13 Feb 2026
In this update:
– notifies implementation timeline for Digital Personal Data Protection Act, 2023 and finalises underlying rules
– publishes operating procedures to curtail dissemination of Non-Consensual Intimate Imagery
Partner: Jyotsna Jayaram, Senior Associate: Prabal De, Associate: Divya Govindan
On 13 November 2025, the Ministry of Electronics and Information Technology (MeitY) finalised the Digital Personal Data Protection Rules, 2025 (DPDP Rules), along with the implementation timeline to operationalise the Digital Personal Data Protection Act, 2023 (DPDP Act). This marks the culmination of over a decade of effort to formulate India’s first omnibus privacy law.
The DPDP Act and DPDP Rules will be enforced in a staggered manner – while provisions relating to the Data Protection Board of India and administrative machinery are already in effect, substantive obligations on data fiduciaries will come into effect after 18 months, on 13 May 2027, to allow parties to bring their processes in line with the DPDP Act. Provisions relating to consent managers will come into force on 13 November 2026.
Our detailed update on the DPDP Act and Rules can be accessed here.
MeitY released a Standard Operating Procedure (SoP) in October 2025 to strengthen mechanisms to remove and prevent Non-Consensual Intimate Imagery (NCII) content on online platforms. This initiative aims to provide clear and victim-friendly procedures for the swift removal of such content and to ensure effective implementation of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (IT Rules, 2021).
NCII is understood to mean any content which (a) is prima facie in the nature of any material which exposes the private area of an individual, (b) shows such individual in full or partial nudity, (c) shows or depicts such individual in any sexual act or conduct and (d) includes artificially morphed images of such individual. The SoP provides detailed guidance for victims, intermediaries, and law enforcement agencies to ensure prompt and uniform action against the online dissemination of NCII content that violates an individual’s privacy.
Intermediaries must take down flagged content within 24 hours of receiving a complaint, report actions taken, and ensure coordination with government portals like Sahyog under the Indian Cybercrime Coordination Centre, Ministry of Home Affairs (MHA – I4C). Significant Social Media Intermediaries (SSMI) must use hash-matching and crawler technologies to prevent the reappearance of the same or similar content.
The SoP can be accessed here.
MeitY has notified certain amendments to the IT Rules, 2021, introducing additional safeguards to ensure that the removal of unlawful content by intermediaries is carried out in a transparent, proportionate and accountable manner (Amendment).
Under Rule 3(1)(d) of the IT Rules, 2021 (Rule), intermediaries must remove unlawful information upon receiving actual knowledge either through a court order or notification from the appropriate government entity. The Amendment clarifies that the authorities who can issue such takedown orders must not be below the rank of Joint Secretary, Director, or an officer of equivalent rank. Where the notification is issued by the police, the authorised officer must not be below the rank of Deputy Inspector General. The Amendment also provides that takedown notices must contain reasons specifying the legal basis and relevant statutory provision, the nature of the unlawful act, and the specific URL/identifier or electronic location of the information to be removed. Further, the Amendment requires monthly review of all takedown notices by an officer not below the rank of Secretary.
The Amendment came into effect on 15 November 2025, and can be accessed here.
Separately, on 8 December 2025, the Ministry of Finance issued a notification designating the Securities and Exchange Board of India (SEBI) as another agency empowered to act under the Rule, and Section 79(3)(b) of the IT Act, 2000 (safe harbour protection to intermediaries against liability for third-party content).
The notification can be accessed here.
If you require any further information about the material contained in this newsletter, please get in touch with your Trilegal relationship partner or send an email to alerts@trilegal.com. The contents of this newsletter are intended for informational purposes only and are not in the nature of a legal opinion. Readers are encouraged to seek legal counsel prior to acting upon any of the information provided herein.
Easing of FDI restrictions on investments from land border-sharing countries
25 Mar 2026
Disputes in the Indian funds industry: Structural drivers and resolution pathways
24 Mar 2026
Balancing liberty and economic justice: Supreme Court clarifies approach to bail in financial crimes
10 Mar 2026If you would like to receive content directly in your inbox from our knowledge repository, please complete this subscription form. This service is reserved for clients and eligible contacts.
Under the rules of the Bar Council of India, Trilegal is prohibited from soliciting work or advertising in any form or manner. By accessing this website, www.trilegal.com, you acknowledge that:
We prioritize your privacy. Before proceeding, we encourage you to read our privacy policy, which outlines the below, and terms of use to understand how we handle your data:
For more information, please read our terms of use and our privacy policy.
