Rule 3 IT Rules 2021: Intermediary Due Diligence

Rule 3 is the working floor of intermediary law: the duties every intermediary, from an ISP to the largest platform, must observe to keep the Section 79 safe harbour. Its text has moved repeatedly, the 2022 Amendment hardened the obligations, the October 2025 amendment disciplined government intimations, and the 2026 Amendment compressed the clocks, so precision about the current position matters. Topic 67 showed where Rule 3 sits in the safe harbour scheme; this note works through the rule clause by clause as it stands, with the prohibited categories, every timeline in its current form, and the grievance route ending at the Grievance Appellate Committee.

1. The Rule in One View

Figure 1: The six movements of Rule 3

• Whom it binds. Every intermediary. The significant social media intermediaries carry Rule 4 in addition (Topic 76), never instead.
• What rides on it. Rule 7: failure to observe these Rules forfeits the s.79(1) protection, and the intermediary becomes liable for the third party content under the applicable law.

2. Publish and Inform: Rule 3(1)(a) to (c)

• Publication of rules, privacy policy and user agreement. Prominently published on the website, app or both, in English or any Eighth Schedule language of the user's choice. These documents are the contractual layer through which the prohibited categories reach users.
• The ensure-compliance standard. Since the 2022 Amendment, the intermediary must itself ensure compliance and make reasonable efforts to cause its users not to host or share the prohibited content, replacing the older duty merely to inform, and it must respect the constitutional rights of users while doing so.
• Periodic user awareness. Users must be informed of the rules, the consequences of non-compliance, including termination of access and removal of content, and, since the 2026 Amendment, the treatment of synthetic content, at least once every three months, the requirement your syllabus tracks as the current three month cycle, tightened from the earlier annual duty.

The prohibited content categories

Figure 2: The Rule 3(1)(b) categories grouped

• Content belonging to another person. Information to which the user has no right, the residual property idea behind leaked documents and stolen content.
• The sexual and privacy cluster. Obscene, pornographic and paedophilic content; content invasive of another's privacy, including bodily privacy; and content insulting or harassing on the basis of gender, the clauses that back the Rule 3(2)(b) complaint route.
• Content harmful to a child. A category wider than the s.67B offences, covering material dangerous to minors though lawful for adults.
• Property and deception. Content infringing patents, trademarks, copyright or other proprietary rights; content that deceives or misleads the addressee about the origin of the message, and information that is patently false or misleading, communicated with intent to mislead, the clause the struck-down fact check route had been attached to.
• Impersonation and malware. Content impersonating another person, and software viruses or any computer code, file or program designed to interrupt, destroy or limit the functionality of any computer resource.
• The State grounds and residual unlawfulness. Content threatening the unity, integrity, defence, security or sovereignty of India, friendly relations with foreign States, or public order, or preventing investigation of any offence, or insulting other nations; and content violating any law for the time being in force.

3. Actual Knowledge and Removal: Rule 3(1)(d)

• The two triggers. Actual knowledge in the form of a court order, or a notification, now a reasoned intimation, of the appropriate Government or its agency that the information violates any law, the Shreya Singhal architecture written into the rule (Topic 67)
• Who may intimate. Since the October 2025 amendment, in force from November 2025: only an officer not below Joint Secretary or equivalent, and for police forces an officer not below Deputy Inspector General, specially authorised, with the intimation specifying the legal basis and statutory provision, and government directions subject to periodic senior review.
• The current three hour takedown. Removal or disabling of access must follow within three hours of the order or intimation, the 2026 Amendment's compression of the original thirty-six, the tightest general takedown clock in comparative law and the platforms' chief operational complaint.
• Preservation of removed information. Information removed under the rule is preserved, with associated records, for one hundred and eighty days for investigative purposes, or longer as a court or authorised agency requires, so takedown never destroys the evidence.

4. Retention and Assistance: Rule 3(1)(h) and (j)

• Data retention after cancellation. Registration information of a user is retained for one hundred and eighty days after cancellation or withdrawal of the registration, so departure does not erase identity.
• The seventy two hour framework. On a lawful order from a Government agency authorised for investigative, protective or cyber security activity, the intermediary provides information under its control, or assistance, as expeditiously as possible and within seventy two hours, for verification of identity, or prevention, detection, investigation and prosecution of offences, the general information channel that sits beneath the specific powers of ss.69 to 69B (Topics 62, 72)
• Security practices. The intermediary takes reasonable security measures for its computer resources, following the s.43A-era discipline, and reports incidents to CERT-In (Topic 64)

5. The Grievance Mechanism: Rule 3(2)

Figure 3: The complaint's path under the current clocks

• The Grievance Officer. Named, with contact details and the complaint mechanism published; complaints are acknowledged within twenty four hours with a ticket for tracking.
• The current seven day disposal. General grievances are disposed of within seven days of receipt under the 2026 Amendment, halved and more from the original fifteen; requests for removal of content by the affected person under the specified categories continue on their own faster track.
• The imagery complaints. A complaint by or on behalf of an individual concerning content which exposes the private area of the individual, shows the individual in full or partial nudity or in a sexual act, or is in the nature of impersonation, including artificially morphed images of the individual, must be actioned by removal or disabling of access, now within two hours of receipt under the 2026 Amendment, the clock that carries the deepfake imagery cases (Topic 75)
• Right of appeal. A person aggrieved by the Grievance Officer's decision, or its absence, may appeal to a Grievance Appellate Committee within thirty days; the GAC, working through online dispute resolution, endeavours to resolve the appeal within thirty days, and the intermediary must comply with its order and publish the compliance report (Topic 73)

The clocks in one table

Figure 4: Every Rule 3 timeline: 2021 against today

6. Frequently Asked Questions

What must an intermediary do on receiving a takedown order today?

On a court order, or a reasoned intimation issued by an officer not below Joint Secretary rank (DIG for police) specifying the legal basis, the intermediary must remove or disable access to the information within three hours under the 2026 Amendment, while preserving the removed information and associated records for one hundred and eighty days for investigation. Failure forfeits the Section 79 safe harbour under Rule 7.

What are the current grievance timelines under Rule 3(2)?

Acknowledgement within twenty four hours; disposal of general grievances within seven days; and removal or disabling within two hours for complaints concerning exposure of private areas, nudity or sexual acts, or impersonation including artificially morphed images. An appeal lies to a Grievance Appellate Committee within thirty days, which endeavours to decide within thirty days.

7. Related Topics

• Topic 67: Section 79. The safe harbour these duties condition.
• Topic 76: Significant Social Media Intermediaries. The Rule 4 layer above this floor.