According to Condition 37.1 of the License Agreement for Unified License, issued by the Department of Telecommunications, Ministry of Communications and Information Technology, Internet Service Provider licensees are prohibited from employing bulk encryption equipment in their networks. The licensor or officers designated for this purpose have the authority to evaluate any encryption equipment connected to the licensee's network. However, the licensee remains responsible for ensuring the protection of communication privacy and preventing unauthorised message interception.

According to Section 84A of the Information Technology Act, the Government may, for secure use of the electronic medium and for the promotion of e-governance and e-commerce, prescribe the modes or methods for encryption. However, no rules have been introduced under this section.

Since the implementation of the Consolidated FDI Policy Circular of 2016, last amended by the Consolidated FD) Policy Circular of 2020, India permits fully owned FDI in business-to-business (“marketplace-based”) electronic commerce, i.e. "providing an information technology platform by an e-commerce entity on a digital & electronic network to act as a facilitator between buyer and seller." However, India prohibits foreign investment in business-to-consumer (or “inventory-based”) electronic commerce, also defined as "e-commerce activity where the inventory of goods and services is owned by an e-commerce entity and is sold to the consumers directly".
When a marketplace e-commerce entity exercises ownership or control over the inventory, the business is categorised into the inventory-based model. Additionally, India implemented regulations that expressly prohibit subsidiaries of foreign-owned marketplace-based electronic commerce sites from selling products on their parent companies’ sites. The rules also prohibit exclusivity arrangements by which electronic commerce retailers can offer a product on an exclusive basis.
The only exceptions for FDI in inventory-based electronic commerce are for food-product retailing and single-brand retailers that meet certain conditions, including the operation of physical stores in India. According to Section 5.2.15.3 of the Consolidated FDI Policy Circular of 2020, retail trading through e-commerce can also be undertaken before opening physical stores, subject to the entity opening physical stores within two years from the start of online retail. Overall, it is reported that these narrow exceptions limit the ability of many electronic commerce service suppliers to serve the Indian market.

According to Section 2 of the Companies Act of 2013, foreign companies relating to B2B, B2C e-commerce, data interchange and other digital supply transactions, web-based marketing, database services, online services such as telemarketing, telecommuting, telemedicine, education and information research and all related data communication services, even when not incorporated in India, should register in India when they are engaged in business in the country.

According to Art. 2 of the Processing and Settlement of Export-related receipts facilitated by Online Payment Gateways from 2011, the Reserve Bank of India restricts export-related payments for goods and services through online payment gateways. It is reported that PayPal had to limit payments for export-related payments above 500 USD. From July 2013, this limit has been increased to USD 10,000.
In addition, according to Section 2 of the Storage of Payment System Data Directive, all payment data held by payment companies should be held in local facilities. Furthermore, according to section 5 of the directive, data must be stored only in India after processing and should be deleted from systems abroad and brought back to India no later than 24 hours after processing. Any subsequent activity, such as settlement processing after payment processing done outside India, must be undertaken on a real-time basis, pursuant to which the data must be stored only in India. However, The RBI has clarified that banks, especially foreign banks, can continue to store banking data abroad but in respect to domestic payment transactions, the data must be stored only in India.

Following a negative response from international payment companies such as MasterCard, Visa, and American Express, the RBI has proposed (in "Frequently Asked Questions" of its website) to ease this restriction so as to allow payment firms to store data offshore as long as a copy was kept in India. The RBI has further clarified that for cross-border transaction data consisting of a foreign component and a domestic component, a copy of the domestic component may be stored abroad if required.

In accordance with NPCI Notification: NPCI/UPI/SOP-01/2020-21, the National Payments Corporation of India (NPCI), a state-owned entity, introduced a 30% market share cap for foreign electronic payment service providers processing online payments via India’s Unified Payment Interface (UPI), which is owned and operated by NPCI. Foreign digital payment companies were required to comply with this 30% market share limit by January 2023.

India does not implement a de minimis threshold, which refers to the minimum value of goods below which customs do not charge duties. Although the Courier Imports and Exports (Electronic Declaration and Processing) Regulations, 2010 refer to "low-value dutiable consignments" as those with an invoice value below INR 100,000 (approx. USD 1,000) for imports (excluding documents, gifts, and samples), the specific de minimis threshold applied in the country remains unclear.

The Consumer Protection (E-Commerce) Rules, 2020, provides a comprehensive framework for consumer protection that also applies to online transactions. The Rules introduced in 2020 established several requirements, such as displaying requirements for the name and details of sellers, details of returns, refunds, exchanges, warranties, and guarantees. In addition, requires sellers on the platform to provide an undertaking affirming the accuracy of descriptions, images, and other content of the goods or services on the platform, including that they correspond directly with the appearance, nature, quality, and purpose.

India has not signed the United Nations (UN) Convention on the Use of Electronic Communications in International Contracts.

India has adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Commerce.

India has not adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Signatures.

According to Notification No. 107/(RE-2013)/2009-2014, GSM mobile handsets’ with duplicate International Mobile Equipment Identity Number (IMEI) or fake IMEI & ‘CDMA mobile handsets’ with duplicate Electronic Serial Number (ESN)/ mobile equipment identifier (MEID) or fake ESN/MEID are added to the list of ‘Prohibited’ items for import. The Government has taken over from a private agency to issue and manage IMEI allocation for mobile phones in India.

It is reported that during the course of 2020, the Ministry of Information and Technology, based on the provisions of Section 69A of the Information Technology Act and relevant provisions of the Information Technology (Procedure and Safeguards for Blocking Access to Information by the Public) Rules, 2009, banned 267 apps in view of the emerging nature of security threats posed by these apps and the detrimental nature of these apps to sovereignty, defence and law and order in India. The Ministry has reportedly pointed out that these apps raise data security and privacy concerns. On June 29, 2020, 59 apps were banned; on September 2, 2020, 118; and on November 24, 2020, 43.

Exporters have raised concerns regarding India’s application of customs valuation criteria to import transactions. Reports indicate that Indian customs officials occasionally reject the declared transaction value of imports, particularly for products with established benchmark prices in India. This practice can potentially increase export costs beyond the expected levels based on India's applied tariff rates. Companies have also reported extensive searches and seizures of imports, which do not seem to be risk-based. Additionally, India's customs authority typically demands extensive clearance documentation, resulting in prolonged processing delays.

According to the Import Export Classification, Indian Trade Classification – Harmonized System (ITC-HS) Code, and Import Policy 2012, certain goods require special permission or licensing in order to be imported. Selected consumer goods, including radio and TV broadcast transmitters and communication jamming equipment, are qualified as licensed/restricted items that can only be imported after obtaining an import license from India’s Directorate General of Foreign Trade (DGFT). However, it has been reported that India is increasingly using import licenses at the discretion of the authorities to limit imports of sensitive products. In addition, it is reported that the licensing system is not automatic as it involves delays, and authorised quantities can be lower than requested. Licenses are granted to actual users.