Distributes a software product, in India

Information Technology Act, 2000 (No. 21 of 2000), s.43A; Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (G.S.R. 313(E), 11 April 2011), rr. 3, 4, 5, 6, 8 · Read the law's page

• This binds a body corporate that possesses, deals in, or handles the sensitive personal data or information of a person, meaning a password, a financial account or payment-instrument detail, a physical, physiological, or mental health condition, sexual orientation, a medical record or history, or biometric information, in a computer resource it owns, controls, or operates; information that is freely available in the public domain or obtainable under the Right to Information Act, 2005 is not sensitive personal data or information under these Rules.
• Implement and maintain a comprehensive, documented information security programme with managerial, technical, operational, and physical control measures commensurate with the information assets you protect and the nature of your business; certifying to the international Standard IS/ISO/IEC 27001, or to a Central-Government-approved industry code of best practice, satisfies this duty as a matter of law, provided the certification is audited by an independent, government-approved auditor at least once a year or after a significant upgrade to your process or computer resource.
• Obtain the data provider's written consent, by letter, fax, or email, before collecting their sensitive personal data or information, let them decline or withdraw that consent, publish a privacy policy on your website, and designate a Grievance Officer who must resolve a complaint within one month.
• Negligently failing to implement or maintain these practices, where it causes wrongful loss or wrongful gain to any person, exposes you to an uncapped compensation claim under section 43A of the Information Technology Act; no criminal penalty attaches to section 43A itself.
• This duty is in effect now and is repealed once section 44(2) of the Digital Personal Data Protection Act, 2023 commences, currently scheduled for 13 May 2027; the DPDPA's own security-safeguards duty (section 8(5)) does not commence until the same date, so these Rules remain the operative standard until then.

Consumer Protection Act, 2019 (Act 35 of 2019), ss. 82-87 · Read the law's page

• The Act defines a product as any article, goods, substance or raw material possessing intrinsic value that is capable of delivery, wholly assembled or as a component part, and produced for introduction to trade or commerce; it does not say whether software or an AI system supplied on its own is a product (section 2(33)).
• If you make or assemble a product, put your own mark on one made by others, design or produce it before its sale, or make it and place it on the market, you are liable for harm it causes through a manufacturing defect, a design defect, a deviation from manufacturing specifications, a failure to conform to your express warranty, or missing instructions for correct use or warnings about improper use (sections 2(36), 84(1)).
• Proving that you were not negligent or fraudulent in making the express warranty of a product does not excuse you as its manufacturer (section 84(2)).
• If you provide a service in respect of a product, perform it to the quality, nature and manner the law or your contract requires, do not withhold information in a way that causes harm, issue adequate instructions or warnings, and keep to your express warranty and contract terms; a service that falls short makes you liable for the harm (sections 2(38), 85).
• If you import, sell, distribute or otherwise place on the market a product you did not make, you answer for harm it causes if you controlled its design, testing, manufacture, packaging or labelling, altered it, gave your own express warranty, failed to take reasonable care in assembling, inspecting or maintaining it, or did not pass on the manufacturer's warnings and instructions (sections 2(37), 86(a) to (c), (e)).
• If you sell a product whose manufacturer is unknown, cannot be served, is not subject to the law in force in India, or cannot have an order enforced against it, you answer for the product in the manufacturer's place (section 86(d)).
• Give adequate warnings and instructions with your product; you are not liable for failing to warn where you warned the employer that bought it for the workplace, the purchaser of a component, or the experts under whose supervision it is meant to be used, where the complainant was under the influence of alcohol or an unprescribed drug, or where the danger was obvious or commonly known (section 87(2), (3)).
• A product seller is not liable where the product was misused, altered or modified at the time of harm (section 87(1)).
• Claims cover damage to property other than the product itself, personal injury, illness or death, and attendant mental agony or emotional distress, but not harm to the product itself, damage on account of breach of warranty conditions, or commercial or economic loss (section 2(22)).
• A complaint must reach a District, State or National Commission within two years of the cause of action arising, unless the Commission accepts sufficient cause for the delay and records its reasons (section 69).

Directions under section 70B(6) of the Information Technology Act, 2000, No. 20(3)/2022-CERT-In (Indian Computer Emergency Response Team, Ministry of Electronics and Information Technology, 28 April 2022) · Read the law's page

• Connect all your ICT systems' clocks to the Network Time Protocol server of the National Informatics Centre or the National Physical Laboratory, or to an NTP server traceable to one of them, and ensure any other time source you use does not deviate from NPL or NIC.
• Report a listed cyber security incident, including a targeted attack, a data breach, a data leak, unauthorised access to your IT systems, an attack through a malicious or fake mobile app, or an attack on, or malicious or suspicious activity affecting, an AI or machine learning system, to CERT-In within six hours of noticing it or being notified of it, by email, phone, or fax; current reporting formats and channels are published on CERT-In's own website.
• Enable logs of all your ICT systems and retain them securely, within Indian jurisdiction, on a rolling 180-day basis, and provide them to CERT-In together with an incident report or when CERT-In orders or directs you to.
• Designate a Point of Contact to interface with CERT-In, using the format CERT-In publishes, and keep that designation current.
• If your own service is itself a data centre, a virtual private server provider, a cloud service provider, a virtual private network service, or a virtual asset (crypto) service provider, a narrower and heavier duty also applies: register and retain specified customer KYC information and financial-transaction records for five years. That narrower bound-party class is not one this profile's declared activities can identify on their own, so confirm applicability directly against the text if this describes your service.
• This binds a service provider, intermediary, data centre, body corporate, or Government organisation, the Information Technology Act's own general terms for essentially any commercial or professional actor operating a computer resource in India, not a licensed or sector-specific status; a company distributing software or operating a mobile app in India falls within this reach without needing a specific regulatory registration.
• Failing to furnish information CERT-In calls for, or to comply with a direction it issues, including these Directions, is punishable under section 70B(7) of the Information Technology Act with imprisonment for up to one year, a fine of up to one lakh rupees, or both.

Draft Rights of Persons with Disabilities (Amendment) Rules, 2026, notification S.O. 3962(E), rule 2 (proposed rule 15(1)(c)) · Read the law's page

• This is a draft published for comments: it binds no one until the Central Government makes the final rules, which come into force on their publication in the Official Gazette (draft rule 1(2)).
• If you make websites, apps, software, digital content or electronic documents, or an information and communication technology based service, available to persons in India, make them comply with IS 17802 (Part 1): 2021 and IS 17802 (Part 2): 2022 and with any accessibility requirements your sectoral regulator notifies (proposed rule 15(1)(c)(B) and (C)).
• Meet the clauses of IS 17802 (Part 1) listed in Schedule I for websites, apps, digital content and services within one year of publication of the final rules if your turnover is five hundred crore rupees or more, and within eighteen months otherwise; Schedule II sets the same periods for hardware and consumer products (proposed rule 15(1)(c)(E)(1) and (2)).
• Comply with the standards in their entirety within two years of publication of the final rules (proposed rule 15(1)(c)(E)(4)); archived content clearly identified as archived is exempt from the scheduled timelines (clause (E)(2), Exception).
• Publish an Accessibility Conformance Report for each item on your website or app, in human-readable and machine-readable formats, and re-test and update it before deploying a major change and at least once every two years (proposed rule 15(1)(c)(D)).
• If you run a platform for user-generated content, give users the capability to embed captions, transcripts, alternative text, audio description and accessible formats, adding any missing capability within six months of notification (proposed rule 15(1)(c)(D)(6), Explanation).
• Designate a senior officer from your management as Grievance Redressal Officer and redress accessibility complaints within thirty days (proposed rule 15(1)(c)(H)(1) and (5)).