Description

Adoption of Information Technology Rules 2021 including data retention requirement

On 25 February 2021, the India Ministry of Electronics and Information Technology adopted the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 which include the requirement for "significant social media intermediaries" to retain user information for 6 months if the user cancels its registration from the service. The entities that have above 5 million registered users are classified as “significant social media intermediaries” and will have to comply with the data retention requirement. Moreover, any content that is removed from the social media platform because it is unlawful or after a grievance complaint shall be retained for 6 months for investigation purposes, or for longer if requested by judiciary courts or authorised Government agencies.

Original source

Scope

Policy Area
Data governance
Policy Instrument
Data protection regulation
Regulated Economic Activity
platform intermediary: user-generated content
Implementation Level
national
Government Branch
executive
Government Body
central government

Complete timeline of this policy change

Hide details
2021-02-25
adopted

On 25 February 2021, the India Ministry of Electronics and Information Technology adopted the Infor…

Key regulatory dimensions

Regulated subjects

The businesses, government agencies or individuals affected by this policy or regulatory change.
producer / supplier
1
Type Private organisation
Economic activity platform intermediary: user-generated content
Category All
2
Type Private organisation
Economic activity platform intermediary: user-generated content
Category All

Policy change by business practice

The detailed activities within the scope of this policy or regulatory change.
user content: any format: storage (any form)
Regulatory tool
Recordkeeping requirement
Sanctions
Regulated subjects
1
Regulatory tool
Regulator reporting requirement
Sanctions
Regulated subjects
2
Regulatory tool
Sanctions
Determined by existing law or regulation
Regulated subjects
1 2
personal data (all forms): storage (any form)
Regulatory tool
Data storage/retention obligation
Sanctions
Regulated subjects
1 2

Policy change by business practice

The detailed activities within the scope of this policy or regulatory change.

user content: any format: storage (any form)

personal data (all forms): storage (any form)