Navigating India’s Digital Regulatory Framework
In India, digital services are governed by an interlocking framework of horizontal technology laws, sectoral regulations, consumer protection mandates, commercial statutes, and tax codes.
Here is a structured overview of the primary direct and indirect laws applicable to digital services operating in or targeting India.
Core Cyber, Data & Technology Laws (Direct Impact)
Information Technology Act, 2000 (IT Act, as amended):
Intermediary Guidelines & Digital Media Ethics Code Rules, 2021 (amended 2022 & 2023): Governs “safe harbour” protection (Section 79) for platforms, search engines, and social media; mandates due diligence, appointment of grievance officers, time-bound takedown mechanisms, and oversight of online gaming.
Cybersecurity Directions (CERT-In, 2022): Requires mandatory 6 hour reporting of specified cybersecurity incidents, 180 day logging within Indian jurisdiction, and strict KYC for VPN, VPS, and cloud service providers.
SPDI Rules, 2011: Currently transitional framework for reasonable security practices regarding sensitive personal data.
Digital Personal Data Protection Act, 2023 (DPDP Act):
Governs processing of digital personal data. Establishes grounds for processing, stringent consent architecture, rights of Data Principals, duties of Data Fiduciaries, and heavy financial penalties (up to ₹250 crore) administered by the Data Protection Board of India.
Consumer Protection & E-Commerce Regulations (Direct Impact)
Consumer Protection Act, 2019:
Consumer Protection (E-Commerce) Rules, 2020 (amended 2021): Enforces transparency on marketplace and inventory models, mandatory country of origin display, clear refund/cancellation policies, and bans unfair price manipulation or anti competitive flash sales.
Guidelines on Prevention and Regulation of Dark Patterns, 2023: Prohibits 13 deceptive UI/UX design patterns (e.g., false urgency, basket sneaking, forced continuity, subscription traps, confirm shaming) across digital platforms.
Financial Technology, Payments & Banking Regulations (Direct Impact for FinTech / Indirect for Merchant Services)
Payment and Settlement Systems Act, 2007 (PSSA):
Governs all digital transaction infrastructure, Prepaid Payment Instruments (PPIs/wallets), and payment gateways.
RBI Regulations & Master Directions:
Payment Aggregator (PA) & Payment Gateway (PG) Directions: Licensing standards, merchant due diligence, and escrow account operations.
Storage of Payment System Data (Data Localization Directive, 2018): Mandates that end to end payment data must be stored exclusively on servers located in India.
Digital Lending Guidelines (2022): Eliminates pool accounts (direct disbursal to borrower accounts only) and restricts mobile app access to phone storage, contacts, and media.
Prevention of Money Laundering Act, 2002 (PMLA) & KYC Directions:
Regulates Digital/Video KYC (V-CIP) and mandates reporting compliance with the Financial Intelligence Unit (FIU-IND), including explicit coverage for Virtual Digital Asset (VDA) service providers.
Commercial, Contractual & Evidentiary Framework (Foundational)
Indian Contract Act, 1872:
Determines the validity and enforceability of digital agreements (click-wrap, browse-wrap, sign-in-wrap) and standard form terms of service.
Bharatiya Sakshya Adhiniyam, 2023 (BSA) (replacing the Indian Evidence Act, 1872):
Sections 61–63 govern the legal recognition and admissibility of electronic records, server logs, digital signatures, and electronic communications in judicial proceedings.
Competition & Antitrust Regulations (Direct Impact on Market Platforms)
Competition Act, 2002 (as amended by Competition (Amendment) Act, 2023):
Scrutinizes algorithmic collusion, predatory pricing, self preferencing, and abuse of dominant position in digital multi sided markets (app stores, e-commerce search rankings).
Introduces the Deal Value Threshold (DVT) of ₹2,000 crore, requiring merger clearance for high value acquisitions of digital targets with significant business presence in India.
(Proposed) Draft Digital Competition Bill: Envisages ex-ante regulations for Systemically Significant Digital Enterprises (SSDEs).
Intellectual Property Rights in Cyberspace (Direct & Indirect)
Copyright Act, 1957 (amended 2012):
Governs digital piracy, circumvention of technological protection measures (Section 65A), digital rights management (DRM), and transient electronic storage safe harbours.
Trade Marks Act, 1999:
Protects against online trademark infringement, meta-tag manipulation, cybersquatting, and deceptive sponsored keyword bidding.
Patents Act, 1970:
Section 3(k) regulates the patentability boundaries for computer-related inventions (CRIs), software, and business methods.
Digital Taxation & Fiscal Levies (Direct Impact)
Income Tax Act, 1961:
Significant Economic Presence (SEP): Tax nexus based on user thresholds and digital revenue from India.
Section 194-O: Tax Deducted at Source (TDS) on e-commerce transactions deducted by platform operators.
Section 115BBH & Section 194S: 30% tax on gains from Virtual Digital Assets (cryptocurrency/NFTs) and 1% TDS on transactions.
Goods and Services Tax (GST) Laws (CGST & IGST Acts):
OIDAR (Online Information Database Access and Retrieval) Services: Requires foreign digital service providers (cloud, streaming, software downloads) to register and pay 18% GST when providing services to unregistered consumers in India.
Online Gaming Levy: 28% GST on full face value of entry fees for online real money games.
Section 52 CGST: Tax Collection at Source (TCS) mandates for e-commerce operators.
Criminal Law, National Security & Telecom (Direct & Indirect)
Telecommunications Act, 2023:
Replaces legacy telegraph laws; covers authorized telecom networks and critical digital transmission infrastructure.
Bharatiya Nyaya Sanhita, 2023 (BNS) & Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS):
Enforces criminal penalties for digital fraud, identity theft, impersonation, and harassment; governs powers of law enforcement regarding digital search, device seizure, and legal summons.
Section 69A of the IT Act & Blocking Rules:
Government authority to block public access to websites, apps, and online content on grounds of national sovereignty, defence, security, or public order.
Sector-Specific Digital Regulations
| Sector | Relevant Framework |
|---|---|
| HealthTech | Telemedicine Practice Guidelines, 2020; Ayushman Bharat Digital Mission (ABDM) standards. |
| EdTech | UGC/AICTE Regulations on Online Education; self regulatory guidelines on advertising and disclosures. |
| Online Gaming | IT Intermediary Rules (Permissible Online Games provisions) + State specific Gaming/Gambling Enactments. |
| Broadcasting & OTT | Part III of IT Rules, 2021 (Self classification of content into age brackets and digital code of ethics). |
