Navigating India's Digital Maze: DPDPA and IT Rules for Intermediaries

India’s digital regulatory landscape, already complex, has matured significantly with the full operationalisation of the Digital Personal Data Protection Act, 2023 (DPDPA). For intermediaries – the backbone of our digital economy – this means navigating a dual compliance regime where the DPDPA now intersects profoundly with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (IT Rules 2021). As of October 2026, understanding this interplay is not just good practice, but a critical imperative for avoiding legal pitfalls and fostering user trust.

Overlapping Mandates: Who is a Fiduciary, Who is an Intermediary?

At first glance, the IT Rules and DPDPA appear to govern different aspects: the former focuses on content moderation, due diligence, and user grievance redressal, while the latter centres on the protection of personal data. However, for most digital platforms, these roles converge. Under the IT Act, 2000, and Rule 2(1)(w) of the IT Rules 2021, an ‘intermediary’ facilitates communication or storage of information. Crucially, almost all intermediaries, by virtue of collecting and processing user data (even if just for service delivery or analytics), will qualify as ‘Data Fiduciaries’ under Section 2(j) of the DPDPA, as they determine the purpose and means of processing personal data.

This dual classification immediately creates overlapping obligations. For instance, Rule 3(1) of the IT Rules mandates intermediaries to publish a privacy policy. The DPDPA elevates this requirement significantly, demanding transparency in data processing notices and ensuring clear, affirmative consent for specific purposes (Section 6). Furthermore, many large intermediaries will likely be designated ‘Significant Data Fiduciaries’ (SDFs) under Section 10 of the DPDPA, triggering enhanced obligations like mandatory Data Protection Impact Assessments (DPIAs) and the appointment of an independent Data Auditor and a Data Protection Officer (DPO). This adds a substantial layer of data protection accountability beyond the IT Rules’ existing due diligence framework.

Data Protection vs. Content Moderation: A Delicate Balance

The core tension often arises where an intermediary’s obligations under the IT Rules necessitate processing user data in ways that could potentially challenge DPDPA principles. Consider the ‘traceability’ requirement for Significant Social Media Intermediaries (SSMIs) under Rule 4(2) of the IT Rules, which aims to identify the first originator of unlawful messages. This mandate to retain and potentially disclose user data must be carefully reconciled with DPDPA principles such as purpose limitation (Section 7), data minimisation, and storage limitation (Section 11). While compliance with a legal obligation is a ‘legitimate use’ under Section 7(d) of the DPDPA, the scope and proportionality of data retained for traceability must still adhere to the spirit of data protection.

Similarly, an intermediary’s efforts to identify and remove unlawful content under Rule 3(1)(j) of the IT Rules involve processing user data. This processing must be lawful, fair, and transparent (Section 6 of DPDPA), and proportionate to the purpose. Data Principals also have rights under the DPDPA (Sections 13-17), including the right to correction and erasure, which must be considered when their data is involved in content moderation processes. The Data Protection Board, established under Section 21 of DPDPA, now serves as an additional avenue for data principals to seek redress for data protection grievances, complementing the grievance redressal mechanisms mandated by IT Rules 3(2) and 4(3).

Integrated Compliance for Enhanced Accountability

For intermediaries operating in regulated sectors like finance (RBI norms), securities (SEBI), or insurance (IRDAI), the DPDPA acts as a horizontal framework, applying in addition to specific sectoral regulations. Section 4(2) of the DPDPA clarifies that if any other law provides a higher standard of data protection, that law will prevail. This means a payment aggregator, for instance, must not only comply with RBI’s data localisation and security norms but also with DPDPA’s broader principles of consent, data principal rights, and accountability.

The enhanced obligations for SDFs under DPDPA (DPIAs, Data Auditors, DPO) and for SSMIs under IT Rules (Chief Compliance Officer, Nodal Contact Person, Resident Grievance Officer) highlight a need for integrated compliance strategies. While the roles are distinct, their functions demand close collaboration. A DPIA conducted by an SDF, for example, should ideally assess not just general data processing risks but also the privacy implications of content moderation and traceability mechanisms mandated by the IT Rules.

Practical Takeaway

For Indian businesses, General Counsels, and Data Protection Officers, the current regulatory environment demands a holistic approach. Do not view DPDPA and IT Rules compliance as separate tasks. Instead, map your data flows comprehensively, identifying how personal data is collected, processed, and stored to meet both sets of obligations. Implement a unified compliance framework that integrates DPDPA’s consent management, data minimisation, security safeguards (Section 12), and Data Principal rights with the IT Rules’ content moderation, grievance redressal, and due diligence requirements. Empower your DPO to collaborate closely with IT Rules compliance officers. Regularly conduct joint DPIAs that assess risks from both data protection and content moderation perspectives. Finally, update your privacy policies and user agreements to clearly articulate how you handle personal data in light of both the DPDPA and IT Rules, ensuring transparency and building trust with your users. The era of siloed compliance is over; integrated accountability is the new standard.