Legal
What we check against
Every law, rule, statutory direction, regulator or CCPA guideline, industry code and technical standard our reports assess a website against — and exactly what we look for under each.
Last updated: 20 September 2026
How to read this list
Not everything below is an Act of Parliament. Rules, statutory directions and orders, regulator guidance, CCPA guidelines, industry self-regulation and voluntary technical standards are labelled separately because their legal effect differs. To be plain about a common misunderstanding: India has no enacted AI Act. What binds a website today on AI and synthetic content is the IT Amendment Rules, 2026, read with the MeitY guidelines, which are advisory.
Register last reviewed: 20 September 2026.
Personal data
Digital Personal Data Protection Act, 2023
Act 22 of 2023
Act of Parliament
- • Consent notice: itemised purposes, plain language, the right to withdraw as easily as to give
- • Purpose limitation, data minimisation and a published retention position
- • Data principal rights — access, correction, erasure, nomination, grievance
- • Children's data and the bar on tracking or targeted advertising at children
- • Processor terms under s.8(2), breach readiness and a named contact
Digital Personal Data Protection Rules, 2025
G.S.R. 846(E), notified 13 November 2025 with phased commencement
Rules
- • Notice, consent-manager, security, breach and erasure requirements as each provision commences
- • Children's data, rights procedures and cross-border restrictions as applicable
- • Board procedure and digital complaint mechanisms
Information Technology Act, 2000
Sections 43A, 72A and 79
Act of Parliament
- • Mandatory privacy policy contents for sensitive personal data
- • Reasonable security practices, disclosure and transfer conditions
- • A named grievance officer with contact details published
IT (Reasonable Security Practices and Sensitive Personal Data or Information) Rules, 2011
Notified under the Information Technology Act, 2000
Rules
- • Mandatory privacy policy contents for sensitive personal data
- • Consent, disclosure, transfer and reasonable-security requirements
- • A named grievance officer with contact details published
Platform duties
IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021
Notified 25 February 2021
Rules
- • Terms of use and the list of prohibited content, published and periodically notified to users
- • Grievance Officer name, contact and disposal timelines
- • Takedown handling and record-keeping for intermediaries
AI and synthetic media
IT Amendment Rules, 2026 — synthetically generated information
G.S.R. 120(E) dated 10 February 2026, in force 20 February 2026
Rules
- • Whether the site offers any tool that creates, alters, publishes or shares synthetic audio or visual content
- • Visible labels on synthetic visuals, prefixed disclosure on synthetic audio, embedded provenance metadata with a unique identifier
- • No feature that strips a label, watermark or metadata
- • Updated timelines on the terms and grievance pages: 3 hours for court or government orders, 2 hours for nudity, morphing and impersonation complaints, 7 days for general grievances, user notification every 3 months
MeitY India AI Governance Guidelines and the generative-AI advisory
Guidelines 5 November 2025; advisory 15 March 2024, as revised
Regulator guidance
- • Whether AI features — chatbots, generated imagery, scoring, voice — are disclosed to users
- • What data the AI feature receives and which provider processes it
- • Whether AI output shown to the public is labelled
Security
CERT-In Directions, 2022
Direction No. 20(3)/2022-CERT-In
Statutory directions / orders
- • Six-hour incident reporting readiness
- • Log retention for 180 days within India
- • Clock synchronisation to NIC or NPL time servers
Commerce and advertising
Consumer Protection Act, 2019
Act 35 of 2019
Act of Parliament
- • Seller and company identity, registered address and contact
- • Cancellation, return and refund terms stated before payment
- • Consumer grievance officer and response timelines
- • Advertisements consistent with the actual goods or services
Consumer Protection (E-Commerce) Rules, 2020
Notified under the Consumer Protection Act, 2019
Rules
- • Seller and company identity, registered address and contact
- • Cancellation, return and refund terms stated before payment
- • Consumer grievance officer and response timelines
CCPA dark patterns and endorsement guidelines
Guidelines for Prevention and Regulation of Dark Patterns, 2023; Guidelines for Prevention of Misleading Advertisements and Endorsements, 2022
CCPA guidelines
- • The thirteen listed dark patterns — false urgency, basket sneaking, confirm shaming, forced action, drip pricing, disguised advertisement and the rest
- • Due diligence behind endorsements and disclosure of material connections
- • Claims capable of substantiation
ASCI Code for Self-Regulation of Advertising Content in India and its guidelines
ASCI Code, Chapters I–IV; Guidelines for Disclaimers; Influencer Advertising in Digital Media; Advertising using Virtual Influencers; Greenwashing; Online Real Money Gaming
Industry self-regulation — not statute
- • Objective claims — 'No.1', 'best', 'guaranteed', percentages — capable of substantiation, with the basis stated
- • Disclaimers legible, in the same medium, and not contradicting the main claim
- • Influencer, affiliate and paid content disclosed upfront and hard to miss
- • Virtual or AI-generated endorsers disclosed as not human
- • Environmental claims evidenced and qualified; real-money gaming and harmful-product rules
- • Fairness in competition — no unsupported disparagement
Legal Metrology (Packaged Commodities) Rules, 2011
Rule 6 declarations for goods sold online
Rules
- • Mandatory declarations on product listings where physical goods are sold
- • Net quantity, retail sale price inclusive of taxes, and consumer care details
Business identity
Company and tax identity disclosure
Rule 26, Companies (Incorporation) Rules, 2014; GST registration display requirements
Rules
- • Legal name, CIN, registered office, telephone and email published on the site
- • GSTIN shown and printed on every invoice
Sector specific
Sector regulator directions, orders and regulations
Applicable RBI, SEBI, IRDAI and TRAI statutory instruments
Statutory directions / orders
- • Binding payment, data-localisation and digital-lending requirements applicable to finance
- • Unsolicited commercial communication and DND obligations
Sector regulator guidance
Applicable RBI, SEBI, IRDAI, health, education and technology guidance
Regulator guidance
- • Non-binding regulator expectations applicable to the site's sector and services
- • Telemedicine, health-data, education and children's-service guidance
Applicable state legislation
State gaming, lottery, Shops and Establishments and other applicable State Acts
Act of Parliament
- • Gaming and lottery restrictions that differ state by state
- • Shops and Establishments and other state-level disclosures
Accessibility
Rights of Persons with Disabilities Act, 2016
Act 49 of 2016
Act of Parliament
- • Applicable non-discrimination and accessibility duties
- • Text alternatives, contrast, keyboard operation and form labelling
- • An accessibility statement and a route to report barriers
Guidelines for Indian Government Websites and Apps (GIGW 3.0)
GIGW 3.0
Regulator guidance
- • Government-site accessibility, usability and quality expectations where applicable
Web Content Accessibility Guidelines
WCAG 2.1 Level AA
Voluntary / technical standard
- • Text alternatives, contrast, keyboard operation, labels and error identification
When the law changes
When a new Act, rule or guideline is notified, we update this register, the report engine and our own published documents together, so what we assess and what we promise stay in step. Read our legal disclaimer for the limits of an automated report.
See where your own site stands
A full audit reads your live pages against every entry above and tells you what to fix first.