Rules 4 to 6 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Rule 4 of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 adds duties for a significant social media intermediary on top of rule 3; rule 5 adds a statement duty for an intermediary in relation to news and current affairs content; and rule 6 lets the Ministry require another intermediary to comply with some of the rule 4 obligations. This article explains the Rules as originally notified on 25 February 2021. Later amendments are not covered here; check the current text of the Rules before acting. The Rules implement the due diligence condition in section 79(2)(c) of the Information Technology Act, 2000; see our article on section 79.
A significant social media intermediary must, within three months from the date of notification of the threshold under rule 2(1)(v), appoint a Chief Compliance Officer, a nodal contact person and a Resident Grievance Officer, and publish a monthly compliance report (rule 4(1)). The threshold is "as notified by the Central Government"; the notification is not in the sources, so no user number is given here. Rule 6 lets the Ministry, by order and for reasons recorded in writing, require any other intermediary to comply with the rule 4 obligations.
Who is covered
A "significant social media intermediary" is defined in rule 2(1)(v) as a social media intermediary having a number of registered users in India above such threshold as notified by the Central Government. Our article on rules 1, 2 and 7 explains the definitions. The threshold figure is not in the Rules, and this article does not state one.
"Significant Data Fiduciary" in data-protection law is a different term from "significant social media intermediary" in these Rules; the two should not be mixed.
Rule 4(1): four appointments and a report
Rule 4(1) says that, in addition to the due diligence observed under rule 3, a significant social media intermediary shall, within three months from the date of notification of the threshold, observe the following additional due diligence:
| Clause | Duty | Explanation printed |
|---|---|---|
| (a) | appoint a Chief Compliance Officer, responsible for ensuring compliance with the Act and the rules made under it, who shall be liable in any proceedings relating to relevant third-party information, data or communication link where he fails to ensure that the intermediary observes due diligence | a key managerial personnel or such other senior employee who is resident in India; a proviso says no liability may be imposed on the intermediary without an opportunity of being heard |
| (b) | appoint a nodal contact person for 24x7 coordination with law enforcement agencies and officers to ensure compliance to their orders or requisitions | an employee, other than the Chief Compliance Officer, who is resident in India |
| (c) | appoint a Resident Grievance Officer, responsible, subject to clause (b), for the functions in rule 3(2) | an employee who is resident in India |
| (d) | publish a periodic compliance report every month mentioning the details of complaints received and action taken, and the number of specific communication links or parts of information removed or disabled in pursuance of proactive monitoring by automated tools or other relevant information as may be specified |
The period of three months runs from the date of notification of the threshold under clause (v) of rule 2(1). The notification itself is not in the sources used here, so this article does not compute any date.
If you run or advise a large platform, an early legal due diligence review of who holds each appointment, where that person resides and how reports are prepared is a practical step.
Rule 4(2): first originator of information (messaging services)
Rule 4(2) says a significant social media intermediary providing services primarily in the nature of messaging shall enable the identification of the first originator of the information on its computer resource as may be required by a judicial order passed by a court of competent jurisdiction, or an order passed under section 69 by the Competent Authority as per the Information Technology (Procedure and Safeguards for interception, monitoring and decryption of information) Rules, 2009, supported with a copy of such information in electronic form. Our article on section 69 explains the section. Four provisos limit the sub-rule:
- An order shall only be passed for the purposes of prevention, detection, investigation, prosecution or punishment of an offence related to the sovereignty and integrity of India, the security of the State, friendly relations with foreign States, or public order, or of incitement to such an offence, or in relation to rape, sexually explicit material or child sexual abuse material punishable with imprisonment for a term of not less than five years.
- No order shall be passed where other less intrusive means are effective in identifying the originator.
- In complying, the intermediary shall not be required to disclose the contents of any electronic message, any other information related to the first originator, or any information related to its other users.
- Where the first originator is located outside India, the first originator within the territory of India shall be deemed to be the first originator for the purpose of the clause.
Rule 4(3) to (9): other duties
| Sub-rule | Duty |
|---|---|
| (3) | An intermediary that provides a service for direct financial benefit in a manner that increases visibility or prominence or targets the receiver, or in relation to information it owns or exclusively controls, shall make that information clearly identifiable to users as being advertised, marketed, sponsored, owned or exclusively controlled |
| (4) | Shall endeavour to deploy technology-based measures, including automated tools, to proactively identify information depicting rape, child sexual abuse or conduct, whether explicit or implicit, or information identical to what was previously removed under rule 3(1)(d), and display a notice to a user attempting to access it |
| (5) | Shall have a physical contact address in India published on its website, mobile based application or both |
| (6) | Shall implement a mechanism for receipt of complaints under rule 3(2) and grievances on this rule, enabling the complainant to track status by a unique ticket number, and to the extent reasonable provide reasons for action taken or not taken |
| (7) | Shall enable users who register from India, or use the services in India, to voluntarily verify their accounts by any appropriate mechanism, including the active Indian mobile number; a verified user shall be provided with a demonstrable and visible mark of verification; information received for verification shall not be used for any other purpose unless the user expressly consents |
| (8) | Where it removes or disables access to information on its own accord under rule 3(1)(b), it must give prior notification with grounds, give an adequate and reasonable opportunity to dispute and request reinstatement, and ensure the Resident Grievance Officer oversees the dispute mechanism |
| (9) | The Ministry may call for such additional information as it may consider necessary for the purposes of Part II |
Rule 4(4) carries three provisos. The first says the measures must be proportionate having regard to the interests of freedom of speech and expression and the privacy of users, including interests protected through the appropriate use of technical measures. The second requires mechanisms for appropriate human oversight, including periodic review of automated tools. The third says the review of automated tools shall evaluate their accuracy and fairness, the propensity of bias and discrimination, and the impact on privacy and security.
Rule 5: news and current affairs content
Rule 5 says that, in addition to rules 3 and 4, as applicable, an intermediary shall publish, on an appropriate place on its website, mobile based application or both, a clear and concise statement informing publishers of news and current affairs content that, in addition to the common terms of service for all users, such publishers shall furnish the details of their user accounts on the services of the intermediary to the Ministry as may be required under rule 18. A proviso lets the intermediary provide verified publishers with a demonstrable and visible mark of verification. An Explanation says the rule relates only to news and current affairs content and shall be administered by the Ministry of Information and Broadcasting.
Rule 6: notification of other intermediary
Rule 6(1) says the Ministry may by order, for reasons to be recorded in writing, require any intermediary which is not a significant social media intermediary to comply with all or any of the obligations in rule 4, if its services permit the publication or transmission of information in a manner that may create a material risk of harm to the sovereignty and integrity of India, security of the State, friendly relations with foreign States or public order. Rule 6(2) says the assessment of material risk shall have regard to the nature of services and whether they permit (a) interaction between users, notwithstanding whether it is the primary purpose, and (b) publication or transmission to a significant number of other users as would be likely to result in widespread dissemination. Rule 6(3) allows an order in relation to a specific part of the computer resources of a website or app, if that part is in the nature of an intermediary.
Consequence of non-observance
Under rule 7, failure to observe the Rules means section 79(1) of the Act does not apply to the intermediary, and it is liable for punishment under any law in force including the Act and the Indian Penal Code. The Indian Penal Code reference is quoted as printed; check the current penal law for the corresponding provision.
A worked example
Bharat Chat Private Limited, an invented messaging service, finds that it falls within the notified threshold. Within three months of the notification it must name a Chief Compliance Officer, a nodal contact person and a Resident Grievance Officer, all resident in India, and publish its first monthly compliance report. The first originator duty in rule 4(2) applies only where an order of the kind described is received, and the provisos limit what must be disclosed. The company's records of appointments, complaints and monthly reports are its evidence of observance.
Need help with significant social media intermediary compliance?
If your platform may be, or may become, a significant social media intermediary, or has received an order under rule 6, our team can help you map the duties. See our legal due diligence service.
Key takeaways
- Rule 4(1): Chief Compliance Officer, nodal contact person, Resident Grievance Officer and a monthly compliance report, within three months from the date of notification of the threshold.
- Rule 4(2) to (9): first originator for messaging services under stated provisos, labelling, technology-based measures, a physical contact address in India, complaint tracking, voluntary verification, notice before removal, and calls for information.
- Rule 5: a statement for publishers of news and current affairs content; rule 6: Ministry order for another intermediary.
- The threshold is "as notified"; no number is given in the sources.
- This article explains the Rules as originally notified; check the current text.
Read next
- Rule 3 of the Intermediary Guidelines Rules, 2021: due diligence and grievance redressal
- Rules 8-19: Code of Ethics and the three-tier grievance structure for digital media
- Rules 1, 2 and 7: definitions, scope and non-observance
- Section 69 of the Information Technology Act, 2000: interception, monitoring and decryption directions
Disclaimer: Based on a consolidated copy of the Information Technology Act, 2000 as amended by the Information Technology (Amendment) Act, 2008, on the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 as originally notified on 25 February 2021 and on the CERT-In Directions of 28 April 2022, read with the amendments made to the Act by the Jan Vishwas (Amendment of Provisions) Act, 2023 and by section 44 of the Digital Personal Data Protection Act, 2023, as consulted on 2 October 2026. Commencement notifications, other amendments, rules, directions and the current position of each provision are not covered and should be checked. This article is general information, not legal advice; check the official text before acting.