India

Rule 3(3), inserted into the Intermediary Guidelines and Digital Media Ethics Code Rules, 2021 by amendment notified 10 February 2026, applies where an intermediary offers a computer resource which may enable, permit, or facilitate the creation, generation, modification, alteration, publication, transmission, sharing, or dissemination of information as synthetically generated information.

Such an intermediary must ensure that any such information not falling within a listed prohibited category (such as child sexual exploitative material or content falsely depicting a real person or event) is prominently labelled, in the visual display or by a prefixed audio disclosure, so a viewer can immediately identify it as synthetically generated.

It must also embed that information with permanent metadata or another technical provenance mechanism, including a unique identifier, to the extent technically feasible. The intermediary must not enable removal, suppression or modification of that label or metadata.

"Synthetically generated information" is defined as audio, visual or audio-visual information artificially or algorithmically created, generated, modified or altered using a computer resource so that it appears real, authentic or true, subject to listed exclusions for routine or good-faith editing, formatting and accessibility work.

Under rule 3(3)(a)(i), such an intermediary must also deploy reasonable and appropriate technical measures, including automated tools or other suitable mechanisms, to not allow any user to create, generate, modify, alter, publish, transmit, share or disseminate synthetically generated information that violates any law in force.

The rule's listed examples include information that contains child sexual exploitative and abuse material, non-consensual intimate imagery content, or is obscene, pornographic, invasive of another person's privacy or sexually explicit. Under rule 3(1)(ca), an intermediary of that kind must additionally inform its users that directing or causing its computer resource to produce or spread such prohibited synthetically generated information may attract penalty or punishment under any law in force.

Rule 3(1)(ca) also requires that notice to say that such a contravention may lead to the immediate disabling of access to or removal of the information, suspension or termination of the violating user's account without vitiating the evidence, and disclosure of the violating user's identity to a complainant who is a victim of the contravention or acts on a victim's behalf.

A significant social media intermediary is a social media intermediary with registered users in India above the threshold the Central Government notifies. Under rule 4(1A), a significant social media intermediary that enables displaying, uploading or publishing information must, before that display, require users to declare whether the information is synthetically generated and deploy appropriate technical measures, including automated tools, to verify the accuracy of the declaration.

Where the declaration or verification confirms that the information is synthetically generated, that intermediary must ensure it is clearly and prominently displayed with a label or notice saying so. These provisions have applied since 20 February 2026, the day the amendment rules state they come into force; the amendment was notified on 10 February 2026.

Section 8(6) requires a Data Fiduciary to give the Board and each affected Data Principal intimation of a personal data breach, in the form and manner prescribed. Rule 7 fills in that detail: notify each affected Data Principal without delay, notify the Board without delay with an initial description, then supply a detailed follow-up report within 72 hours of becoming aware of the breach, or such longer period as the Board allows.

Neither provision is currently in force: s.8 sits in the sections-3-to-17 bucket, appointed by Notification G.S.R. 843(E) (13 November 2025) to commence eighteen months after its own publication date, 13 May 2027; Rule 7 sits in the parallel rules-3-to-16 bucket, appointed to the same 13 May 2027 date by the Rules' own Rule 1(4).

The DPDPA is India's first comprehensive personal-data statute, defining "personal data" broadly and technology-neutrally as any data about an identifiable individual (s.2(t)), with no separate sensitive or special-category tier for any kind of data, biometric included.

A Data Fiduciary must have a lawful basis under s.4 before processing, ordinarily the data principal's free, specific, informed, unconditional and unambiguous consent under s.6, or one of s.7's enumerated legitimate uses (voluntarily-provided data for a specified purpose, state functions, employment, medical emergency). A Data Fiduciary bears general erasure (s.8(7)) and security-safeguard (s.8(5)) duties.

None of ss.4, 6, 7, or 8 have commenced: Notification G.S.R. 843(E) (13 November 2025) appoints eighteen months from its own publication date, 13 May 2027, as their commencement date under clause (c); that calendar date is arithmetic on the notification's own offset, not a separately printed date. Section 2's definitions, by contrast, came into force on the notification's publication date itself, 13 November 2025, under clause (a).

The Rules implement the DPDPA's app-facing detail: consent-notice form, security safeguards, breach notification (Rule 7), children's-data verification, and Significant Data Fiduciary duties including an annual Data Protection Impact Assessment and algorithmic-fairness assessment (Rule 13).

As notified, only Rules 1, 2, and 17 to 21, the Data Protection Board's own administrative machinery (member recruitment, meeting procedure, digital-office functioning, staff appointment), are currently in force. Rule 4 (Consent Manager registration) commences 13 November 2026; the app-facing bulk (Rules 3, 5 to 16, 22, and 23) commences 13 May 2027.

Section 16(1) sets a blacklist model: transfer of personal data outside India is permitted by default to any country or territory, except where the Central Government affirmatively notifies a restriction. This flips the 2019/2021 draft Bills' government-approved whitelist model. No data-localization mandate appears anywhere in the Act.

Section 16 sits inside the sections-3-to-17 bucket; Notification G.S.R. 843(E) (13 November 2025) appoints eighteen months from its own publication date, 13 May 2027, as this bucket's commencement date.

A data principal may demand a summary of their processed personal data and the identities of the Fiduciaries and Processors it was shared with (s.11), correction, completion, updating and erasure (s.12), grievance redressal against the Fiduciary in the first instance with a complaint to the Board only after that process is exhausted (s.13), and a right to nominate another individual to exercise these rights on death or incapacity (s.14).

No express portability or objection right appears in the Act text as read. Notification G.S.R. 843(E) (13 November 2025) appoints eighteen months from its own publication date, 13 May 2027, as Chapter III's commencement date.

The Data Protection Board of India (Chapter VI, ss.18-26) is established and administratively operational, and section 39's ouster of civil-court jurisdiction over any matter the Board is empowered to decide is also in force, both since 13 November 2025 under Notification G.S.R. 843(E), clause (a).

Its penalty powers, set out in the Schedule under s.33(1), are exclusively civil monetary: up to Rs 250 crore for a failure to take reasonable security safeguards, up to Rs 200 crore for failing to notify a breach, up to Rs 200 crore for a children's-data violation, up to Rs 150 crore for a Significant Data Fiduciary violation, and up to Rs 10,000 for a data principal's own breach of their s.15 duties (impersonation, suppressing material information, frivolous complaints).

No provision found authorizes the Board to award compensation to an affected data principal directly; its penalties are payable to government. Section 33 (the penalty Schedule) and the rest of the complaint and appeal machinery (ss.27-34, except s.27(1)(d)) have not commenced; Notification G.S.R. 843(E), clause (c), appoints eighteen months from its own publication date, 13 May 2027, as their commencement date.

Section 43 makes any person who, without the permission of a computer resource's owner or the person in charge of it, accesses or secures access to it, or downloads, copies or extracts data from it, liable to pay damages by way of compensation to the person so affected; the 2009 amendment that substituted this closing language removed the original one-crore-rupee ceiling, so the civil compensation now carries no cap. Section 66 makes the same conduct, done dishonestly or fraudulently, a criminal offence punishable with imprisonment for a term which may extend to three years or a fine which may extend to five lakh rupees, or both.

The Act has applied since its own commencement, 17 October 2000, per the Central Government's notification under section 1(3).

Section 2(o) defines a literary work to include computer programmes, tables and compilations including computer databases, so a database or compilation is protected only as an ordinary literary work rather than under a separate sui generis database right, which the Act does not create.

Section 51 makes any unlicensed exercise of the copyright owner's exclusive rights an infringement, and section 63 punishes a knowing infringement with imprisonment of not less than six months and up to three years, and a fine of not less than fifty thousand rupees and up to two lakh rupees.

Section 52(1)(a) confines fair dealing, for any work other than a computer programme, to private or personal use including research, criticism or review, and the reporting of current events and current affairs, and names no exception for text-and-data-mining or AI-model training.

Section 65A separately makes it an offence, punishable by up to two years' imprisonment and a fine, to circumvent an effective technological protection measure with the intention of infringing a right the Act confers, subject to listed exceptions including encryption research and authorised security testing. The Act has applied since its own commencement, 21 January 1958, per notification under section 1(3).

Paragraph 15 requires a commercial bank to put in place a Cybersecurity Policy, approved by its Board and distinct from its broader IT and information security policy. Paragraph 151 requires vulnerability assessment of critical information systems and systems in the demilitarised zone with a customer interface at least once in every six months, and penetration testing at least once in 12 months.

Paragraph 153 requires a commercial bank to fix identified vulnerabilities and associated risks in a time-bound manner. Paragraph 212 requires a commercial bank to put in place a framework for establishment and operation of a Cyber Security Operations Centre. Paragraph 215 requires the systems for monitoring security operations to enable collection of logs, their correlation through SIEM tools and the generation of alerts. Paragraph 3 applies the Directions to commercial banks.

The Reserve Bank of India issues the Directions in exercise of the powers conferred by Section 27 and Section 35-A of the Banking Regulation Act, 1949. Paragraph 233 makes the interpretation of any provision of the Directions by the Reserve Bank final and binding on all concerned entities. Paragraph 230 repeals the existing directions on Cybersecurity Framework and IT Governance as applicable to commercial banks. Paragraph 2 brings the Directions into effect immediately upon issuance.

Rule 4(4)(a) requires every telecommunication entity to adopt a telecom cyber security policy and to inform the Central Government of its adoption. Rule 4(4)(f) requires a telecommunication entity to conduct periodic telecom cyber security audits of its network and to share the audit report with the Central Government. Rule 4(4)(h) requires a telecommunication entity to establish facilities such as a Security Operations Centre, by itself or in collaboration with other telecommunication entities.

Rule 6 requires every telecommunication entity to appoint a Chief Telecommunication Security Officer, who is responsible to the board of directors or similar governing body of the entity. Rule 4(3) requires every telecommunication entity to ensure compliance with the directions and standards the Central Government issues to prevent misuse of telecommunication identifiers, equipment, networks and services.

Rule 9 provides that any contravention of the Rules is dealt with in accordance with the provisions of the Telecommunications Act, 2023. The Rules came into force on the date of their publication in the Official Gazette. The Rules were made by a notification of the Ministry of Communications dated 21 November 2024.

A body corporate, meaning any company, firm, sole proprietorship, or other association of individuals engaged in commercial or professional activities, that possesses, deals in, or handles sensitive personal data or information, meaning a password, a financial account or payment-instrument detail, a physical, physiological, or mental health condition, sexual orientation, a medical record or history, or biometric information, in a computer resource it owns, controls, or operates, must implement and maintain reasonable security practices and procedures: a comprehensive, documented information security programme with managerial, technical, operational, and physical control measures commensurate with the information assets it protects.

Certification to the international Standard IS/ISO/IEC 27001 is deemed to satisfy this duty as a matter of law. That certification must be audited by an independent, government-approved auditor at least once a year. The same Rules require the body corporate to publish a privacy policy on its website. The body corporate must also appoint a Grievance Officer.

Section 43A of the Information Technology Act makes a body corporate negligent in implementing or maintaining this programme liable to pay uncapped compensation to any person it causes wrongful loss or wrongful gain.

Any service provider, intermediary, data centre, body corporate, or Government organisation that operates a computer resource in India must synchronise all its ICT system clocks to the Network Time Protocol servers of the National Informatics Centre or the National Physical Laboratory, or an equivalent source that does not deviate from them. The same entities must enable logs of all their ICT systems and retain them securely within Indian jurisdiction on a rolling 180-day basis.

They must also designate a Point of Contact for CERT-In. They must mandatorily report a broad enumerated list of cyber security incidents to CERT-In within six hours of noticing the incident or being notified of it. That enumerated list includes a data breach, a data leak, an attack through a malicious or fake mobile app, and attacks on systems and applications related to artificial intelligence and machine learning.

Data centres, virtual private server providers, cloud service providers, virtual private network service providers, and virtual asset service providers face an additional duty to register and retain specified customer KYC and transaction records for five years.

Paragraph 182 requires a commercial bank to report cyber incidents within six hours of detection on the DAKSH platform, the Reserve Bank's Advanced Supervisory Monitoring System, and to notify CERT-In proactively about cyber incidents. Paragraph 183 requires a commercial bank to have clear communication plans for escalation and reporting of incidents to the Board and Senior Management and to customers, as required.

Paragraph 181 requires a commercial bank to analyse cyber incidents for their severity, impact and root cause, and to take corrective and preventive measures. Paragraph 3 applies the Directions to commercial banks. The Reserve Bank of India issues the Directions in exercise of the powers conferred by Section 27 and Section 35-A of the Banking Regulation Act, 1949.

Paragraph 233 makes the interpretation of any provision of the Directions by the Reserve Bank final and binding on all concerned entities. Paragraph 2 brings the Directions into effect immediately upon issuance.

Rule 7(1)(a) requires a telecommunication entity to report a security incident affecting its telecommunication network or telecommunication service to the Central Government within six hours of becoming aware of it, with relevant details of the affected system including a description of the incident.

Rule 7(1)(b) requires the entity to furnish, within twenty-four hours of becoming aware of the incident, the number of users affected, the duration, the geographical area affected, the extent to which the network or service is affected and the remedial measures taken or proposed. Rule 7(2) allows the Central Government to inform the public of a security incident where it determines that disclosure is in the public interest, or to require the affected telecommunication entity to do so.

Rule 7(3) allows the Central Government to require the entity to provide information needed to assess the security of its network and service, including its telecom cyber security policy, and to carry out a security audit by a certified agency. Rule 7(4) allows the Central Government to issue directions to remedy a security incident or prevent one when a significant threat has been identified, and to set time limits for implementing them.

Rule 2(1)(e) defines a security incident as an event having real or potential risk on telecom cyber security. Rule 9 provides that any contravention of the Rules is dealt with in accordance with the provisions of the Telecommunications Act, 2023. The Rules came into force on the date of their publication in the Official Gazette.

Section 79(1) provides that, notwithstanding anything contained in any law for the time being in force but subject to sub-sections (2) and (3), an intermediary is not liable for any third party information, data or communication link made available or hosted by it.

An intermediary, with respect to any particular electronic records, is any person who on behalf of another person receives, stores or transmits that record or provides any service with respect to that record, and the definition in section 2(1)(w) names telecom service providers, network service providers, internet service providers, web-hosting service providers, search engines, online payment sites, online-auction sites, online-market places and cyber cafes.

Section 79(2) applies the exemption if the function of the intermediary is limited to providing access to a communication system over which information made available by third parties is transmitted or temporarily stored or hosted, or if the intermediary does not initiate the transmission, does not select the receiver of the transmission, and does not select or modify the information contained in the transmission.

Section 79(2) also requires that the intermediary observe due diligence while discharging its duties under the Act and observe such other guidelines as the Central Government may prescribe. Section 79(3) removes the exemption if the intermediary has conspired or abetted or aided or induced, whether by threats or promise or otherwise, the commission of the unlawful act.

Section 79(3) also removes the exemption if, upon receiving actual knowledge, or on being notified by the appropriate Government or its agency, that information, data or a communication link residing in or connected to a computer resource it controls is being used to commit the unlawful act, the intermediary fails to expeditiously remove or disable access to that material on that resource without vitiating the evidence in any manner.

Section 81 gives the Act overriding effect over inconsistent law, and provides that nothing in the Act restricts any person from exercising any right conferred under the Copyright Act, 1957 or the Patents Act, 1970. The Digital Personal Data Protection Act, 2023 adds itself to that proviso by its section 44(2).

Rule 3(1) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 lists the due diligence that an intermediary must observe while discharging its duties. Rule 7 of those Rules provides that where an intermediary fails to observe them, section 79(1) does not apply to it and it is liable for punishment under any law in force.

Rule 3(1)(d) of those Rules requires an intermediary to remove or disable access to information used to commit an unlawful act of the kinds it lists within three hours of receiving actual knowledge.

That actual knowledge arises only from an order of a court of competent jurisdiction or from a reasoned written intimation issued by an authorised officer of the appropriate Government or its agency who is not below the rank of Joint Secretary or an officer equivalent in rank, or a Director or an officer equivalent in rank where no officer of that rank is appointed.

Where the police administration issues the intimation, each authorised officer must be not below the rank of Deputy Inspector General of Police. An amendment notified on 10 February 2026 replaced the thirty-six hour period in that clause with three hours. Rule 3(1)(d) was substituted with effect from 15 November 2025.

An intermediary must make reasonable efforts, by itself and by causing the users of its computer resource, not to host, display, upload, modify, publish, transmit, store, update or share the information that rule 3(1)(b) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 lists.

Clause (v) of that sub-rule lists information that deceives or misleads the addressee about the origin of the message or knowingly and intentionally communicates any misinformation or information which is patently false and untrue or misleading in nature.

A 2023 amendment added to clause (v) information that, in respect of any business of the Central Government, is identified as fake or false or misleading by such fact check unit of the Central Government as the Ministry may specify by notification in the Official Gazette. Those words were inserted by a notification dated 6 April 2023.

In an opinion delivered on 20 September 2024 in Kunal Kamra v. Union of India, the third judge of the Bombay High Court concluded that rule 3(1)(b)(v) as amended in 2023 is liable to be struck down. By its order of 26 September 2024 in the same case, a Division Bench of the Bombay High Court, in view of that opinion and the majority opinion, declared the amendment of 6 April 2023 to rule 3(1)(b)(v) unconstitutional and struck it down.

Section 46 requires service providers, whether Government or private, to provide services in accordance with the rules on accessibility formulated by the Central Government under section 40 within two years from the date of notification of those rules. The Central Government may, in consultation with the Chief Commissioner, extend the time for providing certain categories of services in accordance with the rules.

In its judgment of November 8, 2024 the Supreme Court noted that section 46 gives service providers two years to comply with the accessibility rules and that the timelines in these provisions have long passed. Section 40 requires the Central Government to formulate rules laying down the standards of accessibility for information and communications, including appropriate technologies and systems, and other facilities and services provided to the public.

A person who contravenes any provision of the Act or of a rule made under it is punishable for a first contravention with a fine that may extend to ten thousand rupees. For any subsequent contravention the fine is not less than fifty thousand rupees and may extend to five lakh rupees. Where a company commits an offence under the Act, every person in charge of and responsible to the company for the conduct of its business, as well as the company, is deemed to be guilty of the offence.

That person is not liable if the person proves that the offence was committed without his knowledge or that he had exercised all due diligence to prevent it. A director, manager, secretary or other officer of the company is also guilty of the offence where it was committed with that officer's consent or connivance or is attributable to that officer's neglect.

A person who fails to produce documents or furnish information the Act or a direction under it requires is punishable with a fine that may extend to twenty-five thousand rupees for each offence, and a further fine that may extend to one thousand rupees for each day the failure continues. Offences under the Act are tried by a Court of Session that the State Government specifies as a Special Court for each district.

The Supreme Court directed on November 8, 2024 that, once the Union Government prescribes mandatory accessibility rules, the consequences in sections 46 and 89, including fines, be implemented in cases of non-compliance with rule 15 of the Rules. The Act came into force on April 19, 2017, the day the Central Government appointed by notification.

Rule 15(1) provides that every establishment shall comply with the standards it lists relating to physical environment, transport and information and communication technology. Section 2(i) of the Act provides that establishment includes a Government establishment and private establishment. Item (i) of rule 15(1)(c) sets the website standard as specified in the guidelines for Indian Government websites, as adopted by the Department of Administrative Reforms and Public Grievances.

Item (ii) requires documents to be placed on websites to be in Electronic Publication (ePUB) or Optical Character Reader (OCR) based pdf format. The rules are made under the Act by a notification dated June 15, 2017. The rules come into force from the date of their publication in the Official Gazette. Under rule 15(2), the respective Ministries and Departments are to ensure compliance with the standards of accessibility through the concerned domain regulators or otherwise.

On November 8, 2024 the Supreme Court held that several of the guidelines prescribed in rule 15 appear to be recommendatory guidelines under the garb of mandatory rules, and that rule 15(1) is ultra vires the Act. The Court clarified that progressive compliance with the standards listed in rule 15(1) must continue, and directed the Union Government to delineate mandatory rules.

It directed that once those mandatory rules are prescribed, the consequences in sections 44, 45, 46 and 89 of the Act, including fines, be implemented in cases of non-compliance with rule 15. A draft notified on July 16, 2026 would replace clause (c) of rule 15(1), and with it these items.

Rule 15(1) provides that every establishment shall comply with the standards it lists relating to physical environment, transport and information and communication technology. Section 2(i) of the Act provides that establishment includes a Government establishment and private establishment.

Item (iii) of rule 15(1)(c), inserted by the Rights of Persons with Disabilities (Amendment) Rules, 2023, requires websites, apps and information and communication technology based public facilities and services to comply with the Indian standards IS 17802 (Part 1), 2021 and IS 17802 (Part 2), 2022.

The same item reaches electronic goods and equipment meant for everyday use, information and communication technology based consumer products and accessories for general use, and other products and services which are based on information and communication technology. The standards are published by the Bureau of Indian Standards and apply as amended from time to time. The amending rules are made by a notification dated May 10, 2023.

The amending rules come into force on the date of their publication in the Official Gazette. The Gazette in which the amending rules appear is dated Thursday, May 11, 2023. Under rule 15(2), the respective Ministries and Departments are to ensure compliance with the standards of accessibility through the concerned domain regulators or otherwise.

On November 8, 2024 the Supreme Court held that several of the guidelines prescribed in rule 15 appear to be recommendatory guidelines under the garb of mandatory rules, and that rule 15(1) is ultra vires the Act. The Court clarified that progressive compliance with the standards listed in rule 15(1) must continue, and directed the Union Government to delineate mandatory rules.

It directed that once those mandatory rules are prescribed, the consequences in sections 44, 45, 46 and 89 of the Act, including fines, be implemented in cases of non-compliance with rule 15. A draft notified on July 16, 2026 would replace clause (c) of rule 15(1), and with it this item.

Rule 15(1) provides that every establishment shall comply with the standards it lists relating to physical environment, transport and information and communication technology. Section 2(i) of the Act provides that establishment includes a Government establishment and private establishment.

Clause (p) of rule 15(1), inserted by the Rights of Persons with Disabilities (Amendment) Rules, 2024, adds the accessibility standards and guidelines for the banking sector specified in a notification of the Department of Financial Services dated February 2, 2024. The banking standards say that information and communication technology related changes, including to ATMs, websites and mobile applications, should comply with IS 17802.

They say that the Web Content Accessibility Guidelines 2.1 should be followed. Before launching new advanced technology ATMs and self-service kiosks, a bank should ensure that the machines have built-in accessibility features, and ATMs should give audio support for all information. Banks are to develop accessible communication strategies through hearing enhancement systems, closed captioning, sign language interpretation and relay services.

Banks are to follow specific provisions of IS 17802 for authoring digital documents for customers and employees with disabilities. Banks are to provide bank e-statements in accessible PDF format or in alternative accessible formats to customers with disabilities. The amending rules are made by a notification dated July 2, 2024. The amending rules come into force on the date of their publication in the Official Gazette.

The Gazette in which the amending rules appear is dated Tuesday, July 2, 2024. On November 8, 2024 the Supreme Court held that several of the guidelines prescribed in rule 15 appear to be recommendatory guidelines under the garb of mandatory rules, and that rule 15(1) is ultra vires the Act. The Court clarified that progressive compliance with the standards listed in rule 15(1) must continue, and directed the Union Government to delineate mandatory rules.

It directed that once those mandatory rules are prescribed, the consequences in sections 44, 45, 46 and 89 of the Act, including fines, be implemented in cases of non-compliance with rule 15.

The circular is addressed to all intermediaries registered with SEBI under Section 12 of the Securities and Exchange Board of India Act, 1992 and to stock exchanges. It records that the Supreme Court, in its judgment dated April 30, 2025, directed that the process of digital KYC be accessible to persons with disabilities.

Intermediaries are to extend their services enabling digital accessibility to clients including persons with disabilities, guided by SEBI's FAQ on account opening by persons with disabilities. The circular is issued in exercise of the powers conferred under Section 11(1) of the Securities and Exchange Board of India Act, 1992.

SEBI issued a circular on July 31, 2025 on mandatory compliance by all regulated entities with the Rights of Persons with Disabilities Act, 2016 and rules made under it. The circular of September 25, 2025 sets the compliance guidelines for it and applies to all regulated entities that are required to directly submit compliance to SEBI. Regulated entities are to submit a list of the digital platforms they provide for investors by September 30, 2025.

The guidelines set dates to conduct an accessibility audit of the digital platforms by April 30, 2026, and to remediate the audit findings and ensure compliance with the circular by July 31, 2026. A circular of October 30, 2026 extends the time for the appointment of an IAAP certified auditor, the conduct of the accessibility audit and the remediation of its findings to January 31, 2027. It leaves the other provisions of the circulars unchanged.

Regulated entities are to give annual compliance with accessibility audits of all digital platforms and submit the final report to SEBI by April 30, 2027. The circular of December 8, 2025 provides that, instead of meeting the compliance requirement for appointment of an accessibility auditor by December 14, 2025, regulated entities submit a status of their readiness and compliance. That status is due for each digital platform by March 31, 2026.

Regulated entities are to conduct periodic accessibility audits of their digital platforms, including websites, mobile apps and portals, through certified accessibility professionals. An investor can lodge an accessibility complaint against a regulated entity on SCORES. In response to the complaint the regulated entity is to remediate the accessibility related issue for the closure of the complaint.

The status format asks whether each digital platform meets a minimum level of accessibility at AA level as per the latest WCAG guidelines. The circulars are issued in exercise of the powers conferred under Section 11(1) of the Securities and Exchange Board of India Act, 1992.

Rule 8 binds a publisher of online curated content, defined as one who, performing a significant role in determining the content made available, makes available to users a computer resource enabling access to online curated content over the internet. Rule 9 requires that publisher to observe the Code of Ethics in the Appendix.

That Code classifies all such content into a "U" rating suitable for all ages, with tiered "U/A 7+", "U/A 13+" and "U/A 16+" ratings viewable below the stated age with parental guidance. It also sets an "A" rating restricted to adults, a person the Rules define as eighteen years or older. A publisher making available content classified U/A 13+ or higher must ensure access control mechanisms, including parental locks, are available for it.

A publisher making available "A"-rated content must implement a reliable age-verification mechanism for its viewership. Every publisher offering "A"-rated content must take all efforts to restrict a child's access to it through appropriate access-control measures. The Rules have applied since their own commencement, 25 February 2021, the date of their Official Gazette publication.

Section 52(1)(a)(iii) excuses, as fair dealing, the reporting of current events and current affairs, including the reporting of a lecture delivered in public. Section 52(1)(m) separately excuses the reproduction in a newspaper, magazine or other periodical of an article on current economic, political, social or religious topics, unless the article's author has expressly reserved the right of such reproduction, which makes this exception an opt-out rather than an unconditional one.

Section 39(b) gives the same fair-dealing protection, for the reporting of current events, to excerpts of a broadcast or of a recorded performance. The Act has applied since its own commencement, 21 January 1958, per notification under section 1(3).