IT Rules 2021: Intermediary Due Diligence and Deepfake Rules in India

The IT Rules 2021, formally the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, set the conditions an online intermediary in India must meet to keep its legal immunity for content posted by users. They apply to social media and messaging apps, marketplaces, hosting providers, search engines, app stores and many SaaS products that host user content, including foreign companies serving Indian users.

The Rules have been amended several times. The latest amendment, in force from 20 February 2026, introduced duties for "synthetically generated information" such as deepfakes, and cut takedown and grievance deadlines sharply, in some cases to two or three hours. This guide explains who is covered, the due diligence duties, the extra obligations for large platforms, the 2026 changes and how product teams can build compliance into their systems.

What are the IT Rules 2021?

The Rules were notified by the Ministry of Electronics and Information Technology (MeitY) on 25 February 2021 under the Information Technology Act, 2000. They replaced the Intermediary Guidelines of 2011. They have three parts:

• Part I: definitions.
• Part II: due diligence by intermediaries and the grievance redressal mechanism, administered by MeitY.
• Part III: a code of ethics and grievance structure for digital news publishers and online curated content (OTT) platforms, administered by the Ministry of Information and Broadcasting.

Section 79 of the IT Act gives intermediaries "safe harbour": they are not liable for third-party information they host or transmit, provided they observe due diligence and act on actual knowledge, such as a court order or government notification. The Rules define that due diligence. An intermediary that fails it can lose safe harbour and be treated as liable for the content under other laws.

Who is covered?

An "intermediary" is any person who, on behalf of another, receives, stores or transmits electronic records or provides a service for them. The definition is broad and includes telecom and internet providers, web hosts, cloud services, search engines, payment sites, marketplaces, social media, messaging apps, online forums and cyber cafes. The Rules also define:

• Social media intermediary: one that primarily or solely enables online interaction between users to create, upload, share, disseminate, modify or access information.
• Significant social media intermediary (SSMI): a social media intermediary with registered users in India above a threshold notified by the government, currently 50 lakh (5 million).

Foreign intermediaries offering services to Indian users are covered. A B2B SaaS that hosts customer-uploaded content may also be an intermediary for that content, though many due diligence duties are designed with consumer platforms in mind.

Is it mandatory or voluntary?

Mandatory for any intermediary that wants to rely on safe harbour. In practice, no platform can operate safely in India without it. There is no certification; compliance is demonstrated through published terms, grievance handling, records and response to orders.

Due diligence duties for all intermediaries

• Publish rules, a privacy policy and a user agreement in English or any language in the Eighth Schedule, and inform users of them, including at least once every three months since the 2026 amendment.
• Make reasonable efforts to cause users not to host, display, upload, modify, publish, transmit, store, update or share prohibited categories of information, such as content that is obscene, invasive of privacy, harmful to children, infringing, deceptive or misleading, impersonating, threatening to the sovereignty or security of India, containing malware, or knowingly false.
• Remove or disable access to unlawful information on receiving actual knowledge through a court order or a reasoned notification from the appropriate government or its agency, within the deadline set by the Rules.
• Retain information that has been removed, and user registration information after account cancellation, for 180 days for investigation purposes, or longer if required.
• Provide information or assistance to lawfully authorised government agencies for verification, prevention, investigation or prosecution, within 72 hours of an order.
• Report cybersecurity incidents to CERT-In in line with the CERT-In Directions.
• Take reasonable security measures as required under the IT Act and its rules.
• Respect users' rights under the Constitution, including due process, freedom of speech and privacy, an obligation added in 2022.

Grievance redressal

Every intermediary must appoint a Grievance Officer and publish their name and contact details and the complaint mechanism. After the 2026 amendment, the timelines are:

Grievance type	Previous timeline	Timeline from 20 February 2026
General user grievances	Acknowledge in 24 hours, resolve in 15 days	Resolve in 7 days
Requests to remove unlawful content	72 hours	36 hours
Content exposing private areas, nudity, sexual acts or impersonation in morphed images	24 hours	2 hours

Since 2022, users dissatisfied with a Grievance Officer's decision can appeal within 30 days to a Grievance Appellate Committee (GAC) set up by the government, which aims to resolve appeals within 30 days. Intermediaries must comply with GAC orders.

Takedown timelines on orders

The 2026 amendment shortened the time to act on actual knowledge. Based on published legal analyses, intermediaries must now remove or disable access to unlawful content within 3 hours of a court order or reasoned government intimation, down from 36 hours, and within 2 hours for non-consensual intimate imagery including deepfakes, down from 24 hours. These deadlines need around-the-clock monitoring of order channels, clear authority for on-call staff to act, and tools that can remove content quickly across caches and copies.

Additional obligations for significant social media intermediaries

• Chief Compliance Officer, a senior employee resident in India, responsible for compliance and personally liable in some proceedings.
• Nodal Contact Person resident in India for 24x7 coordination with law enforcement.
• Resident Grievance Officer in India.
• Monthly compliance reports on complaints received, action taken and proactive removals.
• Physical contact address in India published on the website or app.
• Voluntary verification mechanism for users, with a visible mark of verification.
• Notice and appeal for users whose content is removed on the platform's own initiative.
• Technology-based measures to identify certain content, such as child sexual abuse material, with human oversight.
• Identification of the first originator of information on messaging services, on a court or competent authority order for specified serious offences (Rule 4(2)). This requirement has been challenged in court by messaging providers on privacy and encryption grounds.

Synthetically generated information (2026)

The 2026 amendment added a definition of synthetically generated information: audio, visual or audio-visual information that is artificially or algorithmically created or altered so that it appears real, authentic or true and depicts a person or event in a way that is likely to be perceived as indistinguishable from a real one. Text-only content, routine editing, accessibility improvements, translation and good-faith enhancements that do not materially alter content are excluded. Key duties include:

• Labelling: intermediaries that enable creation or sharing of synthetic content must ensure it carries a prominent visible label, or a prefixed disclosure for audio.
• Provenance metadata: synthetic content should carry embedded metadata or identifiers where technically feasible, and intermediaries must not allow labels or metadata to be removed or suppressed.
• User declarations: SSMIs must ask users to declare whether content is synthetic and deploy reasonable technical measures to verify declarations.
• Prohibited synthetic content: platforms offering generation tools must deploy measures to prevent synthetic content involving child sexual abuse material, non-consensual intimate imagery, false documents, and deceptive depictions of real people or events.
• User warnings about the consequences of misusing synthetic content.

An SSMI that knowingly permits unlawful synthetic content is treated as failing due diligence. A proposal in the October 2025 draft to require labels covering 10 percent of the display area was dropped from the final rules. MeitY has also issued advisories on labelling, so check the latest advisories alongside the Rules.

Other amendments and court rulings

• 2022: Grievance Appellate Committees, stronger duty to cause users not to post prohibited content, and respect for constitutional rights.
• 2023: rules on online gaming intermediaries, since overtaken by the Promotion and Regulation of Online Gaming Act, 2025, and a provision for a government fact check unit for content about government business. The Bombay High Court struck down the fact check unit provision in September 2024.
• 2026: synthetic content duties, shorter takedown and grievance timelines, and quarterly user notices.

Part III: digital news and OTT platforms

Publishers of news and current affairs content and online curated content providers must follow a Code of Ethics, classify content by age (for OTT: U, U/A 7+, U/A 13+, U/A 16+, A), provide access controls for adult content, and participate in a three-tier grievance structure: self-regulation by the publisher, a self-regulatory body, and an oversight mechanism under the Ministry of Information and Broadcasting. Parts of Part III have been challenged in several High Courts, and some provisions have been stayed for news publishers.

How to comply, step by step

1. Classify your service: intermediary, social media intermediary, SSMI, or publisher under Part III.
2. Update terms, privacy policy and user rules with the prohibited categories, and send notices every three months.
3. Appoint a Grievance Officer and, for SSMIs, a Chief Compliance Officer and Nodal Contact Person in India.
4. Build a reporting and grievance system with ticket tracking against the 2-hour, 36-hour and 7-day timelines.
5. Set up 24x7 order handling for court and government orders with a 3-hour removal capability.
6. Implement synthetic content controls: labelling, metadata preservation, declarations and abuse prevention, if your product creates or hosts such content.
7. Configure data retention for removed content and deleted accounts.
8. Prepare monthly compliance reports if you are an SSMI.
9. Align with CERT-In incident reporting and DPDP obligations.

Documentation you will need

• Terms of service, privacy policy and user rules, with notice records.
• Grievance Officer and other officer appointments.
• Grievance and takedown logs with timestamps.
• Records of court and government orders and actions taken.
• GAC orders and compliance.
• Monthly compliance reports for SSMIs.
• Synthetic content policy, labelling design and verification approach.
• Retention policies for removed content and account data.

What this means for SaaS and marketplace builders

Many products are intermediaries without thinking of themselves as social media: marketplaces with seller listings and reviews, learning platforms with discussion forums, job boards with candidate profiles, and SaaS tools where customers upload files or publish pages. For these, the main practical duties are clear user rules, a published Grievance Officer, a tracked complaint process, the ability to remove specific content quickly when ordered, retention of removed content, and cooperation with lawful requests. Designing content models so each item has an owner, timestamps and a removable state makes these duties much easier to meet.

Common mistakes for platforms

• Assuming B2B or niche platforms are not intermediaries.
• Grievance email inboxes without tracking, missing deadlines.
• No out-of-hours process for 2-hour and 3-hour orders.
• Generative AI features without labels or metadata.
• Deleting content immediately instead of retaining it for 180 days.
• Not refreshing user notices every three months.

Best practices, tools and technologies

• Use a case management tool for grievances and orders with SLA timers and escalation.
• Build in-app reporting for each content type with reason codes matching the Rules.
• Use hashing and classifier tools for known abuse content, with human review.
• Apply content provenance standards such as C2PA for synthetic media metadata.
• Log moderation actions immutably for audits and disputes.
• Keep a regulatory watch on MeitY notifications and advisories.

We build reporting flows, moderation queues, grievance tracking with SLA timers and content labelling into platforms through our web application development service and our work on online marketplaces, where seller and buyer content raises the same issues.

How the IT Rules relate to other laws

Law	Relationship
IT Act 2000	Parent law; section 79 safe harbour and section 69A blocking powers.
DPDP Act	Governs personal data processing by platforms alongside the Rules.
CERT-In Directions	Incident reporting and log retention duties referenced by the Rules.
India AI governance	Broader AI guidance; the synthetic content rules are its main binding element for platforms.
EU Digital Services Act	EU counterpart for platform duties, with notice and action, transparency and risk assessments.

Real-world example

An Indian short-video app with 8 million registered users is an SSMI. It appoints its three India-resident officers, adds an in-app report button with categories mapped to the Rules, routes reports to a moderation queue with timers for the 2-hour and 36-hour deadlines, and runs a 24x7 rota for government and court orders. Its AI filters automatically label generated faces and voices, preserve C2PA metadata on export, and ask creators to declare synthetic content at upload. Removed videos are retained in restricted storage for 180 days, and a monthly compliance report is generated from the moderation system.

Next steps

1. Confirm whether you are an intermediary or SSMI.
2. Appoint officers and publish contacts.
3. Build grievance and order handling to the new timelines.
4. Add synthetic content labelling if relevant.
5. Review terms and notices quarterly.

Frequently asked questions

Who must follow the IT Rules 2021?

Intermediaries offering services in India, including foreign platforms, and digital news publishers and OTT platforms under Part III.

What is a significant social media intermediary?

A social media intermediary with more than 50 lakh (5 million) registered users in India.

What happens if a platform does not comply?

It can lose safe harbour under section 79 and become liable for user content under other laws.

How fast must content be removed on a government or court order?

Within 3 hours under the 2026 amendment, and within 2 hours for non-consensual intimate imagery.

How quickly must user grievances be resolved?

Within 7 days for general grievances, 36 hours for removal requests and 2 hours for intimate imagery complaints.

What is synthetically generated information?

Audio or visual content artificially created or altered to appear real and indistinguishable from a real person or event; text-only content is excluded.

Do AI-generated images need labels in India?

Yes, where they meet the definition of synthetic content, intermediaries must ensure prominent labels and preserve metadata.

Can users appeal a platform's decision?

Yes, to a Grievance Appellate Committee within 30 days of the Grievance Officer's decision.

Do SSMIs need officers in India?

Yes: a Chief Compliance Officer, a Nodal Contact Person and a Resident Grievance Officer, all resident in India.

How long must removed content be retained?

180 days, or longer if required by a court or authorised agency.

Is the fact check unit rule in force?

No. The Bombay High Court struck down that provision in September 2024.