India: technology regulation at a glance

Framework: Patchwork regime: Finance Act 2022 (tax treatment of Virtual Digital Assets), Prevention of Money Laundering Act, 2002 with the 7 March 2023 Ministry of Finance notification bringing VDA service providers under PMLA as reporting entities, and FIU-IND AML/CFT Guidelines (updated 8 January 2026). No comprehensive crypto-specific law is yet in force; a discussion paper is repeatedly delayed and RBI, SEBI and the Ministry of Finance are still debating a multi-regulator framework.

Buying, holding and trading crypto ('Virtual Digital Assets') is legal for Indian residents on FIU-registered platforms, but there is no dedicated crypto law: oversight is patched together from PMLA-based AML rules, the Finance Act 2022 tax regime (30% + 1% TDS), and a 2020 Supreme Court decision (IAMAI v. RBI) that lifted the RBI's 2018 banking restriction. The RBI remains institutionally hostile to private crypto and continues to push for prohibition, while SEBI has floated a multi-regulator model; a long-promised policy discussion paper has been delayed into 2026.

Framework: India AI Governance Guidelines (MeitY, Nov 2025) under the IndiaAI Mission — principle-based ("Seven Sutras"), complemented by the IT Act 2000, IT Rules 2021 (amended 2026 for synthetic media), MeitY advisories, and the Digital Personal Data Protection Act 2023

India has no standalone, comprehensive AI law. It regulates AI through a principle-based, techno-legal approach anchored by the voluntary India AI Governance Guidelines released by MeitY in November 2025, layered on top of existing statutes (IT Act, DPDPA 2023) and sectoral advisories. In February 2026 MeitY notified IT Rules amendments imposing labelling, provenance-metadata and takedown duties on 'synthetically generated information' (deepfakes); a dedicated AI statute is under discussion but not yet introduced.

Framework: Digital Personal Data Protection Act, 2023 (DPDP Act) with implementing Digital Personal Data Protection Rules, 2025 (notified 13–14 November 2025); administered by the Ministry of Electronics and Information Technology (MeitY) and enforced by the Data Protection Board of India (DPB).

India has a comprehensive, cross-sectoral data protection law in force: the DPDP Act 2023, whose implementing Rules were notified on 13–14 November 2025, triggering a phased rollout. Some provisions (Data Protection Board, definitions) took effect immediately on notification; consent-manager and select operational duties become effective 13 November 2026; the bulk of substantive obligations (data-fiduciary duties, data-principal rights, breach notification, penalties) become fully enforceable on 13 May 2027. The regime replaces the earlier narrower Section 43A / SPDI Rules 2011 framework under the IT Act 2000 and establishes a central digital regulator (the DPB) with power to impose monetary penalties up to ₹250 crore per breach.

Framework: Payment and Settlement Systems Act, 2007 (PSS Act), administered by the Reserve Bank of India (RBI); supplemented by RBI Master Directions on Authorisation of Payment Systems, Prepaid Payment Instruments (PPIs), Payment Aggregators, Account Aggregators (NBFC-AA), and Digital Lending. Retail rails are operated by the National Payments Corporation of India (NPCI).

India operates a mature, comprehensive licensing regime for digital payments and fintech, anchored in the PSS Act, 2007 and enforced by the RBI. Distinct authorisation tracks exist for Payment System Operators (PSOs), non-bank PPI issuers, Payment Aggregators (Online, Cross-Border, and Physical), NBFC-Account Aggregators (India's open-banking layer), and digital lenders, with UPI as the flagship state-run instant-payment rail. Recent 2025–2026 updates consolidated the frameworks and moved to perpetual, on-tap authorisations while tightening rules on BNPL, default loss guarantees and cross-border flows.

Framework: Passport (Entry into India) Act 1920 and Foreigners Act 1946, administered by the Ministry of Home Affairs (MHA) and Bureau of Immigration; visa categories governed by MHA visa manual (Employment, Business, e-Tourist, e-Business) with FRRO registration

India does not offer a dedicated digital nomad or remote-work visa as of 2026, and none of its existing categories cleanly authorize a foreigner living in India while working for a foreign employer. The Employment Visa requires an Indian employer and a minimum salary of ~USD 25,000/year; the Business Visa covers meetings and commerce but not salaried remote work; the e-Tourist Visa prohibits any work. Goa has publicly lobbied MHA for a nomad-visa category and Sikkim inaugurated a 'Digital Nomad Village' (Yakten) in July 2025, but these are state-level infrastructure initiatives — no central visa has been enacted.

Framework: Information Technology Act, 2000 (Sections 69A blocking, 79 intermediary safe harbour) + IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (amended through 2025 and 2026), administered by the Ministry of Electronics and Information Technology (MeitY) and the Ministry of Home Affairs' Sahyog portal; Digital Personal Data Protection Act, 2023 covers child data; the proposed Digital India Act to replace the IT Act remains not enacted.

India regulates online content through the IT Act 2000 and the IT Rules 2021, which impose safe-harbour, grievance and due-diligence obligations on intermediaries and a three-tier code for digital news/OTT publishers. In practice the regime has tilted heavily toward state-directed content restriction: MeitY issued around 24,300 blocking orders in 2025 (nearly double 2024), the Home Ministry's Sahyog portal enables bulk takedown requests, and 2025-2026 amendments have compressed takedown timelines and formalised officer-issued removal notices. A more comprehensive Digital India Act (modelled partly on the EU DSA / UK OSA) has been under consultation since 2023 but has not been introduced as legislation.

Framework: Information Technology Act, 2000 (esp. ss. 70/70A/70B) with CERT-In and NCIIPC; CERT-In Directions of 28 April 2022; sector regulators (RBI, SEBI, IRDAI). No single NIS2-style comprehensive cybersecurity statute is in force; the National Cyber Security Strategy remains unfinalized.

India has no single dedicated comprehensive cybersecurity law. Obligations rest on a patchwork: the IT Act 2000 (which created CERT-In and the NCIIPC and underpins critical-infrastructure protection), CERT-In's binding 2022 incident-reporting directions applying horizontally to all entities, sector-specific regimes from RBI, SEBI and IRDAI, and breach-notification duties under the newly notified DPDP framework. The proposed National Cyber Security Strategy has not been finalized, so the regime is best characterized as sectoral/patchwork rather than a unified comprehensive law.

Framework: Companies Act, 2013 (Ministry of Corporate Affairs — SPICe+ web form on MCA V3 portal) for incorporation; Foreign Exchange Management Act, 1999 with Consolidated FDI Policy (DPIIT) and FEMA (Non-Debt Instruments) Rules for foreign investment; Press Note 3 (2020) as amended by Press Note 2 of 2026 for land-border countries.

India permits 100% foreign ownership on the automatic route in most sectors and offers a fully digital single-window incorporation via SPICe+ that bundles ten services (name, DIN, PAN, TAN, GSTIN, EPFO, ESIC, bank account) with typical grant of the Certificate of Incorporation in 7–10 working days. However, foreigners must navigate real frictions: a mandatory Indian-resident director (≥182 days), sectoral caps and prohibited sectors, FEMA reporting, and prior government approval for investors from countries sharing a land border with India (partly relaxed in March 2026 for ≤10% non-controlling stakes). Overall setup is workable but multi-agency.