Rule 3 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Rule 3 of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 sets out the due diligence an intermediary must observe, in sub-rule (1) clauses (a) to (l), and the grievance redressal mechanism, in sub-rule (2). This article explains the Rules as originally notified on 25 February 2021. Later amendments are not covered here; check the current text of the Rules before acting. Rule 3 supports the condition of due diligence in section 79(2)(c) of the Information Technology Act, 2000; see our article on section 79.
An intermediary, including a social media intermediary and a significant social media intermediary, shall observe the due diligence in rule 3(1) while discharging its duties. The periods printed are thirty-six hours (removal on a court order or notification), one hundred and eighty days (preservation of removed information; retention of registration information after cancellation), seventy two hours (providing information or assistance on a written order), twenty four hours and fifteen days (the Grievance Officer), and twenty-four hours (removal of certain content on a complaint under rule 3(2)(b)). Under rule 7, failure to observe the Rules means section 79(1) does not apply.
Rule 3(1): the due diligence, clause by clause
Rule 3(1) reads: "An intermediary, including social media intermediary and significant social media intermediary, shall observe the following due diligence while discharging its duties, namely:-". The clauses are:
| Clause | What the intermediary must do, in outline |
|---|---|
| (a) | prominently publish on its website, mobile based application or both the rules and regulations, privacy policy and user agreement for access or usage of its computer resource |
| (b) | inform users, through those documents, not to host, display, upload, modify, publish, transmit, store, update or share information of the kinds listed in (i) to (x) |
| (c) | periodically inform users, at least once every year, that on non-compliance it has the right to terminate access or usage rights immediately or remove non-compliant information, or both |
| (d) | on actual knowledge in the form of an order by a court of competent jurisdiction, or on being notified by the Appropriate Government or its agency under section 79(3)(b), not host, store or publish unlawful information, with three provisos including the thirty-six hours period |
| (e) | temporary, transient or intermediate storage automatically as an intrinsic feature of the computer resource, involving no human, automated or algorithmic editorial control, is not hosting, storing or publishing for clause (d) |
| (f) | periodically, and at least once in a year, inform users of its rules and regulations, privacy policy or user agreement or any change |
| (g) | preserve removed information and associated records for one hundred and eighty days for investigation purposes, or a longer period required by the court or lawfully authorised Government agencies |
| (h) | retain information collected for registration for a period of one hundred and eighty days after any cancellation or withdrawal of registration |
| (i) | take all reasonable measures to secure its computer resource following the reasonable security practices and procedures as prescribed in the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Information) Rules, 2011 |
| (j) | provide information or assistance to a lawfully authorised Government agency not later than seventy two hours of the receipt of an order |
| (k) | not knowingly deploy or install or modify technical configuration of the computer resource to change its normal operation and circumvent any law, with a proviso for security measures |
| (l) | report cyber security incidents and share related information with the Indian Computer Emergency Response Team in accordance with the Information Technology (The Indian Computer Emergency Response Team and Manner of Performing Functions and Duties) Rules, 2013 |
Clause (b): the categories users are told not to share
The categories in clause (b), in outline, are information that: (i) belongs to another person and to which the user does not have any right; (ii) is defamatory, obscene, pornographic, paedophilic, invasive of another's privacy, including bodily privacy, insulting or harassing on the basis of gender, libellous, racially or ethnically objectionable, relating or encouraging money laundering or gambling, or otherwise inconsistent with or contrary to the laws in force; (iii) is harmful to child; (iv) infringes any patent, trademark, copyright or other proprietary rights; (v) violates any law for the time being in force; (vi) deceives or misleads the addressee about the origin of the message or knowingly and intentionally communicates patently false or misleading information that may reasonably be perceived as a fact; (vii) impersonates another person; (viii) threatens the unity, integrity, defence, security or sovereignty of India, friendly relations with foreign States, or public order, or causes incitement to the commission of any cognisable offence or prevents investigation of any offence or is insulting other nation; (ix) contains software virus or any other computer code, file or program designed to interrupt, destroy or limit the functionality of any computer resource; (x) is patently false and untrue, and is written or published in any form, with the intent to mislead or harass a person, entity or agency for financial gain or to cause any injury to any person.
The Rules do not define each category further in this rule. A platform's user agreement should tell users in its own words not to share those kinds of information; the Rules require the agreement to "inform", and they do not prescribe the wording.
Clause (d): the three provisos
The first proviso says any notification by the Appropriate Government or its agency in relation to information prohibited under any law shall be issued by an authorised agency, as may be notified by the Appropriate Government. The second says that if such information is hosted, stored or published, the intermediary shall remove or disable access "as early as possible, but in no case later than thirty-six hours from the receipt of the court order or on being notified by the Appropriate Government or its agency". The third says removal or disabling on a voluntary basis, or on the basis of grievances received under sub-rule (2), within the categories in the clause "shall not amount to a violation of the conditions of clauses (a) or (b) of sub-section (2) of section 79 of the Act".
If you run a platform and need your user agreement, privacy policy and take-down procedure to line up with rule 3, advice on agreement drafting is a practical starting point.
Rule 3(2): grievance redressal
Rule 3(2)(a) says the intermediary shall prominently publish on its website, mobile based application or both the name of the Grievance Officer and his contact details as well as the mechanism by which a user or a victim may make a complaint against violation of the rule or any other matters pertaining to the computer resources made available by it. The Grievance Officer shall (i) acknowledge the complaint within twenty four hours and dispose of such complaint within a period of fifteen days from the date of its receipt; and (ii) receive and acknowledge any order, notice or direction issued by the Appropriate Government, any competent authority or a court of competent jurisdiction.
Rule 3(2)(b) says the intermediary shall, within twenty-four hours from the receipt of a complaint made by an individual or any person on his behalf, in relation to any content which is prima facie in the nature of material that exposes the private area of such individual, shows such individual in full or partial nudity or in any sexual act or conduct, or is in the nature of impersonation in an electronic form, including artificially morphed images, "take all reasonable and practicable measures to remove or disable access to such content". The clause ends with a colon and no proviso follows; we flag the printing slip and do not correct it. Rule 3(2)(c) requires a mechanism for receipt of such complaints which may enable the individual or person to provide details as may be necessary.
For the data-protection side of grievance redressal, which is a different law with different tests, see our post on section 8 of the Digital Personal Data Protection Act, 2023 on contact information and grievance redressal.
The periods in rule 3
| Rule | Period printed | Event |
|---|---|---|
| 3(1)(c), (f) | at least once every year / once in a year | Informing users |
| 3(1)(d), second proviso | thirty-six hours | Removal or disabling of access after a court order or notification |
| 3(1)(g) | one hundred and eighty days | Preservation of removed information and associated records |
| 3(1)(h) | one hundred and eighty days | Retention of registration information after cancellation or withdrawal |
| 3(1)(j) | seventy two hours | Information or assistance to a lawfully authorised agency on an order |
| 3(2)(a) | twenty four hours; fifteen days | Acknowledge a complaint; dispose of it |
| 3(2)(b) | twenty-four hours | Measures on a complaint about private area, nudity, sexual act or impersonation content |
Rule 3(1)(g) and (h) overlap in subject with section 67C of the Act, which leaves duration to rules the Central Government may prescribe; see our article on sections 67C and 69B. The reference in clause (l) to reporting to the Indian Computer Emergency Response Team is read with section 70B; our article on section 70B covers it.
Consequence of non-observance
Under rule 7, where an intermediary fails to observe the Rules, section 79(1) of the Act is not applicable to it, and the intermediary is liable for punishment under any law for the time being in force, including the provisions of the Act and the Indian Penal Code. The Indian Penal Code reference is quoted as printed; check the current penal law for the corresponding provision. Our article on rules 1, 2 and 7 explains rule 7.
A worked example
Rasoi Marketplace Private Limited, an invented online marketplace, receives a court order directing removal of a listing that is prohibited under a law in force. Under rule 3(1)(d), second proviso, the marketplace must remove or disable access as early as possible and in no case later than thirty-six hours from receipt. Under rule 3(1)(g), it must preserve the information and associated records for one hundred and eighty days, without vitiating the evidence, or longer if the court or an authorised agency requires. The marketplace's Grievance Officer logs the order under rule 3(2)(a)(ii). A well-kept log of times is the marketplace's evidence that it met the periods.
Need help with your platform's terms?
If you operate an app, website or marketplace and need your rules, privacy policy and user agreement drafted to match rule 3, our team can help. See our agreement drafting service.
Key takeaways
- Rule 3(1) lists due diligence in clauses (a) to (l); rule 3(2) deals with the Grievance Officer and complaints about certain content.
- Periods as printed: thirty-six hours, one hundred and eighty days (twice), seventy two hours, once every year, twenty four hours, fifteen days, twenty-four hours.
- Rule 3(2)(b) ends with a colon and no proviso; this is flagged, not corrected.
- Failure to observe the Rules removes section 79(1) under rule 7.
- This article explains the Rules as originally notified; check the current text.
Read next
- Rules 1, 2 and 7 of the Intermediary Guidelines Rules, 2021: definitions, scope and non-observance
- Rules 4 to 6: significant social media intermediary duties
- Section 79 of the Information Technology Act, 2000: exemption from liability of intermediary
- Privacy Policy Draft: DPDP compliant
Disclaimer: Based on a consolidated copy of the Information Technology Act, 2000 as amended by the Information Technology (Amendment) Act, 2008, on the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 as originally notified on 25 February 2021 and on the CERT-In Directions of 28 April 2022, read with the amendments made to the Act by the Jan Vishwas (Amendment of Provisions) Act, 2023 and by section 44 of the Digital Personal Data Protection Act, 2023, as consulted on 2 October 2026. Commencement notifications, other amendments, rules, directions and the current position of each provision are not covered and should be checked. This article is general information, not legal advice; check the official text before acting.