Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 14 APRIL 2026

From Safe Harbour To Command‑And‑Control: How India's 2026 IT Rules Draft Turns Intermediary Compliance Into Real‑Time Obedience

King, Stubb & Kasiva
King, Stubb & Kasiva
Contributor
King, Stubb & Kasiva

King, Stubb & Kasiva

King Stubb & Kasiva is few of the top corporate law firms in India with offices in Bengaluru,...

View firm profile
Explore more from King, Stubb & Kasiva

On March 30, 2026, the Ministry of Electronics and Information Technology ("MeitY") has circulated draft Second Amendment Rules, 2026 ("Draft Amendment") to the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 ("IT Rules, 2021"), proposing the consequential structural realignment of India's intermediary liability.

IndiaMedia, Telecoms, IT, Entertainment
Tanishq Acharya
Tanishq Acharya
Srishti Rathore
Srishti Rathore
Author LinkedIn connections

1. INTRODUCTION

On March 30, 2026, the Ministry of Electronics and Information Technology ("MeitY") has circulated draft Second Amendment Rules, 2026 ("Draft Amendment") to the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 ("IT Rules, 2021"), proposing the consequential structural realignment of India's intermediary liability.

These amendments represent a fundamental recalibration of how India regulates digital intermediaries- moving away from a rules-based compliance architecture toward a model where executive direction itself becomes the compliance standard. For platforms, publishers, and content creators, the shift carries material operational and legal consequences that demand immediate strategic response.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

Instagram’s 2026 AI Labelling Rules

Instagram's 2026 policy shift introduces mandatory AI-generated profile labels and penalties for non-disclosure, creating new compliance challenges at the intersection of platform governance and India's statutory framework for synthetically generated information. How do these overlapping regimes affect brands, influencers, and content creators operating in India's digital ecosystem?
IndiaMedia, Telecoms, IT, Entertainment
Global Advertising Lawyers Alliance (GALA)
Global Advertising Lawyers Alliance (GALA)
Article

The Promotion And Regulation Of Online Gaming Act, 2025 And The Promotion And Regulation Of Online Gaming Rules, 2026

The Act, the Rules and the OGAI are therefore simultaneously operational. The prohibition provisions under Chapter III of the Act, the criminal penalties under Chapter V of the Act and the institutional framework under the Rules are all in effect. There is effectively no formal compliance window for core prohibitions and penalties; stakeholders should treat the regime as immediately operational and adjust business models without delay.
IndiaMedia, Telecoms, IT, Entertainment
King, Stubb & Kasiva
King, Stubb & Kasiva
Article

Telegram Ban In India – The Rise Of Digital Sovereignty

The Delhi High Court's landmark ruling in Telegram FZ LLC v. Union of India addresses whether Section 69A of the IT Act permits the government to block an entire platform rather than specific content. Following the NEET-UG 2026 paper leak scandal, where fraudulent channels circulated fake exam papers affecting millions of aspirants, the court upheld the Centre's power to impose a platform-wide ban on Telegram, sparking intense debate about the boundaries between examination integrity and digital censorship.
IndiaMedia, Telecoms, IT, Entertainment
Hammurabi & Solomon Partners
Hammurabi & Solomon Partners
Article

DOT Notifies Telecom Network Authorisation Rules, 2026: What Has Changed?

On 20 July 2026, the Department of Telecommunications (DoT) notified the Telecommunications (Authorisation for Telecommunication Network) Rules, 2026 (Rules). The Rules operationalise Section 3(1)(b) of the Telecommunications Act, 2023 and establish a framework for six categories of telecommunication network authorisations: infrastructure provider (IP) (formerly, IP-I), digital connectivity infrastructure provider (DCIP), internet exchange point (IXP) provider, satellite earth station gateway (SESG) provider, cloud-hosted telecommunication network (CTN) provider and mobile number portability (MNP) provider.
IndiaMedia, Telecoms, IT, Entertainment
Khaitan & Co.
Khaitan & Co.
Article

Is Meta Still Just An Intermediary? Why India Is Rethinking Safe Harbour

In mid-September 2026, government sources said Meta Platforms’ Indian operations, Facebook, Instagram and Threads, should no longer be viewed merely as an “internet intermediary” but should also be treated as a “service provider,” arguing that the company’s monetised algorithms actively decide what content gets amplified, distributed and shown to whom. That is a government position, not a new statutory classification, and this article returns to that distinction below.
IndiaMedia, Telecoms, IT, Entertainment
S.S. Rana & Co.
S.S. Rana & Co.
Article

DPDP Data Breach Notification In India: Timelines, Requirements And Key Compliance Considerations

A personal data breach can create immediate legal, operational, and reputational consequences for an organisation. Under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules), specific obligations have been prescribed for Data Fiduciaries following a personal data breach. While organisations may already have broader data protection and cybersecurity measures in place, breach notification requires a distinct and time-sensitive response. The DPDP framework requires communication both to affected Data Principals and to the Data Protection Board of India.
IndiaPrivacy
King, Stubb & Kasiva
King, Stubb & Kasiva
Article

Cross-Border Data Transfers Under India’s DPDP Act: Rules, Restrictions And Compliance Roadmap For 2027

India’s Digital Personal Data Protection Act, 2023 (DPDP Act) introduces a relatively permissive framework for the cross-border transfer of personal data from India. Unlike the European Union’s GDPR, which relies extensively on adequacy decisions and prescribed transfer safeguards, the DPDP framework adopts a negative-list approach: international transfers are generally permitted, subject to restrictions that may be notified by the Central Government.
IndiaPrivacy
King, Stubb & Kasiva
King, Stubb & Kasiva
Article

Data Retention And Deletion Under The DPDP Act: How Long Can Businesses Retain Personal Data In India?

India’s data protection framework has moved from legislation to implementation. With the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) now notified, organizations processing personal data in India need to reassess how long they retain personal data, why they retain it, and how they ultimately delete or anonymize it.
IndiaPrivacy
King, Stubb & Kasiva
King, Stubb & Kasiva
Article

CCPS In India: Why Compulsorily Convertible Preference Shares Remain Central To Venture Capital And M&A Transactions

Compulsorily Convertible Preference Shares (CCPS) remain one of the most widely used instruments for venture capital and private equity investments in Indian companies. Their appeal lies in the ability to combine equity classification with negotiated economic and governance protections. But CCPS are not governed by a single, standalone statutory framework. Their legal treatment is instead shaped by the Companies Act, FEMA and foreign investment rules, tax law, and, where applicable, SEBI regulations.
IndiaCorporate/Commercial Law
King, Stubb & Kasiva
King, Stubb & Kasiva
Article

DPDP Act And Rules 2025: The 2026 Compliance Milestones Businesses Can’t Afford To Miss

India’s data protection regime has moved well past the discussion stage. With the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) notified by the Ministry of Electronics and Information Technology (“MeitY”) on 13 November 2025, the Digital Personal Data Protection Act, 2023 (“DPDP Act”) now has a defined implementation roadmap, and 2026 is the year businesses should be using to prepare for substantive compliance.
IndiaPrivacy
King, Stubb & Kasiva
King, Stubb & Kasiva
Article

What Happens To Existing SPDI Rules After Full DPDP Enforcement?

India’s data protection landscape is undergoing its most significant shift in over a decade. The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), have long formed the core of personal data protection obligations under the Information Technology Act, 2000 (“IT Act“) for body corporates handling sensitive personal data or information.
IndiaPrivacy
King, Stubb & Kasiva
King, Stubb & Kasiva
Article

Banking & Finance Updates September 2026

In August 2026, the Reserve Bank of India (RBI) released the draft Reserve Bank of India (Interest Rates on Loans and Advances) Directions, 2026, proposing a comprehensive framework for the way regulated entities determine and apply interest rates on loans. While the Indian banking sector has long operated under a patchwork of institution specific instructions, the draft Directions seek to bring much-needed consistency to interest rate regulation across banks, cooperative banks, regional rural banks (RRBs), all-India financial institutions and NBFCs. If finalised in their present form, the Directions will come into effect from 1 April 2027.
IndiaFinance and Banking
King, Stubb & Kasiva
King, Stubb & Kasiva
Article

Direct Tax Newsletter - Sep - Oct 2026

The CBDT, through its press release dated 28 September 2026, has extended the due date for furnishing the Return of Income for Assessment Year 2026-27 in the case of persons covered under the specified category in the table to Explanation 2 to section 139(1) of the Income-tax Act, 1961, i.e. persons whose accounts are subject to audit under the Act. The original due date for furnishing the return was 31 October 2026. The CBDT has extended this date by 21 days, and the revised due date is 21 November 2026.
IndiaTax
King, Stubb & Kasiva
King, Stubb & Kasiva
Article

How Does The DPDP Act Regulate AI Training And Automated Decision-Making In India

The rapid adoption of artificial intelligence (“AI”) has brought data protection considerations into the design, training and deployment of AI systems. AI models may be trained using datasets containing names, images, text, identifiers, behavioural information or other data that can relate to identifiable individuals. AI systems may also process personal data when they are deployed for purposes such as recruitment, credit assessment, insurance, healthcare, customer profiling or content moderation.
IndiaPrivacy
King, Stubb & Kasiva
King, Stubb & Kasiva
Article

DPDP Act Compliance For Startups And MSMEs: A Minimum Viable Data Protection Framework

The Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) were notified on 13 November 2025, more than two years after the Digital Personal Data Protection Act, 2023 (“DPDP Act” or “Act”) received Presidential assent. The Government has adopted a phased implementation approach, with most of the substantive obligations under the Act and Rules becoming operative 18 months from the date of notification, i.e., on 13 May 2027.
IndiaPrivacy
King, Stubb & Kasiva
King, Stubb & Kasiva