How Do the DPDP Rules Interact with the IT Act and Intermediary Guidelines?

Introduction

India’s digital regulatory framework is multi-layered. The Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) sit alongside the long-standing Information Technology Act, 2000 (“IT Act”) and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (“Intermediary Guidelines” or “IT Rules, 2021”). Understanding their interaction is essential for platforms, social media intermediaries, e-commerce entities, online gaming intermediaries and other organisations that process digital personal data while hosting or transmitting third-party content.

As of September 2026, the DPDP regime remains subject to a phased commencement. Several institutional provisions of the DPDP Act and the DPDP Rules are already in force, including the establishment of the Data Protection Board of India. Rule 4, dealing with the registration and obligations of Consent Managers, is scheduled to take effect one year after notification of the Rules, while Rules 3 and 5 to 16, 22 and 23 are scheduled to take effect eighteen months after notification, i.e. on 13 May 2027. The corresponding substantive provisions of the DPDP Act are also scheduled to take effect in the eighteen-month phase.

Until the substantive DPDP obligations take effect, the existing framework under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”) continues to be relevant to the protection of sensitive personal data or information under Section 43A of the IT Act. Once Section 44(2) of the DPDP Act takes effect, Section 43A of the IT Act will be omitted.

Interaction with the IT Act, 2000

Section 44 of the DPDP Act makes targeted amendments to the IT Act. Once the relevant provisions take effect in the eighteen-month phase:

• Section 43A of the IT Act, which presently deals with compensation for failure to protect sensitive personal data or information, will be omitted.
• The rule-making power under Section 87(2)(ob), which relates to reasonable security practices and sensitive personal data or information under Section 43A, will also be omitted.
• Section 81 of the IT Act will be amended to include the DPDP Act within its proviso, alongside the Copyright Act and the Patents Act.

These amendments remove the specific data-protection provisions contained in Section 43A and the corresponding rule-making power from the IT Act. They do not repeal the IT Act as a whole.

Core provisions of the IT Act will continue to operate, including:

• Section 79, which provides conditional safe harbour to intermediaries subject to compliance with the statutory requirements, including applicable due diligence obligations;
• provisions dealing with cybersecurity and cyber incidents, including the framework governing CERT-In;
• provisions concerning lawful interception and monitoring, including Section 69;
• provisions relating to computer-related offences and electronic evidence; and
• other sectoral and intermediary-related obligations contained in the IT Act and rules made thereunder.

Accordingly, the transition to the DPDP regime should not be understood as replacing the IT Act in its entirety. Rather, the specific statutory framework for protection of digital personal data will move away from Section 43A and the SPDI Rules towards the DPDP Act and Rules, while other aspects of the IT Act will continue to operate independently.

For example, an intermediary may face consequences under Section 79 and the Intermediary Guidelines for failure to comply with applicable due diligence requirements, while separately facing consequences under the DPDP regime where it acts as a Data Fiduciary and fails to comply with applicable obligations relating to personal data.

The DPDP Act’s approach to other laws

The interaction between the DPDP Act and other legislation is also governed by Section 38 of the DPDP Act. Section 38 provides that the DPDP Act operates in addition to, and not in derogation of, other laws. Where there is a conflict between a provision of the DPDP Act and another law, the DPDP Act prevails to the extent of the conflict.

This provision is important because it indicates that the DPDP Act is not intended to operate as a wholesale replacement for other regulatory regimes. Organisations may therefore continue to be subject to multiple legal obligations, with the DPDP Act assuming priority only where a genuine conflict arises.

Interaction with the Intermediary Guidelines (IT Rules, 2021)

The Intermediary Guidelines remain the principal framework governing intermediary due diligence, grievance redressal and the conditions relevant to safe harbour under Section 79 of the IT Act.

The IT Rules, 2021 have undergone several amendments. Most recently, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 introduced a more detailed framework concerning synthetically generated information (“SGI”), including requirements relating to identification and labelling of certain SGI, additional due diligence obligations and strengthened compliance timelines.

The DPDP framework operates alongside these intermediary obligations.

1. Dual obligations for intermediaries that process personal data

An intermediary is not necessarily a Data Fiduciary merely because it is an intermediary. The classification under the DPDP Act depends on whether the entity determines the purpose and means of processing personal data.

Accordingly, social media intermediaries, e-commerce platforms, online gaming intermediaries and other digital platforms may, depending on their particular activities, be required to comply with both regimes: the content-related due diligence obligations under the Intermediary Guidelines and the personal-data obligations under the DPDP Act and Rules.

The two sets of obligations therefore address different regulatory concerns. The Intermediary Guidelines principally regulate intermediary conduct, content-related due diligence and grievance mechanisms, while the DPDP regime regulates the processing of digital personal data.

2. Retention and preservation

The Intermediary Guidelines contain obligations concerning preservation and retention of certain information in specified circumstances. At the same time, the DPDP framework introduces purpose-based requirements governing the retention and erasure of personal data.

This creates a practical compliance issue for platforms: retention schedules should distinguish between data that must be retained because of a specific statutory or investigative obligation and personal data that no longer needs to be retained for the purpose for which it was processed.

Organisations should therefore maintain documented retention schedules and legal-hold mechanisms so that data required to be preserved under applicable law is appropriately retained, while personal data that is no longer required for a lawful purpose is deleted in accordance with the DPDP framework.

3. Information requests

Rule 23 of the DPDP Rules provides a separate mechanism for information requests. Importantly, the Rule empowers the Central Government, acting through the authorised person specified in the Seventh Schedule, to require a Data Fiduciary or intermediary to furnish information for specified purposes under the DPDP Act. It does not confer a general information-calling power on the Data Protection Board under Rule 23.

This mechanism operates alongside information and investigative powers available under the IT Act and the Intermediary Guidelines. Organisations should therefore have internal processes for identifying the statutory basis of information requests and responding to them appropriately.

4. Breach and incident reporting

The DPDP framework introduces specific obligations relating to personal data breaches. Under Rule 7 of the DPDP Rules, once the relevant provision takes effect, a Data Fiduciary will be required to intimate affected Data Principals without delay and intimate the Data Protection Board in the manner prescribed under the Rules, including furnishing specified information within 72 hours or such longer period as the Board may allow.

Separately, cybersecurity incidents may continue to attract reporting obligations under the CERT-In framework. CERT-In’s Directions of 28 April 2022 require specified cyber incidents to be reported within six hours of noticing them. Where a cybersecurity incident also constitutes a personal data breach, including incidents involving cross-border data transfers of the affected personal data, organisations may therefore need to assess the incident under both frameworks and maintain incident-response processes capable of addressing the respective requirements.

5. Children’s data and synthetically generated information

The DPDP Rules introduce requirements relating to the processing of children’s personal data, including requirements concerning verifiable parental consent, subject to the statutory exemptions. Separately, the 2026 amendments to the Intermediary Guidelines introduce specific due diligence requirements concerning synthetically generated information. These include measures relating to unlawful SGI and, in specified circumstances, labelling and identification requirements.

Accordingly, platforms dealing with both user-generated content and personal data will need to address content-safety and data-protection considerations through separate but coordinated compliance mechanisms.

The two frameworks are therefore complementary rather than contradictory in most areas. Compliance with the Intermediary Guidelines is relevant to maintaining the conditions for safe harbour under Section 79, while compliance with the DPDP Act is relevant where an entity processes personal data as a Data Fiduciary. Compliance with one framework does not, by itself, discharge obligations under the other.

Useful Comparison Table

The comparison demonstrates that the two frameworks should not be treated as substitutes. Rather, organisations may need to comply with both, depending on their activities and the role they perform in relation to personal data and third-party content.

Practical Implications for Organisations

Intermediaries and digital platforms should treat the two regimes as overlapping compliance frameworks and begin preparing well before the substantive DPDP obligations take effect. Organisations should consider the following measures:

• Maintain robust content moderation and takedown workflows to support compliance with the Intermediary Guidelines and the conditions relevant to Section 79 safe harbour.
• Implement DPDP-compliant privacy notices, consent mechanisms and data-principal rights processes, while preparing for the requirements applicable to Consent Managers and other provisions that take effect during the phased rollout.
• Reconcile retention policies so that statutory preservation requirements can be met while personal data that is no longer required for a specified purpose is appropriately deleted.
• Establish coordinated incident-response processes capable of addressing both CERT-In reporting requirements and, once effective, DPDP personal data breach notification requirements.
• Review contracts with vendors and Data Processors to allocate responsibilities relating to security, data processing and incident management.
• Monitor MeitY notifications and amendments to the Intermediary Guidelines, particularly in light of the evolving framework concerning synthetically generated information and intermediary due diligence.

Platforms that operate at significant scale, including Significant Social Media Intermediaries and other large digital businesses, should pay particular attention to the interaction between the two regimes and assess whether their activities may bring them within additional obligations under the DPDP Act.

Frequently Asked Questions