India IT Rules

Why does it matter?

The Rules turn “reasonable security practices and procedures” into something a body corporate can document and an auditor can test. Section 43A leaves that phrase to an agreement between the parties, to other law or to what the Central Government prescribes, and Rule 8 is the prescription.

Key benefits include:

• A named security standard

Rule 8(2) names IS/ISO/IEC 27001 as one standard that meets the reasonable security requirement.

• A deemed compliance route

A body corporate that has implemented IS/ISO/IEC 27001, or codes of practice approved and notified by the Central Government, is deemed compliant if the standard or codes are certified or audited regularly by an independent auditor approved by the Central Government (Rule 8(4)).

• Written consent tied to purpose

Consent in writing about the purpose of use is required before collection, and the information may be used only for that purpose (Rule 5(1) and (5)).

• A grievance clock

A Grievance Officer's name and contact details are published on the website, and grievances are redressed within one month (Rule 5(9)).

• Disclosure and transfer limits

Disclosure to a third party needs the provider's prior permission unless the contract allows it or a legal obligation requires it (Rule 6(1)), and transfers go only to recipients that ensure the same level of protection (Rule 7).

How does it work?

Before collecting sensitive personal data or information, the body corporate obtains written consent on the purpose of use, collects only for a lawful purpose connected with its function that the collection is necessary for, and takes reasonable steps to make the person aware of the fact and purpose of collection, the intended recipients, and the name and address of the collecting and retaining agencies (Rule 5(1) to (3)). It may not retain the information longer than required for the lawful purpose or by other law (Rule 5(4)). Providers can review and correct their information, decline to provide it and withdraw consent in writing, after which the body corporate may decline to provide the service (Rule 5(6) and (7)).

The privacy policy must be published on the website and give clear statements of practices and policies, the types of data collected under Rule 3, the purpose of collection and use, disclosure under Rule 6 and the security practices under Rule 8 (Rule 4). Disclosure to government agencies mandated by law needs a written request stating the purpose, and sensitive personal data or information must not be published (Rule 6(1) to (3)). A third party that receives the data may not disclose it further (Rule 6(4)).

Under Rule 8(1), a body corporate meets the reasonable security standard if it has implemented security practices and standards and a comprehensive documented information security program and policies with managerial, technical, operational and physical controls commensurate with the information assets and the nature of business. After a breach it must show the agency mandated by law that it implemented those controls. The audit of reasonable security practices is carried out at least once a year or after significant upgrades to its process and computer resources (Rule 8(4)).

Key Elements

• Sensitive personal data or information (Rule 3)

Eight categories, from passwords and financial information to biometric information, excluding public domain information and information furnished under the Right to Information Act.

• Privacy policy (Rule 4)

A published policy covering practices, data types, purpose, disclosure and security practices.

• Collection and consent (Rule 5)

Written consent, lawful and necessary collection, notice of recipients and agencies, retention limit, review, correction, withdrawal and the Grievance Officer.

• Disclosure (Rule 6)

Prior permission unless the contract or a legal obligation provides otherwise, written government agency requests, no publication and no onward disclosure.

• Transfer (Rule 7)

Transfers inside or outside India only to recipients with the same level of data protection and only where necessary for the contract or with consent.

• Reasonable security practices (Rule 8(1))

A documented program and policies with managerial, technical, operational and physical controls, demonstrable after a breach.

• Standards and audit (Rule 8(2) to (4))

IS/ISO/IEC 27001, approved industry codes, deemed compliance with independent audit at least once a year.

What does it cover?

The Rules bind a body corporate and any person acting on its behalf, covering the information of the providers who give it (Rules 4 and 5). Sensitive personal data or information is limited to the Rule 3 categories, and Rule 7 allows transfers to recipients in India or in any other country on stated conditions. The Rules contain eight rules and no penalty clause: consequences arise under the Information Technology Act, 2000, not under the Rules themselves.

What are its objectives?

The Rules contain no preamble. Their provisions pursue these outcomes:

Providers know what is collected, why, by whom and who receives it (Rules 4 and 5(3)).

Sensitive data is collected with written consent and kept no longer than the purpose requires (Rule 5).

Disclosure and onward transfer are controlled (Rules 6 and 7).

Security controls are documented, proportionate to the assets and demonstrable after a breach (Rule 8(1)).

Complaints reach a named Grievance Officer and are answered within one month (Rule 5(9)).

Framework in Context

Section 43A of the Information Technology Act, 2000 makes a body corporate that is negligent in implementing and maintaining reasonable security practices and procedures for sensitive personal data in a computer resource it owns, controls or operates liable to pay compensation to a person who suffers wrongful loss or gain. These Rules supply the definitions of sensitive personal data and of reasonable security practices that section 43A calls for. The Digital Personal Data Protection Act, 2023 omits section 43A in its Section 44(2)(a), with effect eighteen months after publication of G.S.R. 843(E). The Digital Personal Data Protection Rules, 2025 do not mention the 2011 Rules.

Common Framework Mappings

The Rules name only IS/ISO/IEC 27001 (Rule 8(2)), so ISO/IEC 27001 and its control guidance in ISO/IEC 27002 are the direct mapping for Rule 8. The other frameworks below help with consent, policy, disclosure and transfer duties. The mappings are control-level aids, not equivalences.

Mapped frameworks include:

GDPR (General Data Protection Regulation)

ISO/IEC 27001

ISO/IEC 27002

ISO/IEC 27018

ISO/IEC 27701

NIST Privacy Framework

NIST SP 800-53

SOC 2