Under Section 69 of the Information Technology Act, both central and state governments are empowered to instruct any government agency to intercept, monitor, or decrypt electronic information. This authority can be exercised on the following grounds: in the interest of India's sovereignty or integrity; for the security of the State; to maintain friendly relations with foreign states; for public order; or to prevent or investigate the commission of an offence. Additionally, under Section 69B, the government is authorised to permit any agency to monitor and collect traffic data or information exchanged through a computer resource.
The Information Technology (Procedure and Safeguards for Interception, Monitoring, and Decryption of Information) Rules of 2009 and the Information Technology (Procedure and Safeguards for Monitoring and Collecting Traffic Data or Information) Rules of 2009, both promulgated under the Information Technology Act, provide procedural guidelines for carrying out such interception and monitoring. For example, Rule 3 of the latter Rules permits the collection and/or monitoring of traffic data or information via a computer resource for several purposes, including: forecasting imminent cyber incidents; monitoring network applications; identifying and determining viruses or computer contaminants; tracking cybersecurity breaches or incidents; identifying individuals who have breached or are suspected of breaching cybersecurity measures; conducting forensic analyses as part of investigations or internal audits of information security practices; accessing stored data for the enforcement of cybersecurity law; or addressing any other cybersecurity-related issues.

Pursuant to Art. 20(2) of the Telecommunications Act, 2023, in the event of a public emergency or in the interest of public safety, the Central Government, a State Government, or any officer specifically authorised by either, may issue an order—if deemed necessary or appropriate—directing that any message or category of messages, whether sent or received by any person or group of persons, through any telecommunication equipment or network, and relating to any specific subject, be prohibited from transmission, intercepted, detained, or disclosed in an intelligible format to the designated officer identified in the order. It is not clear whether a court order is required to access the data.

The Information Technology Act establishes a safe harbour regime for intermediaries for copyright infringements. Section 79 of the Act provides intermediaries with qualified immunity for unlawful content as long as they follow the prescribed due diligence requirements and do not conspire, abet or aid an unlawful act. However, the protection lapses if an intermediary with "actual knowledge" of any content used to commit an unlawful act or, on being notified of such content, fails to remove or restrict access to it.

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules of 2021 establish a safe harbour regime beyond intermediaries for copyright infringement. According to Rule 3.1(d), an intermediary, after receiving 'actual knowledge' through a court order or by being notified by a government agency, must remove information that is prohibited by law in relation to the interest and sovereignty of India, the security of the state, friendly relations with foreign states, public order, decency or morality, contempt of court, defamation, incitement to an offence or information which violates any law which is in force. Such information has to be removed within thirty-six hours from receipt of actual knowledge by the intermediary.
In addition, "significant social media intermediaries", defined as having more than five million registered Indian users, need to observe additional due diligence requirements to claim the immunity/safe harbour available. Rule 6 of the Information Technology Rules provides that even if a social media intermediary does not meet this user threshold, the Central Government may still require an intermediary to meet these additional obligations if it believes that their operations create a material risk of harm to the sovereignty and integrity of India or to the security of the State. This discretion to the Central government may lead to the arbitrary imposition of additional obligations on certain intermediaries. The additional due diligence requirements include appointing certain personnel for compliance, enabling identification of the first originator of the information on its platform under certain conditions, and deploying technology-based measures on a best-effort basis to identify certain types of content.

According to the Regulation on the Use of Aadhaar e-KYC Service of the Unique Identity Authority of India (UIDAI) for Issuing New Mobile Connections and Re-Verification of Existing Subscribers via OTP-Based Authentication, Indian citizens are required to register their SIM card with their Aadhaar Card (a type of national identity card). Foreigners have to provide their passport, a photocopy of their Indian visa/ travel permit, a passport-sized photo and contact details.

According to Art. 3.3 of the Information Technology Intermediaries Guidelines Rules, intermediaries are required to deploy technology-based automated tools or appropriate mechanisms with appropriate controls for proactively identifying and removing or disabling public access to unlawful information or content.

Section 69 of the Indian Information Technology Act (IITA) requires intermediaries to extend all facilities and technical assistance to intercept, monitor or decrypt information as well as to provide information stored in a computer or provide access to a computer resource when called upon to do so by certain agencies. This extends to online intermediaries, which are required to designate an officer to facilitate the execution of such orders. Intermediaries that fail to meet these obligations may be punished with imprisonment of up to seven years.

According to Art. 4.2 of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules of 2021, a significant social media intermediary (defined as a social media intermediary having a number of registered users in India above five million) providing messaging services must enable identification of the first originator of the information on its computer resource as may be required by a judicial order or an order passed by a competent authority. In complying with an order for the identification of the first originator, a significant social media intermediary will not be required to disclose the contents of the electronic message related to the first originator or other users. No order must be passed in cases where there are less intrusive means of identifying the originator of the information.

India has not joined any agreement with binding commitments to open transfers of data across borders.

Section 69A of the Information Technology Act empowers the Central Government, or any officer expressly authorised by it for this purpose, to issue directions for the blocking of public access to information where it is satisfied that such action is necessary or expedient. Such directions may be issued in the interests of the sovereignty and integrity of India, the defence of India, the security of the State, friendly relations with foreign States, public order, or for the prevention of incitement to the commission of any cognisable offence relating to these grounds. Where these conditions are met, the Government may, for reasons recorded in writing, order any government agency or intermediary to block, or to cause the blocking of, public access to any information that is generated, transmitted, received, stored, or hosted in any computer resource.
Pursuant to Section 69A of the Information Technology Act, read together with the relevant provisions of the Information Technology (Procedure and Safeguards for Blocking for Access of Information by Public) Rules:
- TikTok, WeChat, and 57 other applications of Chinese origin were banned in India with effect from 29 June 2020, with the blocking orders remaining in force as of 2025.
- 14 messaging applications were blocked in early May 2023, with the restrictions remaining in place as of 2025. Subsequent court proceedings clarified that these blocking orders were, in fact, geographically limited to Jammu and Kashmir. The Delhi High Court upheld the ban on Briar primarily on the basis that its application was confined to the Union Territory of Jammu and Kashmir.

The Digital Personal Data Protection Act establishes a comprehensive regime for safeguarding digital personal data in India, extending its reach extraterritorially where processing relates to the provision of goods or services to individuals in India. It imposes statutory duties on data fiduciaries, confers defined rights upon data principals, and generally permits the outward transfer of personal data. The Act introduces the novel institution of independent consent managers, entrusted with administering individuals’ consent and operating separately from data fiduciaries and data processors. It further provides for significant penalties for non‑compliance, including a maximum fine of INR 2.5 billion (approx. USD 31 million), and designates the Data Protection Board of India as the regulatory authority. The Act is implemented in phases, with certain provisions commencing on 13 November 2025, further provisions taking effect one year thereafter, with the remaining substantive provisions entering into force in May 2027.

It is reported that several instances of the blocking of commercial web content occurred in India in 2025, as detailed below:
- 23 social media and messaging platforms were blocked in Jamui District, Bihar, from 23:30 on 16 February 2025 until 23:30 on 18 February 2025.
- 23 social media and messaging platforms were blocked in Katihar District, Bihar, from 20:00 on 6 July 2025 until 20:00 on 7 July 2025.
- 23 social media and messaging platforms were blocked in the Hathwa sub‑division of Gopalganj District, Bihar, from 12:00 on 30 September 2025 until 12:00 on 2 October 2025.
- At least four platforms were shut down for several days in October 2025 across three areas of Cuttack city, Cuttack District, Odisha, namely the Cuttack Municipal Corporation (CMC) area, the Cuttack Development Authority (CDA) area, and the 42 Mauza region.
- At least four platforms were shut down for several days in December 2025 in Malkangiri District, Odisha.

Section 5 of Direction No. 20(3)/2022-CERT-In mandates data centres, virtual private server providers, cloud service providers, and virtual private network service providers to mandatorily collect and retain certain subscriber-related information accurately for a minimum period of five years after the subscriber is no longer availing the underlying services. These data sets include subscriber names, period of hire including dates, IPs allocated and used, e-mail address along with IP and time stamp used at time of registration, purpose of availing the services, verified address and contact numbers, and ownership pattern of subscribers. Virtual asset service providers, virtual asset exchange providers and custodian wallet providers must also maintain KYC information and records of financial transactions for a period of 5 years. Specific to transaction records, Direction No. 20(3)/2022-CERT-In states that information must be maintained accurately in such a way that individual transactions can be reconstructed along with the relevant constituents such as IP addresses, time zones, transaction ID, public keys or equivalent identifiers, addresses or accounts involved, nature and date of transaction, amount transferred, etc.

According to the License Agreement for Provision of Internet Services, the Internet Service Provider licensee shall maintain all commercial records, call detail records, exchange detail records, and IP detail records with regard to the communications exchanged on the network. Such records shall be archived for at least two years for scrutiny by the Licensor for security reasons and may be destroyed thereafter unless directed otherwise by the Licensor.

According to Section 3 of The Prevention of Money-Laundering (Maintenance of Records) Rules, banking information must be stored for 10 years "from the date of cessation of the transactions between the client and the banking company, financial institution or intermediary, as the case may be".