How Intermediary (platform) Liability Works in India, 2026 Compliance Playbook

Intermediary liability india is the central compliance concern for any online platform operating in or serving users within India, and this guide is written for the in-house counsel, platform legal and compliance teams, and startup founders who need to translate legal doctrine into working operations. In recent years, regulators have sharpened their focus on platform governance and AI-driven content moderation, expecting documented design decisions, audit trails for automated actions, and faster, better-evidenced takedown and grievance procedures. The pages that follow set out the statutory basis, the eligibility tests for safe harbour, and a step-by-step operational playbook with owners, timelines, records and cost estimates. Treat this as a practitioner’s working manual rather than an academic summary.

This guide reflects the current platform governance and AI moderation emphasis, including heightened expectations around algorithmic impact assessments and record retention for automated decisions. Readers should confirm the latest position directly with the relevant statutes and MeitY notifications, as the regime continues to evolve.

Overview: what intermediary liability is in India

An intermediary is an entity that receives, stores or transmits electronic records on behalf of others, or provides a service in respect of those records, this includes hosting providers, marketplaces, search services, messaging services and social media platforms. Under the Information Technology Act, 2000, Section 79 provides a conditional exemption from liability, commonly called “safe harbour”, for third-party content hosted or transmitted by an intermediary. That immunity is not automatic. It is conditional on the intermediary observing due diligence and acting on knowledge of unlawful content, as detailed in the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

The practical message for platform teams is straightforward: safe harbour is earned through documented process, not asserted by status. Understanding intermediary liability india means understanding what you must avoid, namely, ignoring valid notices, exercising publisher-like editorial control over user content, or failing to operate the grievance and takedown machinery the Rules require.

Legal test for intermediary immunity

• Passive role. The intermediary must not initiate the transmission, select the receiver, or select or modify the information in the transmission.
• Due diligence. The intermediary must observe the due-diligence obligations prescribed under the IT Rules 2021.
• Act on knowledge. On receiving actual knowledge (via a court order or appropriate government notification) of unlawful material, the intermediary must expeditiously remove or disable access to it.
• No conspiracy or abetment. Immunity is lost where the intermediary has conspired, abetted, aided or induced the unlawful act.

Key definitions

• Intermediary. Any person who on behalf of another receives, stores or transmits electronic records, or provides any service with respect to those records.
• User. Any person who accesses or avails the computer resource of an intermediary.
• Content / information. The third-party data, text, images or audiovisual material hosted or transmitted.
• Traceability. For significant social media intermediaries providing messaging services, the obligation to enable identification of the first originator of information on a lawful order, as framed in the IT Rules 2021.

Eligibility: who qualifies for safe harbour in India

All intermediaries can in principle claim the Section 79 exemption, but the depth of obligations scales with role and reach. Platform liability india is tiered: ordinary intermediaries face the baseline due-diligence requirements, while platforms that cross user thresholds are classified as significant social media intermediaries (SSMIs) and must meet additional obligations. Eligibility for safe harbour is therefore not a one-off qualification, it is a continuing state that depends on ongoing compliance with the applicable tier of obligations under the IT Rules 2021.

Immunity is generally unavailable where the platform steps outside the passive intermediary role. If a service curates, edits, commissions or exercises editorial judgment over content in a way that makes it the author or publisher rather than the conduit, the Section 79 shield may not apply to that content. Similarly, knowingly hosting unlawful material after valid notice, or failing to operate the required grievance mechanism, puts safe harbour at risk.

Significant Social Media Intermediary (SSMI) implications

SSMIs, platforms exceeding the user threshold notified by the government, carry enhanced obligations under the IT Rules 2021: appointment of a resident Chief Compliance Officer, a nodal contact person for coordination with law enforcement, and a resident Grievance Officer. More recently, MeitY’s platform governance emphasis has added expectations around AI-driven moderation, including documented assessments of automated tooling, logs of automated content decisions, and clear human-review triggers. Messaging SSMIs also face traceability obligations enabling identification of the first originator of information on a lawful order, subject to the conditions and litigation surrounding that requirement.

When immunity is lost, examples and case pointers

• Publisher-like conduct. Taking editorial control, endorsing specific user content as the platform’s own voice, can convert an intermediary into a publisher for that content.
• Ignoring valid notice. Failing to act expeditiously after a court order or appropriate government notification of unlawful content.
• Procedural failure. Not maintaining grievance officers, not publishing contacts, or not operating the takedown SOP.

The Supreme Court’s decision in Shreya Singhal v. Union of India (2015) remains an anchoring precedent. The Court struck down Section 66A and read down the intermediary obligation so that “actual knowledge” for takedown purposes arises through a court order or a notification by the appropriate government or its agency, not through a private complaint alone. That holding continues to shape how platforms calibrate what triggers a mandatory takedown versus a policy-based voluntary removal.

Step-by-step compliance playbook (operations and governance)

This is the operational core of achieving defensible intermediary liability india compliance. The playbook below assigns each step an owner and an output, and the timeline table that follows sets realistic durations. Treat each output as evidence you can produce to a regulator or court to demonstrate that your platform observed due diligence.

1. Governance and policy mapping. Draft or update your platform terms of service and community guidelines, and maintain strict version control.
   • Map each policy clause to the specific IT Rules 2021 obligation it satisfies.
   • Maintain a policy register and a change log recording who approved each revision and when.
   • Owner: Legal and Product. Output: policy register, dated change log, published policies.
2. Appoint officers and publish contact points. Designate a nodal contact person, a Grievance Officer, and (for SSMIs) a Chief Compliance Officer.
   • Publish names, roles, physical contact address and dedicated email addresses on an accessible page.
   • Ensure the required officers are resident in India where SSMI rules apply.
   • Owner: Legal/Compliance. Output: published contact page, designated monitored inboxes.
3. Grievance redressal and takedown SOPs. Build an intake flow with triage criteria, SLA timelines and an escalation ladder.
   • Define categories (unlawful content, IP, defamation, impersonation, CSAM, etc.) with routing rules.
   • Set acknowledgement and resolution SLAs and specify who escalates and when.
   • Owner: Compliance and Ops. Output: SOP documents, intake forms, templated notices (mark drafts for legal review).
4. Notice and action workflows. Standardise the lifecycle: receipt, assessment, decision, action and record-keeping.
   • Capture the legal basis for every action in a decision memo.
   • Distinguish mandatory removals (court/government order) from policy-based removals.
   • Owner: Moderation team and Legal. Output: decision memos, action logs with timestamps.
5. Evidence retention and audit trails. Define retention periods, chain-of-custody and secure storage.
   • Preserve the original content, the notice, the decision and the system logs together.
   • Apply write-once storage or hashing for integrity on high-risk matters.
   • Owner: Security/Legal Ops. Output: retention schedule, chain-of-custody records.
6. Algorithmic governance and AI audits. Implement impact assessments and logging for automated moderation.
   • Record why an automated decision occurred, the model version, and the confidence or rule triggered.
   • Define human-review triggers for borderline or high-impact automated decisions.
   • Owner: Product and data governance lead. Output: assessment reports, versioned model-decision logs.
7. Record production and law-enforcement requests. Build procedures for lawful disclosure that preserve privilege and keep responses narrow.
   • Verify the validity of each request against the legal process presented.
   • Produce only what the valid process requires; log every disclosure.
   • Owner: Legal and Security. Output: disclosure log, response memos.
8. Training and internal audits. Run periodic tabletop exercises and audits.
   • Test the takedown SOP end-to-end, including emergency escalation.
   • Audit a sample of moderation decisions for consistency and documentation quality.
   • Owner: Legal and Compliance. Output: training records, audit findings and remediation log.
9. Incident response and transparency reporting. Establish a cadence for publishing takedown statistics, appeals data and moderation metrics, as required for SSMIs and as good practice for others.
   • Automate the collection of underlying metrics so reports are reproducible.
   • Reconcile published figures against internal logs before each release.
   • Owner: Compliance and Communications. Output: transparency reports, retained underlying data.

Online intermediary compliance india, owners and timelines

The table below is the operational backbone of online intermediary compliance india. Use it to resource the programme and to set internal SLAs that you can defend if challenged. Note that specific statutory timelines under the IT Rules 2021 (for example, acknowledgement and resolution of grievances) should be confirmed against the current text of the Rules; the figures below are indicative operational targets.

Note on drafting: any templated notices, SOP text or assessment templates generated to accelerate this work should be marked as DRAFT and validated by qualified counsel before deployment, with statutory citations inserted against each obligation.

Required documents and operational records

Preserving safe harbour is largely an evidentiary exercise. The records below are what you should be able to produce to demonstrate due diligence under the IT Rules 2021 and lawful data handling under the Digital Personal Data Protection Act, 2023. Organise them so that, for any single takedown, you can retrieve the notice, the decision, the action log and the preserved content as one bundle. Note that the DPDP Act, 2023 comes into force in a phased manner through rules notified by the government; confirm the operative provisions and timelines before relying on specific obligations.

Timeline and deadlines: takedowns, grievances and law enforcement

The IT Rules 2021 set grievance acknowledgement and resolution expectations, and current platform governance guidance pushes SSMIs toward tighter, better-documented turnaround on automated and urgent cases. Confirm the precise statutory periods in the current text of the Rules; the practical targets below combine those requirements with defensible operational practice. Where a court order or appropriate government notification arrives, the obligation is to act expeditiously, build your SLAs to meet that standard and to record the clock from the moment of receipt.

A recurring enforcement risk is a mismatch between your published SLAs and your actual performance. If your policy promises prompt acknowledgement, your logs must show you meet it consistently; an unmet self-imposed deadline is harder to defend than a realistic one honoured reliably.

Costs and fees: how much will compliance cost?

Budgeting realistically protects the programme from being under-resourced and then failing at the evidentiary stage. The ranges below are indicative build-versus-buy figures only and will vary widely by platform size, engineering approach and vendor; smaller platforms can start lean and scale, while SSMIs should expect higher costs plus the recurring cost of resident officers. Obtain current quotations before relying on any figure.

What changed recently, platform governance and AI moderation

A defining shift in intermediary liability india is the move from outcome-based scrutiny toward process-and-design scrutiny of automated moderation. MeitY’s platform governance emphasis means regulators increasingly want to see not just that unlawful content was removed, but how automated systems reached their decisions, what human oversight existed, and whether the platform assessed the risks of its own tooling in advance. For SSMIs in particular, transparency reporting and record-keeping for automated decisions are areas of active attention.

In practice this translates into three operational expectations: documented impact assessments before deploying or materially changing moderation models; retained, versioned logs of automated content decisions sufficient to reconstruct why a given action occurred; and demonstrable human-review triggers for high-impact or borderline cases. Platforms that already run DPDP-aligned data governance will find the assessment layer a natural extension rather than a new silo.

Practical operational changes to implement

• Stand up an assessment template. Create a repeatable assessment covering purpose, data inputs, error modes, and mitigation for each moderation model.
• Extend logging. Capture model version, trigger, confidence and reviewer for every automated action.
• Define human-review thresholds. Route high-impact removals and repeat appeals to a human before final action.
• Lengthen retention for automated decisions. Keep raw model outputs available for audit windows.
• Automate transparency metrics. Build the reporting pipeline now so the cadence is reproducible.

Common pitfalls and how to avoid them

• No version control on policies. Without a dated change log you cannot prove what users were told at the time of an incident, maintain an immutable policy register.
• Weak chain-of-custody. Deleting original content when actioning a takedown destroys your evidence, preserve the content, notice and logs as one bundle before removal.
• Inconsistent triage. Different outcomes for similar reports suggest arbitrary moderation, codify triage criteria and audit samples for consistency.
• Overbroad takedowns. Removing more than the notice requires invites challenge, act proportionately and record the legal basis.
• Undocumented automated actions. Automated removals without logs or assessment backing are a weak point, instrument every model decision.
• Unmonitored officer inboxes. Published contacts that nobody watches defeat the grievance obligation, assign ownership and SLAs to each channel.

Comparison table: India vs UK / EU, operational differences

Platforms serving multiple jurisdictions benefit from mapping where obligations converge and diverge. The table gives a high-level operational comparison; it is a planning aid, not a substitute for jurisdiction-specific advice in each market.

Conclusion: building a defensible intermediary liability india programme

Getting intermediary liability india right is an operational discipline as much as a legal one: safe harbour is preserved through documented policies, responsive grievance handling, proportionate takedowns, rigorous evidence retention, and, increasingly, demonstrable governance of AI-driven moderation. Platforms that build the owners, SOPs, logs and audit trails set out in this playbook will be well placed to respond to regulators, courts and users alike. For bespoke compliance audits, defence-ready templates, and tailored platform governance support, platform operators can contact Global Law Experts to arrange a review against current Indian requirements. See also the Technology practice, India and the GLE lawyer directory, India, Technology for specialist support.

Sources

1. Ministry of Electronics & Information Technology (MeitY), Information Technology Act, 2000 and IT Rules 2021
2. Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, MeitY
3. Digital Personal Data Protection Act, 2023, MeitY
4. Supreme Court of India, Shreya Singhal v. Union of India (2015) 5 SCC 1
5. Gazette of India, Official Notifications
6. Supreme Court of India