IT Rules 2021 Compliance for Social Media Apps in India

IT Rules 2021 compliance for a social media app means meeting the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the Indian rules that set what an operator of a platform hosting user content must publish, respond to and remove. Every intermediary has a base set of duties. A larger group, the significant social media intermediaries, carries more. This guide explains both tiers in plain terms, shows the timelines as they stand after the 2026 amendment, and lists what an operator should set up before launch. This guide is informational only; the text of the rules and your counsel decide.

If you are planning a regional short video app, our Moj clone app gives you the reporting, reviewer and admin tools that these duties rely on. The legal setup, the officers and the policies are yours to hold. The companion guides on moderating Indian language video content and short video app payments in India cover the operations behind the rules.

Who do the IT Rules 2021 apply to?

The rules apply to intermediaries, a term from the Information Technology Act that covers services which host or transmit content for other people. The rules define a social media intermediary as one that primarily or solely enables online interaction between two or more users and lets them create, upload, share, disseminate, modify or access information. A short video app fits that definition.

The rules then draw a line. A significant social media intermediary is a social media intermediary whose number of registered users in India is above a threshold notified by the Central Government. Reporting on the February 2021 notification, Business Today gives the threshold as 50 lakh (5 million) registered users in India. Because the threshold is set by notification, it can change, so confirm the current figure in the Gazette before you rely on it.

The last row matters for a new app. Rule 6 lets the Ministry, by a reasoned written order, require a service below the threshold to follow some or all of rule 4 if its design could allow harmful content to spread widely. A start-up should therefore build the rule 4 habits early, since they are the habits regulators expect from a larger platform.

What does every operator have to do under rule 3?

Rule 3 is the baseline. Even a new app with a few thousand users falls under it.

1. Publish your rules, privacy policy and user agreement, and communicate them in English or the Eighth Schedule language each user prefers, repeating the notice yearly.
2. Make reasonable efforts to keep users from hosting the categories of content listed in rule 3(1)(b), which include obscene or pornographic material, content harmful to a child, impersonation, material that infringes intellectual property and content that threatens the unity and integrity of India.
3. Remind users at least once a year that non-compliance can lead to loss of access or removal of content.
4. Remove or disable access to unlawful information on receiving a court order or a notification from the Appropriate Government or its authorized agency, within the time the rule sets.
5. Preserve removed information and related records for 180 days for investigation, or longer if a court or authorized agency requires.
6. Retain a user's registration information for 180 days after the account is canceled or withdrawn.
7. Follow reasonable security practices and procedures, as set out in the 2011 rules the text names.
8. Publish the name and contact details of a Grievance Officer, prominently, with a way for users and victims to complain.

"Prominently publish" has a definition: a clearly visible place on the website home page or the home screen of the app, or a page or screen directly reachable from it. A link buried in a footer is a poor reading of that text. Place the grievance officer's details where a worried user can find them in two taps.

What do the grievance officer and takedown timelines look like?

The Grievance Officer must acknowledge a complaint within 24 hours, resolve it within a set period, and receive and acknowledge orders and notices from government and courts. Rule 3(2)(b) separately covers complaints from an individual about content that exposes the private area, shows nudity or a sexual act, or impersonates them, including morphed images, and requires reasonable and practicable measures to remove or disable access within a short window after the complaint.

The timelines changed in 2026. The consolidated text on MeitY's site, updated to 6 April 2023, shows the earlier figures. Hogan Lovells and MediaNama report that MeitY notified an amendment on 10 February 2026 with effect from 20 February 2026. The table sets both side by side; the 2026 column comes from those summaries, so check it against the notification in the Gazette before you set your service levels.

These clocks are short. A 3-hour window cannot be met by a team that checks email once a day. The path should be: a named inbox or portal, an on-call person, a standing procedure to disable a clip or an account, and a record of the time received and the time acted on. The admin panel supports the action side: reviewers can remove content and apply a ban with a recorded reason, and staff roles keep the right people on the right queue.

Setting up the complaint inbox and the clock log

Short clocks are met by systems, not by effort. Build the complaint channel so that every item arrives with a timestamp and leaves with one.

• Use a single, monitored entry point for complaints, with an address and a form that both feed the same log.
• Record the received time automatically, and never retype it later from memory.
• Classify each item at intake: ordinary grievance, intimate imagery or impersonation complaint, court or government order, or appeal. The class decides which clock applies.
• Assign an owner and a backup the moment the item arrives, with the deadline shown next to it.
• Record each action with its time, the person who took it and the reason.
• Send the complainant an acknowledgment that carries a reference number they can quote.

Test the whole path outside office hours at least once before launch. The most common weakness is not a missing tool but an inbox that nobody watches on a holiday.

Appeals to the Grievance Appellate Committee

The rules also provide for appeals to a Grievance Appellate Committee set up by the Central Government, and an intermediary must comply with the committee's orders and upload a report to that effect on its website. Plan a procedure for receiving such an order, because it arrives through the same grievance channel.

What extra duties apply to a significant social media intermediary?

Rule 4 adds a set of duties once an operator crosses the notified threshold. The text gives them in order.

Reports of the 2026 amendment add a further duty for these larger platforms: asking users to declare whether content is synthetically generated, using technical measures to verify the declaration, and labeling content confirmed as synthetic. Treat the exact wording as something to read in the notification.

The Chief Compliance Officer is a personal role

The rule says this officer is liable in proceedings relating to third-party content if they fail to ensure due diligence, after an opportunity to be heard. That is why the role should go to someone with authority over product and operations, backed by evidence in the form of logs and reports.

What happens if an operator does not follow the rules?

Rule 7 states the consequence in one sentence: if an intermediary fails to observe the rules, the protection of section 79(1) of the IT Act does not apply to it, and it is liable for punishment under any law in force. Section 79 is the safe harbour that shields an intermediary from liability for third-party content when it meets conditions. Losing it means being treated closer to the publisher of what users upload.

This is the reason compliance is a launch gate and not a later project. It is also why records matter. If someone challenges a decision, the log of when you received a complaint and when you acted is your evidence of due diligence.

How do you build a compliance stack for a short video app?

Divide the work into people, pages, tooling and records.

• People: a Grievance Officer from day one; for larger scale, a Chief Compliance Officer, a nodal contact person and a Resident Grievance Officer, all resident in India.
• Pages: terms, privacy policy and community rules, in the languages you serve; a prominent grievance page; a physical contact address if you are, or may become, a significant intermediary.
• Tooling: in-app reporting, a review queue, a user-facing notice and appeal flow, and a log that stamps each step.
• Records: 180-day preservation of removed content and associated records; registration data retention after account closure; monthly reports from the logs.

Our platform covers the tooling side with facts you can check. Members get block and report buttons for accounts, clips, comments and profiles. Reports collect in one queue where reviewers apply a warning, strike or ban and note the reason. Sign-up shows consent prompts, members can erase their profile or export their data, and you choose the retention periods. A second sign-in step is available for staff. Ticket numbers, notices to users, monthly reports and time-stamped order handling are available with our platform; the scope for your build is settled with us at kickoff. The companion guide moderating Indian language video content shows how the queue and the escalation path fit these timelines.

Records worth keeping and who owns them

Retention periods other than the two 180 day figures above are a question for your counsel, who will weigh the privacy side against the duty to preserve. Set the periods in the platform once they agree, and write down who can change them.

What does the first 3 hours look like for a takedown order?

As an illustration of the process, not a real case, say a notice arrives at the grievance inbox at 10:00. A workable sequence under a 3-hour clock looks like this.

1. 10:00 to 10:15: the Grievance Officer logs the receipt time and checks that the notice comes from a court or an authorized agency.
2. 10:15 to 10:45: the reviewer locates every URL and copy named in the order, including reposts and duets.
3. 10:45 to 11:30: the reviewer disables access and records the reason, the links and the time.
4. 11:30 to 12:00: the Grievance Officer confirms the action in writing to the sender and preserves the content and records for 180 days or longer.
5. Within the day: a counsel review and, where applicable, a notice to the uploader.

The table of timelines above tells you the minimum tempo. If your team cannot run this sequence at 3 a.m. on a Sunday, define who can, and give them the admin access to do it.

Keeping policy pages and the app in step

The published pages and the live product drift apart unless someone owns the link between them. Every time a feature changes what you collect, host or share, ask whether the terms, the privacy policy or the community rules need an update. Give each page an owner and a version date, show the date to users, and keep the older versions on file. When the app adds a language, publish the pages in that language before the language opens, and check that the grievance details appear on the screen a user reaches in two taps. A short review at every release, with the policy owner in the room, is enough to prevent most gaps.

What does the software do, and what stays with the operator?

The software gives you the tools: reports, queues, enforcement actions, logs, roles and data controls. The operator carries the legal duties: appointing officers, publishing pages, responding to orders, deciding what the rules mean for each case and keeping the paper trail. Content rules differ from country to country, and India's are aimed at platforms hosting user content, so have a lawyer confirm which duties reach you. We provide tooling and not legal advice.

Two further points sit next to the IT Rules. Stores also ask for reporting, blocking and contact details from any app that carries user videos, as explained in how app stores review apps with user content. Age questions are separate again, see age verification for social media apps.

How should a small team phase its compliance work?

A new operator cannot do everything on day one, and does not have to. What cannot wait is the base: the pages, the grievance contact, the takedown procedure and the records. The heavier rule 4 duties can be phased in as you grow, provided you plan the trigger.

Run a drill each quarter

Once a quarter, send a test notice through the real channel, without warning the people on call. Measure the time to acknowledge, the time to locate the content and the time to disable it. Write down what slowed the team, fix one thing, and run the drill again next quarter. A drill costs a few hours and tells you more about your readiness than any checklist.

Questions to bring to your counsel

• Based on our structure and user numbers, which duties apply to us today?
• Which amendments are in force, and where do we keep the official notifications?
• Who should hold each officer role, and what are their personal obligations?
• What should our records policy say about retention, access and deletion requests?
• How should we respond to an order that we think is unclear or overbroad?

Whichever phase you are in, keep one page that lists every duty you believe applies, the person who owns it, the evidence that shows it is met and the date it was last checked. Review that page monthly with counsel in the loop. When an amendment is notified, the page tells you at once which owner has work to do, and it gives an auditor or a partner a clear answer to the question of how you manage compliance.

Which compliance items should be done before launch?

• Grievance Officer appointed, with name and contact details prominently published in the app.
• Terms, privacy policy and community rules published in each launch language.
• Procedure and rota for court orders and government notices, tested against a 3-hour clock.
• Intimate imagery complaint path tested against a 2-hour clock.
• Preservation setting of at least 180 days for removed content and records.
• Notice and appeal flow for removals.
• Decision on rule 4 readiness: officers, address, monthly report process and review of automated tools.
• Counsel briefed, with the Gazette text of the current rules and amendments on file.

The standard build takes 6 working days to go live. Support after go-live is 60 days of technical help, 12 months of updates, and bug fixes on a separate 6-month term. Ticketing, report and other compliance tooling is tailored work that usually takes 2 to 8 weeks after scope sign-off. See the Moj clone features list for the reporting and admin tools, the Moj clone development company page for how we work, the Moj clone solution page for the product, and the live demo to try the report queue. Compare pricing, then use contact to tell us which duties you expect to carry so we can settle the scope for you.