2021. They replaced the intermediary guidelines of 2011. Every intermediary must publish its user rules, appoint a grievance officer, acknowledge complaints within twenty four hours and resolve them within fifteen days. Platforms crossing the notified threshold of fifty lakh registered users are significant social media intermediaries and carry heavier duties: a chief compliance officer, a nodal contact person and a resident grievance officer in India, and monthly compliance reports. An amendment of October 2022 created Grievance Appellate Committees, appointed by the Centre, to hear appeals against platform grievance decisions. The parent Act supplies only the safe harbour in Section 79; the working obligations are all in the Rules.

Q: What do the CERT-In directions require companies to do after a cyber incident?

The directions issued by the Indian Computer Emergency Response Team on 28 April 2022, under Section 70B(6) of the information technology statute and effective from 27 June 2022, require service providers, intermediaries, data centres, body corporates and government organisations to report specified classes of cyber incident to CERT-In within six hours of noticing the incident or having it brought to their notice. The listed classes include unauthorised access, data breaches and data leaks, attacks on critical systems and ransomware events. The same directions require logs of information and communication technology systems to be kept for a rolling one hundred and eighty days, system clocks to be synchronised to the national time servers, and data centres, cloud, virtual private server and virtual private network providers to maintain validated subscriber records for five years.

Q: How can a reader check whether a technology rule has been replaced?

By following the Gazette rather than the commentary. Rules in this field are made, amended and replaced by notification in the Official Gazette, so the reliable method is to identify the parent section, find the rule set made under it, and then check for later notifications that amend or supersede it, reading the consolidated text as last amended. The pattern of the field makes the check necessary: the intermediary guidelines of 2011 looked current in many manuals years after the Rules of 2021 replaced them, and the data protection rules of 2011 remain the text a careless search returns even as the rules of 2025 displace them. Ministry websites and the Gazette’s own archive carry the notifications; a textbook, however recent, is a snapshot of a moving target.

Q: Why are the IT Rules of 2021 challenged in court?

Because the challenges say the Rules do more than their parent Act permits. The Rules were made under the information technology statute, whose intermediary provision grants a safe harbour conditional on due diligence. Petitioners, including the Internet Freedom Foundation and the Editors Guild of India, argue that a power to prescribe diligence cannot support a full regulatory regime for platforms, a code of ethics for digital news publishers, traceability obligations affecting encrypted messaging, or government appointed appellate committees inside private moderation. The government answers that the Rules operationalise the statute’s own conditions and rule-making power. Courts have decided pieces of the argument: the Bombay High Court stayed the code of ethics provisions for digital media in 2021 and held the government fact check amendment unconstitutional in 2024, while the Rules as a whole remain in force.

Q: What is the difference between the IT Act and the DPDP Act?

They govern different layers of the same activity. The information technology statute of 2000 is the general statute: electronic records and signatures, computer offences, intermediary liability, interception and blocking, and the parent of most of the field’s rules. The Digital Personal Data Protection Act, 2023 is a specialist statute for one subject, the processing of digital personal data, built on consent and specified legitimate uses, with obligations on data fiduciaries, rights for data principals, a dedicated Data Protection Board and penalties expressed in crores. The overlap is historical: data protection first lived inside the older Act, in the negligence based compensation provision of Section 43A and the rules of 2011, and the Act of 2023 provides for that provision’s omission as its own commencement proceeds, transferring the subject to the specialist statute.

Q: Which laws apply to a startup launching an app in India?

The routing depends on what the app does, and a founder works through the field’s layers in order. The information technology statute and the Rules of 2021 apply if the app hosts user content or acts as an intermediary, with grievance machinery to build from the start. The data protection statute of 2023 and its rules govern the personal data the app collects, and the emergency response directions of 2022 impose incident reporting and log retention on the company as a body corporate. If the app authenticates identity through Aadhaar, the Aadhaar Act and its regulations govern that use; if it provides a communication service, the telecommunications statute’s authorisation regime is engaged. Sectoral regulators add their own layers for payments, lending, health and securities, each writing technology rules under its own statute.

Q: How does a citizen complain about harmful content on a social media platform?

The first forum is the platform itself. The Rules of 2021 require every intermediary to appoint a grievance officer whose name and contact details are published, to acknowledge a complaint within twenty four hours and to resolve it within fifteen days, and the complaint mechanism must track the complaint with a unique identification number. If the grievance officer’s decision does not resolve the matter, the amendment of October 2022 gives the complainant an appeal to a Grievance Appellate Committee appointed by the Central Government, which is expected to decide within thirty days. Content that amounts to an offence can also be reported to the police and through the national cyber crime reporting portal, and a person seeking state blocking of content petitions the government under the blocking rules, though that route is neither quick nor public.

Q: Is there a law that governs artificial intelligence in India?

No statute is addressed to artificial intelligence as such. No Act defines an artificial intelligence system, licenses one or assigns liability for its outputs, and proposals for technology legislation have spoken of addressing emerging technologies without producing an introduced text that does so. Artificial intelligence systems are reached instead through the general instruments: the data protection statute where a system processes personal data, the offence and intermediary provisions of the information technology statute where its outputs or its misuse cause the harms those provisions name, the consumer protection framework for misleading claims, and sectoral regulators, in finance, health and elsewhere, issuing directions within their own statutes. The result is governance by accumulation rather than by design, and a reader should treat any claim of a dedicated Indian artificial intelligence law as an error.

Q: What happens when a technology rule conflicts with its parent Act?

The rule fails to the extent of the conflict. Delegated legislation is valid only within the power the parent Act confers, and a rule that contradicts the Act, exceeds its rule-making section, or imposes obligations of a kind the Act does not contemplate is ultra vires and liable to be struck down or stayed by a High Court or the Supreme Court. That doctrine is the working limit on the field’s method of governing by notification, and it has bitten in practice: provisions of the Rules of 2021 have been stayed, and the fact check amendment of 2023 was held unconstitutional by the Bombay High Court in 2024. The executive can usually repair the position only by persuading Parliament to amend the Act or by rewriting the rule within the power that exists, which is why the vires argument, not the merits, decides many technology cases.

Q: How are streaming services and digital news publishers regulated in India?

Through the third part of the Rules of 2021, administered by the Ministry of Information and Broadcasting rather than by the electronics ministry that made the Rules. Publishers of online curated content, the streaming services, are placed under a code of ethics that carries the classification logic of film and television into streaming, with content classified by age suitability and access controls for adult material. Publishers of news and current affairs content on digital media must furnish information to the Ministry and follow the same code. Both classes sit inside a three tier structure: self regulation by the publisher, oversight by a self regulating body of publishers, and an inter-departmental committee of the government at the apex, with grievance timelines at each tier. The code of ethics provisions were stayed by the Bombay High Court in 2021 in the challenges to the Rules, and their position is contested in pending litigation.

Q: What is the role of state governments in Indian technology law?

Operational rather than legislative. Parliament’s competence over communications and its residuary power leave little room for state technology statutes, and the field’s Acts are Union Acts. But the offences those Acts create are investigated by state police forces, through cyber cells and specialised units that states have built at very uneven speeds, and prosecuted in state courts. State home departments are also one of the two levels of competent authority that can authorise interception under the rules of 2009, so the surveillance machinery itself is partly state worked. States issue their own information technology and electronics policies, run data centres and service delivery platforms, constitute state level response arrangements and legislate at the field’s edges under their own list entries, on subjects such as land records digitisation and state public services. The Union writes the law; the states work much of it.