As per the Foreign Trade Policy, 2015-2020, India has distinguished between goods that are new and those that are second-hand, remanufactured, refurbished or reconditioned. The country allows the import of second-hand capital goods by end-users without an import license, provided the goods have a residual life of five years. In addition, users are required to present the certificate of an Indian chartered engineer attesting that such spare parts have at least 80% residual life of the original spare part, while second-hand domestic capital goods are not subject to this requirement. Problems reported by industry representatives include excessive details required in the license application, quantity limitations set at specific part numbers, and long delays between application and license issuance. According to a 2018 amendment (DGFT Notification No. 58/2015-2020), second-hand goods imported for repair, refurbishment, reconditioning or re-engineering purposes can be exported back under the customs notification provided that the waste generated during the repair or refurbishment of the imported items is treated in accordance with national environmental laws/regulations/rules/regulations/standards.

On 30 July 2020, the Indian Directorate General of Foreign Trade, through Notification No. 22/2015-2020, amended the import policy of colour television sets from "Free" to "Restricted". According to the notification, a license shall be required for imports of these TV sets, including smart TVs.

According to the Electronics and Information Technology Goods (Requirement of Compulsory Registration) Order of 2021, and subsequent notifications, 76 ICT products must undergo registration and labelling prior to being launched in the market. In addition, no person shall manufacture or store for sale, import, sell, or distribute goods that do not conform to the Indian standard specified in the order and do not bear the Standard Mark with a unique registration number obtained from the Bureau of Indian Standards (BIS). BIS grants a license to the manufacturers to use or apply Standard Mark with a unique R-number through registration based on self-declaration of conformity for goods and articles as per Indian Standards. Examples of products subject to the scheme include set-top boxes, amplifiers, laptops/notebooks/tablets, scanners, printers, and mobile phones. It is reported that India has been tightening quality clearances for electronic products from China, which has ended up holding up products such as mobile phones from Chinese companies. While applications to the BIS are typically processed within 15 days, they now take more than two months.

According to Notification No. 5 (2015-2020), the import of goods (new as well as second-hand, whether or not refurbished, repaired, or reconditioned) notified under the Electronics and Information Technology Goods (Requirement of Compulsory Registration) Order of 2021 is prohibited unless they are registered with the Bureau of Indian Standards and comply with its labelling requirements, or on a specific exemption letter from the Ministry of Electronics and Information Technology (MEITY) for a particular consignment.

According to the Consolidated Foreign Direct Investment (FDI) Policy Circular 2020, for any single-brand retail, including e-commerce entities with physical stores in India, foreign investment exceeding 51% is only allowed when 30% of the value of goods purchased is done from India. This requirement was established by the Consolidated Foreign Direct Investment (FDI) Policy Circular 2013. It is reported that India has modified the requirements in recent years, including by allowing firms to offset the local sourcing requirement by sourcing products from India for global supply chains. In addition, despite these modifications, it is reported that the local content requirements remain prohibitive for certain retailers with highly specialised supply chains.

According to the Foreign Trade (Development and Regulation) Act, the export of dual-use items and technologies is either prohibited or permitted under a license. The list of dual-use items also includes electronics, computers, and information technology, including information security.

In September 2017, India’s Ministry of Communications introduced the Telegraph (Amendment) Rules, requiring testing and certification for all telegraph equipment. This formed the basis for the implementation of the Mandatory Testing and Certification of Telecom Equipment (MTCTE) procedures in 2019, which mandate local security testing for telecom products. In September 2021, the MTCTE programme was expanded to include 175 products, prompting concerns from stakeholders about the burden of in-country testing requirements.
Additionally, the 2021 Electronics and Information Technology Goods (Requirement of Compulsory Registration) Order requires manufacturers and importers to register and certify their products with laboratories accredited by the Bureau of Indian Standards, even if those products are already certified internationally. Expanded to cover 63 product categories, this order has drawn criticism due to limited government testing capacity, a complex registration process, and high compliance costs—including factory- and component-level testing.
In response, the Department of Telecommunications (DoT) has released the draft Telecommunications (Standards, Conformity Assessment and Certification) Rules, 2025. These Draft Rules, notified under Section 19 of the Telecommunications Act, 2023 (which repealed the Telegraph Act of 1885), aim to revise and streamline the framework for standardisation and certification of telecom equipment in India. Once finalised, the Draft Rules will supersede and replace the earlier Telegraph (Amendment) Rules.

The rules on security clearance for telecom equipment have required that telecom service providers (TSPs) use network elements that have been tested as per contemporary Indian or international security standards. Since April 2013, no certification of network equipment has been undertaken by authorised and certified agencies/labs in India.
Only resident-trained Indian nationals can be employed as executives responsible for certain security checks. There is also a possibility of extensive inspections of hardware, software, design, development and manufacturing facilities, as well as supply chains that might jeopardise intellectual property rights. High fines are imposed in case of non-compliance.
Additionally, since September 2017, India's Telegraph (Amendment) Rules require onerous in-country security testing on all telecom network equipment and products. Previously, such products could be tested and certified in laboratories globally or at manufacturers' in-house laboratories (self-certification). Mandatory testing and certification by Indian laboratories trigger additional costs and unnecessary delays for companies, especially given that the availability of suitable laboratories in India remains unclear. Furthermore, there are concerns about India's compulsory security certification scheme (CRS).
The Department of Telecommunications (DoT) has released the draft Telecommunications (Standards, Conformity Assessment and Certification) Rules, 2025 (Draft Rules), revising and streamlining the framework for the standardisation and certification of the telecom equipment in India. The Telegraph (Amendment) Rules, 2017, continue to be operative under the transitional provisions of the Telecommunications Act, 2023, until they are formally repealed or replaced by new regulations.

According to Art. 4.2 of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules of 2021, a significant social media intermediary (defined as a social media intermediary having a number of registered users in India above five million) providing messaging services must enable identification of the first originator of the information on its computer resource as may be required by a judicial order or an order passed by a competent authority. In complying with an order for the identification of the first originator, a significant social media intermediary will not be required to disclose the contents of the electronic message related to the first originator or other users. No order must be passed in cases where there are less intrusive means of identifying the originator of the information.

India has not joined any agreement with binding commitments to open transfers of data across borders.

Section 69A of the Information Technology Act empowers the Central Government, or any officer expressly authorised by it for this purpose, to issue directions for the blocking of public access to information where it is satisfied that such action is necessary or expedient. Such directions may be issued in the interests of the sovereignty and integrity of India, the defence of India, the security of the State, friendly relations with foreign States, public order, or for the prevention of incitement to the commission of any cognisable offence relating to these grounds. Where these conditions are met, the Government may, for reasons recorded in writing, order any government agency or intermediary to block, or to cause the blocking of, public access to any information that is generated, transmitted, received, stored, or hosted in any computer resource.
Pursuant to Section 69A of the Information Technology Act, read together with the relevant provisions of the Information Technology (Procedure and Safeguards for Blocking for Access of Information by Public) Rules:
- TikTok, WeChat, and 57 other applications of Chinese origin were banned in India with effect from 29 June 2020, with the blocking orders remaining in force as of 2025.
- 14 messaging applications were blocked in early May 2023, with the restrictions remaining in place as of 2025. Subsequent court proceedings clarified that these blocking orders were, in fact, geographically limited to Jammu and Kashmir. The Delhi High Court upheld the ban on Briar primarily on the basis that its application was confined to the Union Territory of Jammu and Kashmir.

The Digital Personal Data Protection Act establishes a comprehensive regime for safeguarding digital personal data in India, extending its reach extraterritorially where processing relates to the provision of goods or services to individuals in India. It imposes statutory duties on data fiduciaries, confers defined rights upon data principals, and generally permits the outward transfer of personal data. The Act introduces the novel institution of independent consent managers, entrusted with administering individuals’ consent and operating separately from data fiduciaries and data processors. It further provides for significant penalties for non‑compliance, including a maximum fine of INR 2.5 billion (approx. USD 31 million), and designates the Data Protection Board of India as the regulatory authority. The Act is implemented in phases, with certain provisions commencing on 13 November 2025, further provisions taking effect one year thereafter, with the remaining substantive provisions entering into force in May 2027.

It is reported that several instances of the blocking of commercial web content occurred in India in 2025, as detailed below:
- 23 social media and messaging platforms were blocked in Jamui District, Bihar, from 23:30 on 16 February 2025 until 23:30 on 18 February 2025.
- 23 social media and messaging platforms were blocked in Katihar District, Bihar, from 20:00 on 6 July 2025 until 20:00 on 7 July 2025.
- 23 social media and messaging platforms were blocked in the Hathwa sub‑division of Gopalganj District, Bihar, from 12:00 on 30 September 2025 until 12:00 on 2 October 2025.
- At least four platforms were shut down for several days in October 2025 across three areas of Cuttack city, Cuttack District, Odisha, namely the Cuttack Municipal Corporation (CMC) area, the Cuttack Development Authority (CDA) area, and the 42 Mauza region.
- At least four platforms were shut down for several days in December 2025 in Malkangiri District, Odisha.

Section 5 of Direction No. 20(3)/2022-CERT-In mandates data centres, virtual private server providers, cloud service providers, and virtual private network service providers to mandatorily collect and retain certain subscriber-related information accurately for a minimum period of five years after the subscriber is no longer availing the underlying services. These data sets include subscriber names, period of hire including dates, IPs allocated and used, e-mail address along with IP and time stamp used at time of registration, purpose of availing the services, verified address and contact numbers, and ownership pattern of subscribers. Virtual asset service providers, virtual asset exchange providers and custodian wallet providers must also maintain KYC information and records of financial transactions for a period of 5 years. Specific to transaction records, Direction No. 20(3)/2022-CERT-In states that information must be maintained accurately in such a way that individual transactions can be reconstructed along with the relevant constituents such as IP addresses, time zones, transaction ID, public keys or equivalent identifiers, addresses or accounts involved, nature and date of transaction, amount transferred, etc.

According to the License Agreement for Provision of Internet Services, the Internet Service Provider licensee shall maintain all commercial records, call detail records, exchange detail records, and IP detail records with regard to the communications exchanged on the network. Such records shall be archived for at least two years for scrutiny by the Licensor for security reasons and may be destroyed thereafter unless directed otherwise by the Licensor.