According to Section 84A of the Information Technology Act, the Government may, for secure use of the electronic medium and for promotion of e-governance and e-commerce, prescribe the modes or methods for encryption. However, no rules have been introduced under this section.

Since 2011, the rules on security clearance for telecom equipment require that Telecom Service Providers (TSP) must use network elements which have been tested as per contemporary Indian or international security standards. From April 2013, any certification of network equipment must only be undertaken from authorized and certified agencies/labs in India.
Only resident trained Indian nationals can be employed as executives responsible for certain security checks. There is also a possibility of extensive inspections of hardware, software, design, development and manufacturing facilities as well as supply chains that might jeopardize intellectual property rights. High fines are imposed in case of non-compliance.
Additionally, since April 2018, India's Telegraph (Amendment) Rules require onerous in-country security testing on all telecom network equipment and products. Previously, such products could be tested and certified in laboratories globally, or at in-house laboratories of the manufacturers (self-certification). Mandatory testing and certification by Indian laboratories triggers additional cost and unnecessary delays for companies, especially given that the availability of suitable laboratories in India remains unclear. Furthermore, there are concerns on India's compulsory security certification scheme (CRS).

The Indian government used to block purchases of telecoms equipment from Chinese vendors on national security grounds. The Department of Telecommunications had amended its license conditions for mobile service providers, and required them to submit all plans for procurement of telecoms equipment from foreign vendors for screening and “security clearance” purposes. Although the amendment did not single out China, it is reported that, in practice, security agencies had been blocking applications involving Chinese vendors.
The aforesaid process is soon to be replaced with a new Directive, which will enter into force in mid-2021. The Department of Telecommunications will declare a list of trusted sources and products for installations in India's telecom network. The methodology to designate trusted products will be devised by the designated authority (National Cyber Security Coordinator). As per the directive, telecom service providers will be required to connect new devices from the list of trusted products. The list of trusted sources and products will be decided based on the approval of a committee headed by the deputy national security advisor. When announcing the directive, the Telecom and IT Minister said that measures will be taken to increase the use of equipment from trusted Indian sources.

India's Compulsory Registration Scheme mandates that 76 ICT products must undergo registration and labelling prior to being launched in the market. No person shall manufacture or store for sale, import, sell or distribute goods which do not conform to the Indian standard specified in the order and do not bear the Standard Mark with unique registration number obtained from the Bureau of Indian Standards (BIS). BIS grants licence to the manufacturers to use or apply Standard Mark with unique R-number, through registration based on self-declaration of conformity for goods and articles as per Indian Standards. Examples of products subject to the scheme include set top boxes, amplifiers, laptops/notebooks/tablets, scanners, printers and mobile phones.
It has been noted that India has been tightening quality clearances for electronic products from China which has ended up in holding up products such as mobile phones from Chinese companies. While applications to the BIS, typically processed within 15 days, but are now taking more than two months.

According to the Foreign Trade (Development and Regulation) Act, the export of dual-use items and technologies is either prohibited or is permitted under a license. The list of dual-use items also includes electronics, computers, and information technology, including information security.

According to the Consolidated Foreign Direct Investment (FDI) Policy Circular, for any single-brand retail, including e-commerce entities with physical stores in India, foreign investment exceeding 51% is only allowed when 30% of the value of goods purchased is done from India. This requirement was established by the Consolidated Foreign Direct Investment (FDI) Policy Circular 2015. It is reported that India has modified the requirements in recent years, including by allowing firms to offset the local sourcing requirement by sourcing products from India for global supply chains. In addition, despite these modifications, it is reported that the local content requirements remain prohibitive for certain retailers with highly specialized supply chains.

According to the Electronics and Information Technology Goods (Requirement for Compulsory Registration) Order, 2012, and subsequent notifications, 76 ICT products must undergo registration and labelling prior to being launched in the market. In addition, no person shall manufacture or store for sale, import, sell, or distribute goods that do not conform to the Indian standard specified in the order and do not bear the Standard Mark with a unique registration number obtained from the Bureau of Indian Standards (BIS). BIS grants license to the manufacturers to use or apply Standard Mark with a unique R-number, through registration based on self-declaration of conformity for goods and articles as per Indian Standards. Examples of products subject to the scheme include set-top boxes, amplifiers, laptops/notebooks/tablets, scanners, printers, and mobile phones. It is reported that India has been tightening quality clearances for electronic products from China which has ended up in holding up products such as mobile phones from Chinese companies. While applications to the BIS, are typically processed within 15 days but are now taking more than two months.

According to Notification No. 5 (2015-2020), the import of goods (new as well as second-hand, whether or not refurbished, repaired, or reconditioned) notified under the Electronics and Information Technology Goods (Requirement of Compulsory Registration) Order, 2012 is prohibited unless they are registered with the Bureau of Indian Standards and comply with its labeling requirements, or on a specific exemption letter from the Ministry of Electronics and Information Technology (MEITY) for a particular consignment.

As per the Foreign Trade Policy, 2015-2020, India has distinguished between goods that are new and those that are second-hand, remanufactured, refurbished or reconditioned. The country allows the import of second-hand capital goods by end-users without an import license, provided the goods have a residual life of five years. In addition, users are required to present the certificate of an Indian chartered engineer attesting that such spare parts have at least 80% residual life of the original spare part, while second-hand domestic capital goods are not subject to this requirement. Problems reported by industry representatives include excessive details required in the license application, quantity limitations set at specific part numbers, and long delays between application and license issuance. According to a 2018 amendment (DGFT Notification No. 58/2015-2020), second-hand goods imported for repair, refurbishment, reconditioning or re-engineering purposes can be exported back under the customs notification provided that the waste generated during the repair or refurbishment of the imported items is treated in accordance with national environmental laws/regulations/rules/regulations/standards.

On 30 July 2020, the Indian Directorate General of Foreign Trade through Notification No. 22/2015-2020 amended the import policy of color television sets from "Free" to "Restricted". According to the Notification, a license shall be required for imports of these TV sets, which include smart TVs.

It is reported that during the course of 2020, the Ministry of Information and Technology, based on the provisions of Section 69A of the Information Technology Act and relevant provisions of the Information Technology (Procedure and Safeguards for Blocking Access to Information by the Public) Rules, 2009, banned 267 apps in view of the emerging nature of security threats posed by these apps and the detrimental nature of these apps to sovereignty, defense and law and order in India. The Ministry has reportedly pointed out that these apps raise data security and privacy concerns. On June 29, 2020, 59 apps were banned; on September 2, 2020, 118; and on November 24, 2020, 43.

According to the Import Export Classification, Indian Trade Classification – Harmonized System (ITC-HS) Code, and Import Policy 2012, certain goods require special permission or licensing in order to be imported. Selected consumer goods, including radio and TV broadcast transmitters and communication jamming equipment, are qualified as licensed/restricted items that can only be imported after obtaining an import license from India’s Directorate General of Foreign Trade (DGFT). However, it has been reported that India is increasingly using import licenses at the discretion of the authorities to limit imports of sensitive products. In addition, it is reported that the licensing system is not automatic as it involves delays and authorized quantities can be lower than requested. The granting of licenses is limited to actual users.

According to Notification No. 107/(RE-2013)/2009-2014, GSM mobile handsets’ with duplicate International Mobile Equipment Identity Number (IMEI) or fake IMEI & ‘CDMA mobile handsets’ with duplicate Electronic Serial Number (ESN)/ mobile equipment identifier (MEID) or fake ESN/MEID are added to the list of ‘Prohibited’ items for import. The Government has taken over from a private agency to issue and manage IMEI allocation for mobile phones in India.

The indicator "6.2.4 - Government Internet shut down in practice" of the V-Dem Dataset, which measures whether the government has the technical capacity to actively make internet service cease, thus interrupting domestic access to the internet or whether the government has decided to do so, has a score of 2 in India. This corresponds to "The government shut down domestic access to the Internet several times this year."

The Indian state has reportedly shut down the internet several times in recent years. In 2021, the state shut down the internet when Indian farmers staged a months-long protest against new agricultural laws in the country's capital. Also, in 2022, a shutdown was reported in the western Indian city of Udaipur when a Hindu tailor was killed by a Muslim in an incident that raised fears of communal violence. Finally, it is reported that nearly one-third of the outages counted between 2020 and 2022 were aimed at preventing cheating on exams.