Navigating India's Dual Privacy Mandate: DPDPA and IT Rules for Intermediaries

The Indian digital ecosystem, as of October 2026, operates under a fascinating and complex regulatory landscape, particularly for intermediaries. With the Digital Personal Data Protection Act, 2023 (DPDPA) and its subsequent DPDP Rules 2025 now fully operational, intermediaries find themselves balancing the comprehensive data protection obligations of the DPDPA with the existing due diligence and content moderation requirements of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (IT Rules 2021). This dual mandate demands a nuanced understanding and integrated compliance strategy.

The Dual Mandate: DPDPA and IT Rules for Intermediaries

Intermediaries, ranging from social media platforms to e-commerce sites and cloud service providers, play a pivotal role in the digital economy. Historically, their compliance framework was largely dictated by the IT Act, 2000, and more recently, the IT Rules 2021, which focused heavily on content moderation, user grievances, and platform accountability. The DPDPA introduces a paradigm shift, placing personal data at the centre and imposing stringent obligations on entities handling such data, irrespective of their intermediary status. The challenge for Indian intermediaries is to reconcile these two distinct, yet often overlapping, regulatory frameworks.

DPDPA’s Data-Centric Framework: A New Paradigm

The DPDPA establishes a rights-based framework for Data Principals and obligations for Data Fiduciaries. Many intermediaries, by virtue of determining the purpose and means of processing personal data, will qualify as Data Fiduciaries, or at least Data Processors acting on behalf of Fiduciaries. Key DPDPA provisions directly impacting intermediaries include:

• Consent and Purpose Limitation: Data Fiduciaries must obtain clear and specific consent from Data Principals for processing their personal data (Section 6), ensuring it is used only for the purpose for which it was collected (Section 5). This directly impacts how intermediaries collect user data for various services, advertising, or platform improvements.
• Data Principal Rights: The DPDPA empowers individuals with rights such as access to information (Section 11), correction and erasure (Section 12), and grievance redressal (Section 13). Intermediaries must build robust mechanisms to facilitate these rights.
• Security Safeguards: Data Fiduciaries are mandated to implement reasonable security safeguards to prevent personal data breaches (Section 8(5)). The DPDP Rules 2025 are expected to elaborate on the nature of these safeguards, likely setting a higher bar than previous general requirements.
• Significant Data Fiduciary (SDF) Obligations: Many large intermediaries, especially those handling vast volumes of personal data or operating in sensitive sectors, will likely be designated as SDFs (Section 10). This designation brings additional responsibilities, including appointing a Data Protection Officer, conducting Data Protection Impact Assessments (DPIAs), and undergoing periodic audits.

IT Rules 2021: Content, Conduct, and Compliance

In parallel, the IT Rules 2021 continue to govern intermediary due diligence and content-related responsibilities. These rules primarily focus on:

• Due Diligence: Intermediaries must publish user agreements, privacy policies, and rules and regulations (Rule 3(1)(a)), and inform users about prohibited content (Rule 3(1)(b)).
• Grievance Redressal: A robust grievance redressal mechanism, including the appointment of a Grievance Officer, is mandatory (Rule 3(2)).
• Content Moderation: Intermediaries are required to remove or disable access to prohibited content within specified timelines upon receiving knowledge (Rule 3(1)(d)).
• Significant Social Media Intermediaries (SSMIs): SSMIs face enhanced obligations, such as appointing a Chief Compliance Officer, Nodal Contact Person, and Resident Grievance Officer (Rule 4(1)), and enabling traceability of the originator of information in specific circumstances (Rule 4(2)).

Navigating the Overlap: Synergy and Strain

The interplay between DPDPA and IT Rules 2021 presents both synergistic opportunities and potential areas of strain for intermediaries.

• Synergy in Grievance Mechanisms: The DPDPA’s requirement for Data Principal grievance redressal (Section 13) can largely be integrated with the existing Grievance Officer framework under IT Rules 2021 (Rule 3(2)). A unified system can efficiently handle both data-related and content-related complaints.
• Enhanced Security Standards: The DPDPA’s emphasis on “reasonable security safeguards” (Section 8(5)) will likely elevate the baseline for data protection across the board. While IT Rules 2021 also mention security (Rule 3(1)(g)), the DPDPA provides a more granular, data-centric approach, potentially informed by global best practices like those seen in GDPR.
• Transparency and Notice: Both frameworks advocate for transparency. The DPDPA mandates clear notice for consent (Section 6), while IT Rules 2021 require intermediaries to inform users about their policies (Rule 3(1)(a)). Aligning these ensures users have a comprehensive understanding of how their data is handled and what content rules apply.
• Potential Strain: Traceability vs. Data Minimisation: A key area of tension arises with the IT Rules’ traceability requirement for SSMIs (Rule 4(2)). This obligation, to identify the first originator of a message, could potentially conflict with DPDPA’s principles of purpose limitation (Section 5) and data minimisation. Collecting and retaining data for traceability purposes might be seen as exceeding what is “necessary” for a given service, requiring careful legal interpretation and potential guidance from the Data Protection Board of India (DPBI) and MeitY.
• SDF and SSMI Overlap: Many SSMIs will invariably qualify as SDFs. This means they must comply with both the enhanced IT Rules obligations (e.g., specific personnel appointments) and the DPDPA’s SDF requirements (e.g., DPIAs, independent audits). This necessitates a consolidated compliance strategy to avoid duplication and ensure comprehensive coverage.

Practical Takeaway

For Indian businesses operating as intermediaries, the current regulatory environment demands a holistic and integrated approach to compliance. General Counsels and Data Protection Officers should conduct a thorough audit of their data processing activities, aligning them with DPDPA’s consent, purpose limitation, and security mandates. Simultaneously, existing IT Rules 2021 compliance frameworks, particularly for grievance redressal and content moderation, must be reviewed and potentially expanded to encompass DPDPA’s Data Principal rights. Crucially, intermediaries should anticipate and proactively address potential conflicts, such as the tension between traceability and data minimisation, by seeking clarity from regulators and documenting their legal basis for data processing. Investing in robust privacy-by-design principles and comprehensive training for personnel will be key to navigating this evolving landscape successfully.