2[(a) the intermediary shall prominently publish on its website, mobile based application or both, as the case may be, the rules and regulations, privacy policy 1 Subs. by G.S.R. 275(E), dated 6.4.2023 for “social media intermediary and significant social media intermediary”.
2 Subs. by G.S.R. 794(E), dated 28.10.2022, for clauses (a) and (b) (w.e.f. 28.10.2022). Clauses (a) and (b), before substitution, stood as under:
“(a) the intermediary shall prominently publish on its website, mobile based application or both, as the case may be, the rules and regulations, privacy policy and user agreement for access or usage of its computer resource by any person;
(b) the rules and regulations, privacy policy or user agreement of the intermediary shall inform the user of its computer resource not to host, display, upload, modify, publish, transmit, store, update or share any information that,—
(i) belongs to another person and to which the user does not have any right;
(ii) is defamatory, obscene, pornographic, paedophilic, invasive of another’s privacy, including bodily privacy, insulting or harassing on the basis of gender, libellous, racially or ethnically objectionable, relating or encouraging money laundering or gambling, or otherwise inconsistent with or contrary to the laws in force;
(iii) is harmful to child;
(iv) infringes any patent, trademark, copyright or other proprietary rights;
(v) violates any law for the time being in force;
(vi) deceives or misleads the addressee about the origin of the message or knowingly and intentionally communicates any information which is patently false or misleading in nature but may reasonably be perceived as a fact;
(vii) impersonates another person;
and user agreement in English or any language specified in the Eighth Schedule to the Constitution for access or usage of its computer resource by any person in the language of his choice and ensure compliance of the same;
(b) the intermediary shall inform its rules and regulations, privacy policy and user agreement to the user in English or any language specified in the Eighth Schedule to the Constitution in the language of his choice and shall make reasonable efforts 1[by itself, and to cause the users of its computer resource to not host], display, upload, modify, publish, transmit, store, update or share any information that,—
(i) belongs to another person and to which the user does not have any right;
(ii) is obscene, pornographic, paedophilic, invasive of another’s privacy including bodily privacy, insulting or harassing on the basis of gender, racially or ethnically objectionable, relating or encouraging money laundering or gambling,2[or an online game that causes user harm,] or promoting enmity between different groups on the grounds of religion or caste with the intent to incite violence;
(iii) is harmful to child;
(iv) infringes any patent, trademark, copyright or other proprietary rights;
(v) deceives or misleads the addressee about the origin of the message or knowingly and intentionally communicates any misinformation or information which is patently false and untrue or misleading in nature 3[or, in respect of any business of the Central Government, is identified as fake or false or misleading by such fact check unit of the Central Government as the Ministry may, by notification published in the Official Gazette, specify];
(vi) impersonates another person;
(vii) threatens the unity, integrity, defence, security or sovereignty of India, friendly relations with foreign States, or public order, or causes incitement to the commission of any cognisable offence, or prevents investigation of any offence, or is insulting other nation;
(viii) contains software virus or any other computer code, file or program designed to interrupt, destroy or limit the functionality of any computer resource;
(viii) threatens the unity, integrity, defence, security or sovereignty of India, friendly relations with foreign States, or public order, or causes incitement to the commission of any cognisable offence or prevents investigation of any offence or is insulting other nation;
(ix) contains software virus or any other computer code, file or program designed to interrupt, destroy or limit the functionality of any computer resource;
(x) is patently false and untrue, and is written or published in any form, with the intent to mislead or harass a person, entity or agency for financial gain or to cause any injury to any person;”.
1 Subs. by G.S.R. 275(E), dated 6.4.2023 for “to cause the user of its computer resource not to host,”.
2 Ins. by G.S.R. 275(E), dated 6.4.2023.
3 Ins. by G.S.R. 275(E), dated 6.4.2023.
1[(ix) is in the nature of an online game that is not verified as a permissible online game;
(x) is in the nature of advertisement or surrogate advertisement or promotion of an online game that is not a permissible online game, or of any online gaming intermediary offering such an online game;
(xi) violates any law for the time being in force;
Explanation.—In this clause, “user harm” and “harm” mean any effect which is detrimental to a user or child, as the case may be;]]
(c) an intermediary shall periodically inform its users, at least once every year, that in case of non-compliance with rules and regulations, privacy policy or user agreement for access or usage of the computer resource of such intermediary, it has the right to terminate the access or usage rights of the users to the computer resource immediately or remove non-compliant information or both, as the case may be;
(d) an intermediary, on whose computer resource the information is stored, hosted or published, upon receiving actual knowledge in the form of an order by a court of competent jurisdiction or on being notified by the Appropriate Government or its agency under clause (b) of sub-section (3) of section 79 of the Act, shall not host, store or publish any unlawful information, which is prohibited under any law for the time being in force in relation to the interest of the sovereignty and integrity of India; security of the State; friendly relations with foreign States; public order; decency or morality; in relation to contempt of court; defamation; incitement to an offence relating to the above, or any information which is prohibited under any law for the time being in force:
Provided that any notification made by the Appropriate Government or its agency in relation to any information which is prohibited under any law for the time being in force shall be issued by an authorised agency, as may be notified by the Appropriate Government:
Provided further that if any such information is hosted, stored or published, the intermediary shall remove or disable access to that information, as early as possible, but in no case later than thirty-six hours from the receipt of the court order or on being notified by the Appropriate Government or its agency, as the case may be:
Provided also that the removal or disabling of access to any information, data or communication link within the categories of information specified under this clause, under clause (b) on a voluntary basis, or on the basis of grievances received under sub-rule (2) by such intermediary, shall not amount to a violation of the conditions of clauses (a) or (b) of sub-section (2) of section 79 of the Act;
1 Subs.by G.S.R. 275(E), dated 6.4.2023 for clause (ix). Clause (ix), before substitution, stood as under:
“(ix) violates any law for the time being in force;”.
(e) the temporary or transient or intermediate storage of information automatically by an intermediary in a computer resource within its control as an intrinsic feature of that computer resource, involving no exercise of any human, automated or algorithmic editorial control for onward transmission or communication to another computer resource shall not amount to hosting, storing or publishing any information referred to under clause (d);
1[(f) the intermediary shall periodically, and at least once in a year, inform its users in English or any language specified in the Eighth Schedule to the Constitution in the language of his choice of its rules and regulations, privacy policy or user agreement or any change in the rules and regulations, privacy policy or user agreement, as the case may be:]
2[Provided that an online gaming intermediary who enables the users to access any permissible online real money game shall inform its users of such change as soon as possible, but not later than twenty-four hours after the change is effected;]
(g) where upon receiving actual knowledge under clause (d), on a voluntary basis on violation of clause (b), or on the basis of grievances received under sub-rule
(2), any information has been removed or access to which has been disabled, the intermediary shall, without vitiating the evidence in any manner, preserve such information and associated records for one hundred and eighty days for investigation purposes, or for such longer period as may be required by the court or by Government agencies who are lawfully authorised;
(h) where an intermediary collects information from a user for registration on the computer resource, it shall retain his information for a period of one hundred and eighty days after any cancellation or withdrawal of his registration, as the case may be;
(i) the intermediary shall take all reasonable measures to secure its computer resource and information contained therein following the reasonable security practices and procedures as prescribed in the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Information) Rules, 2011;
(j) the intermediary shall, as soon as possible, but not later than seventy two hours 3[and in case of an online gaming intermediary who enables the users to access any permissible online real money game not later than twenty-four hours] of the receipt of an order, provide information under its control or possession, or assistance to the Government agency which is lawfully authorised for investigative or protective or cyber security activities, for the purposes of verification of identity, or for the prevention, detection, investigation, or 1 Subs. by G.S.R. 794(E), dated 28.10.2022 (w.e.f. 28.10.2022), for clause (f). Clause (f), before substitution stood as under:
“(f) the intermediary shall periodically, and at least once in a year, inform its users of its rules and regulations, privacy policy or user agreement or any change in the rules and regulations, privacy policy or user agreement, as the case may be;”.
2 Ins. by G.S.R. 275(E), dated 6.4.2023.
3 Ins. by G.S.R. 275(E), dated 6.4.2023.
prosecution, of offences under any law for the time being in force, or for cyber security incidents:
Provided that any such order shall be in writing stating clearly the purpose of seeking information or assistance, as the case may be;
(k) the intermediary shall not knowingly deploy or install or modify technical configuration of computer resource or become party to any act that may change or has the potential to change the normal course of operation of the computer resource than what it is supposed to perform thereby circumventing any law for the time being in force:
Provided that the intermediary may develop, produce, distribute or employ technological means for the purpose of performing the acts of securing the computer resource and information contained therein;
(l) the intermediary shall report cyber security incidents and share related information with the Indian Computer Emergency Response Team in accordance with the policies and procedures as mentioned in the Information Technology (The Indian Computer Emergency Response Team and Manner of Performing Functions and Duties) Rules, 2013.
1[(m) the intermediary shall take all reasonable measures to ensure accessibility of its services to users along with reasonable expectation of due diligence, privacy and transparency;
(n) the intermediary shall respect all the rights accorded to the citizens under the Constitution, including in the articles 14, 19 and 21.]
(2) Grievance redressal mechanism of intermediary: (a) The intermediary shall prominently publish on its website, mobile based application or both, as the case may be, the name of the Grievance Officer and his contact details as well as mechanism by which a user or a victim may make complaint against violation of the provisions of this rule or 2[sub-rules (11) to (13) of rule 4, or in respect of] any other matters pertaining to the computer resources made available by it, and the Grievance Officer shall- 3[(i) acknowledge the complaint within twenty-four hours and resolve such complaint within a period of fifteen days from the date of its receipt:
Provided that the complaint in the nature of request for removal of information or communication link relating to clause (b) of sub-rule (1) of rule 3, except sub-clauses
(i), (iv) and 4[(xi)], shall be acted upon as expeditiously as possible and shall be resolved within seventy-two hours of such reporting;
Provided further that appropriate safeguards may be developed by the intermediary to avoid any misuse by users;]
1 Ins. by G.S.R. 794(E), dated 28.10.2022 (w.e.f. 28.10.2022).
2 Ins. by G.S.R. 275(E), dated 6.4.2023.
3 Subs. by G.S.R. 794(E), dated 28.10.2022, for sub-clause (i) (w.e.f. 28.10.2022). Sub-clause (i), before substitution, stood as under:
“(i) acknowledge the complaint within twenty four hours and dispose off such complaint within a period of fifteen days from the date of its receipt;”.
4 Subs. by G.S.R. 275(E), dated 6.4.2023 for “(ix)”.
(ii) receive and acknowledge any order, notice or direction issued by the Appropriate Government, any competent authority or a court of competent jurisdiction.
1[Explanation.—In this rule, “prominently publish” shall mean publishing in a clearly visible manner on the home page of the website or the home screen of the mobile based application, or both, as the case may be, or on a web page or an app screen directly accessible from the home page or home screen.]
(b) The intermediary shall, within twenty-four hours from the receipt of a complaint made by an individual or any person on his behalf under this sub-rule, in relation to any content which is prima facie in the nature of any material which exposes the private area of such individual, shows such individual in full or partial nudity or shows or depicts such individual in any sexual act or conduct, or is in the nature of impersonation in an electronic form, including artificially morphed images of such individual, take all reasonable and practicable measures to remove or disable access to such content which is hosted, stored, published or transmitted by it:
(c) The intermediary shall implement a mechanism for the receipt of complaints under clause
(b) of this sub-rule which may enable the individual or person to provide details, as may be necessary, in relation to such content or communication link.