Home > Resources > Cyber Offences & Digital Safety FAQs > Defamation, Privacy & Cyber Offences
Defamation, Privacy & Cyber Offences FAQs
These FAQs cover defamation, reviews and public allegations, privacy and leaked communications, doxxing and personal data, selected cyber offences, deepfakes, platform-removal routes, electronic evidence and complaint procedure in India.
Important scope note. Online publication disputes can engage several legal regimes at the same time. The exact words or content, evidence, privacy interests, statutory offence ingredients, platform rules, limitation and procedural route should be checked before publication, complaint or takedown action. A platform report, criminal complaint or request for urgent relief does not guarantee removal, prosecution, injunction or any particular outcome.
A. Criminal and Civil Defamation Fundamentals
Criminal defamation is governed by Section 356 of the Bharatiya Nyaya Sanhita, 2023. Civil defamation is a separate tort-based remedy for injury to reputation. The legal tests, procedure, limitation, defences and remedies are not identical. A publication should therefore be assessed separately for criminal exposure, civil liability and any overlapping commercial-disparagement or privacy issues.
There must generally be an imputation concerning a person, made or published in a manner covered by the section, with intent to harm reputation or knowledge or reason to believe that the imputation will harm reputation. Section 356 also contains explanations and statutory exceptions. The analysis must address the actual words, image or representation, the person concerned, the audience, mental element and any applicable exception.
Yes. Section 356 expressly states that an imputation concerning a company, association or collection of persons as such may amount to defamation. A company can also have protectable commercial reputation for civil-law purposes. Whether a particular group is sufficiently identifiable and whether the statement actually harms reputation remain fact-specific.
Yes. Section 356 expressly recognises that an imputation may be defamatory even when expressed in the alternative or ironically. A disclaimer such as “just joking” does not necessarily neutralise a factual insinuation that a reasonable audience would understand as damaging. Text, image, caption, thumbnail, emoji and context should be assessed together.
Not by itself. The first statutory exception to Section 356 requires both truth and public good, and whether publication is for the public good is a question of fact. A publisher should therefore distinguish “I believe this is true” from “I can prove this and justify publication in the public interest”.
Truth or justification can be a substantive defence in civil defamation, but the exact pleaded statement, meaning, proof, context and cause of action still matter. Publication of true material can also raise independent privacy, confidentiality or data issues. Truth should therefore not be treated as a universal permission to disclose damaging private material.
No. Genuine opinion, criticism or evaluative comment can differ from an assertion of verifiable fact, and Section 356 contains good-faith exceptions for specified forms of opinion. But a statement framed as opinion can still imply an undisclosed or false factual basis. A safer publication distinguishes verified fact, allegation, inference and opinion.
Parody, satire and exaggeration may be less likely to be understood as literal factual assertions, but the label does not immunise fabricated accusations, unverified allegations of crime, manipulated evidence or misleading captions. Ask what a reasonable viewer would understand and whether any implied factual allegation can be supported.
B. Reviews, Public Allegations and Defamation Procedure
Those labels can convey assertions of criminal or dishonest conduct. Where there is only a complaint, investigation or allegation, describe the procedural status accurately and avoid converting it into a finding of guilt. Preserve the underlying records and distinguish allegations, charges, findings and convictions.
Use primary records where available, verify source reliability, preserve full context, distinguish allegation from established fact, seek a meaningful response where appropriate, fairly represent the response, avoid selective editing and review the title, thumbnail, captions, spoken content and promotional posts together. Sensational packaging can create a defamatory meaning even where the long-form content is more qualified.
Section 356 contains a specific exception for substantially true reports of court proceedings or the result of such proceedings. The protection should not be overstated: a publisher must report the proceeding substantially truthfully and should not add unsupported allegations outside the record.
No. Ordinary defamation punishable under Section 356(2) of the Bharatiya Nyaya Sanhita, 2023 is classified as non-cognizable and bailable. The punishment may include simple imprisonment up to two years, fine, both, or community service. Section 222 of the Bharatiya Nagarik Suraksha Sanhita, 2023 also contains a special complaint route for specified public-function cases, so the precise complaint category and forum should still be identified.
Section 222 BNSS generally requires a complaint by a person aggrieved by the alleged offence under Section 356 BNS. It also creates a special route for certain allegations concerning specified constitutional or public office-holders in respect of conduct in public functions, where a Public Prosecutor may complain to the Court of Session with the sanction required by the section. An ordinary observer should not assume that they can prosecute merely because they saw the publication.
Yes. Articles 75 and 76 of the Limitation Act, 1963 prescribe one year for suits seeking compensation for libel and slander: for libel, from publication; for slander, from the speaking of the words or, where the words are not actionable in themselves, when the special damage results. Questions about a later republication, a different cause of action or non-damages relief require separate analysis, so continuing online accessibility should not be assumed to restart limitation automatically.
C. Privacy, Leaks, Doxxing and Personal Data
Yes. Privacy is recognised as a constitutionally protected right connected with personal liberty and dignity. That does not create an absolute prohibition on publication, but it requires balancing privacy with legitimate speech, public-interest and other legal considerations. The lawfulness of disclosure depends on the information, source, purpose, public record status, consent, necessity and context.
No. Authenticity does not itself establish a right to publish. Private correspondence may raise privacy, breach-of-confidence, contractual, data-protection, copyright and defamation issues. A publisher should examine source, consent, public-interest justification, necessity, redaction and potential harm before disclosure.
Not automatically. The legality and later use of a recording depend on how it was obtained, the relationship between the parties, privacy and confidentiality expectations, the purpose of publication, the contents and any applicable statutory restrictions. Possession of the audio file is not the same as a general licence to broadcast it.
No. Copyright and privacy are separate legal interests. A person can hold copyright or possess a file while still lacking a lawful basis to expose another person’s private correspondence, intimate image, identity document, location, medical information or confidential material.
Doxxing commonly refers to publishing identifying or contact information such as a home address, telephone number, workplace details, identity documents, family information or location data in a manner that can expose a person to harassment or harm. India does not rely on one single offence called “doxxing”; the applicable law depends on what was obtained, disclosed, threatened or done with the information.
Public interest is not a blanket permission to disclose every identifying detail. Even where reporting on misconduct is justified, addresses, phone numbers, identity numbers, children’s information, medical details and unrelated family data should ordinarily be redacted unless their disclosure is genuinely necessary to the public-interest purpose.
The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 are commencing in phases. Under the 13 November 2025 commencement notification, several institutional and preliminary provisions are already in force, while most core processing provisions in Sections 3 to 17 are scheduled to commence eighteen months after that notification, on 13 May 2027. Most corresponding operational Rules are phased similarly. The current legal position must therefore be checked provision by provision rather than treating the entire Act as already operational.
No. The phased commencement of the DPDP framework does not create a legal vacuum. Constitutional privacy, confidentiality and contract, provisions of the Information Technology Act and rules that remain in force, current intermediary duties, sector-specific obligations and other civil or criminal law can still be relevant. The applicable basis depends on who is handling the information, what information is involved and what is being done with it.
Apply a necessity-and-redaction test. Publish only what is reasonably necessary to establish the issue, mask unrelated identifiers, protect children and uninvolved third parties, avoid unnecessary medical or financial detail and preserve the unredacted evidence separately. Public-facing evidence should not become a new source of harm.
That can create serious privacy, confidentiality, intimidation, defamation and proportionality risks. A complaint or notice should normally be directed to persons with a legitimate role in resolving the dispute, not circulated broadly to unrelated employers, family members, customers or social contacts.
D. Cyber Offences, Impersonation, Intimate Content and Deepfakes
No. Section 66A is omitted and should not be invoked as a current offence for online speech. Complaints involving threats, impersonation, obscenity, privacy violations, stalking, cheating or other conduct must be analysed under the provisions that actually remain in force.
Section 66C addresses identity theft involving fraudulent or dishonest use of another person’s electronic signature, password or other unique identification feature. It is not a generic provision for every fake profile. The actual identifier used and the dishonest or fraudulent conduct should be identified.
Section 66D punishes cheating by personation using a communication device or computer resource. It can be relevant where a person impersonates someone online to deceive another person, particularly where the conduct amounts to cheating. Mere parody or a clearly non-deceptive fan account should not automatically be described as Section 66D cheating.
Section 66E is a specific bodily-privacy offence. It applies to intentional or knowing capture, publication or transmission of the image of a person’s “private area” without consent under circumstances violating that person’s privacy. It should not be misdescribed as a general criminal provision covering every disclosure of personal data.
Depending on the material and conduct, Section 66E and Sections 67 or 67A of the Information Technology Act, 2000, Section 77 BNS on voyeurism and other provisions may apply. If a child is involved, Section 67B of the IT Act and child-protection law can create additional and serious consequences. The correct provision depends on matters such as the image, consent, age, manner of capture, transmission or publication, and the role of the person concerned.
No. Consent to capture and consent to dissemination are distinct. Explanation 2 to Section 77 BNS expressly provides that where the victim consents to capture of the images or the act but not to dissemination to third persons, dissemination is treated as an offence under that section. Other IT Act, privacy and platform rules may also be relevant depending on the material and conduct.
Section 78 BNS includes, in the circumstances specified by the section, a man monitoring a woman’s use of the internet, e-mail or another form of electronic communication. It also covers repeated following or attempts at personal interaction despite a clear indication of disinterest, subject to the statutory exceptions. Preserve the chronology of accounts, messages, blocks, new accounts and any clear indication of disinterest.
A realistic synthetic sexual image, video or voice can engage several legal regimes at once, depending on its content and use, including privacy, impersonation, obscenity or sexually explicit-content provisions, defamation and platform duties. The 2026 amendments to the IT Rules expressly create a due-diligence framework for synthetically generated audio, visual and audio-visual information, including unlawful synthetic content. Artificial creation does not by itself make the content lawful or harmless.
The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, effective from 20 February 2026, introduced a specific framework for synthetically generated information, or SGI. Among other changes, the Rules define covered synthetic audio, visual and audio-visual information, add due-diligence requirements for intermediaries that enable or disseminate SGI, require specified labelling or provenance measures for covered permissible SGI, and impose additional declaration and verification duties on significant social-media intermediaries. The exact duty depends on the intermediary and the content.
Potentially, but the offence must be matched to its ingredients. A deceptive synthetic identity can raise privacy, defamation, false-record, platform-rule or other issues even without a financial loss. Section 66D of the IT Act specifically requires cheating by personation through a communication device or computer resource, so it should not be invoked merely because a voice or face was imitated when the cheating element is absent.
Preserve the messages, account identifiers, transaction references and beneficiary details; contact the bank, payment provider or other financial intermediary promptly; and report the incident through the National Cyber Crime Reporting Portal. The national helpline 1930 is used for prompt reporting of online financial fraud. Early reporting can matter when an attempt is being made to trace or stop movement of funds.
E. Platform Complaints, Intermediaries and Online Removal
No. A platform may remove content under its terms or grievance process, but a private complaint is not itself a court order and does not finally determine defamation. The complaint should identify the exact URL or content, legal or policy basis, supporting evidence and the specific relief requested.
Under Rule 3(2)(a)(i) of the IT Rules as amended in 2026, the intermediary’s Grievance Officer is to acknowledge a complaint within twenty-four hours and ordinarily resolve it within seven days from receipt. The same Rule contains shorter timelines for specified classes of removal or disabling-access complaints, so the seven-day period should not be applied mechanically to every grievance.
The proviso to Rule 3(2)(a)(i), as amended in 2026, requires certain grievances requesting removal of or disabling access to information connected with Rule 3(1)(b), subject to the exclusions stated there, to be acted upon expeditiously and resolved within thirty-six hours. That is a category-specific timeline, not a universal thirty-six-hour deadline for every platform complaint.
Under amended Rule 3(2)(b), an intermediary must, within two hours of receiving a qualifying complaint, take reasonable and practicable measures to remove or disable access to specified content that prima facie exposes an individual’s private area, depicts full or partial nudity or a sexual act, or is electronic impersonation including artificially morphed images. The complaint should identify the content or communication link sufficiently for the intermediary to act.
Yes. Rule 3A provides the Grievance Appellate Committee route. A person aggrieved by the Grievance Officer’s decision, or whose grievance remains unresolved within the applicable period, may prefer an appeal within thirty days from receipt of the decision or expiry of that period, as applicable. This administrative appeal is distinct from any independent court or statutory remedy that may otherwise exist.
Rule 3(1)(d), as amended in 2026, deals separately with actual knowledge received through an order of a court of competent jurisdiction or a reasoned intimation from an authorised officer of the Appropriate Government or its authorised agency in the prescribed manner. For information covered by that rule, the amended compliance timeline is three hours from receipt of the order or valid intimation. This three-hour actual-knowledge route should not be confused with the seven-day, thirty-six-hour or two-hour user-grievance timelines.
No. Section 79 provides conditional protection for qualifying intermediary activity when its statutory conditions and applicable due-diligence obligations are satisfied. The protection can be affected by matters such as the intermediary’s role in the unlawful act and failure to comply with a legally valid actual-knowledge requirement. It is a safe-harbour framework, not blanket immunity for every platform activity or every type of claim.
Potentially, where the legal test and procedural basis are established. Courts can direct disclosure of subscriber or identifying information in appropriate proceedings, subject to necessity, proportionality and applicable law. A private complainant should not assume that a platform will disclose another user’s identity merely on request.
Potentially, but pre-trial restraints on publication require particular caution because they affect freedom of speech and the public’s right to know. The Supreme Court in Bloomberg Television Production Services India Pvt. Ltd. v. Zee Entertainment Enterprises Ltd. emphasised that ex parte pre-trial injunctions against publication should not be granted casually and are exceptional. The ordinary interim-relief tests, the alleged falsity or malice, urgency and the competing speech and reputation interests must be assessed on the actual record.
Appropriate online relief can be granted where the legal basis and evidence justify it, but removal, de-indexing and blocking are distinct remedies with different procedural foundations. Section 69A blocking, an intermediary takedown, a search-result de-indexing direction and a civil injunction should not be treated as interchangeable.
F. Electronic Evidence and Complaint Procedure
Preserve original messages, emails, files and exports where available; full URLs; usernames and account identifiers; capture date, time and time zone; complete conversation context; screen recordings for dynamic content; file metadata; transaction details; and a dated evidence log. Avoid altering the original files or relying only on cropped screenshots.
The Bharatiya Sakshya Adhiniyam, 2023 contains specific rules for electronic and digital records, including Section 63. Where a computer output is tendered under that framework, the statutory certificate and Schedule particulars must be addressed; the Schedule records source/device particulars and hash information and contains separate Part A and Part B components. The exact certification, source, custody and authenticity proof should be matched to the record and the manner in which it is produced.
Sometimes they may be useful, but they are not invariably sufficient. Screenshots can omit metadata, URLs, timestamps, surrounding conversation or proof linking an account to a person. Where the dispute is serious, preserve the original electronic source, exports, recordings, headers and other corroborating material.
BNSS Section 222 generally requires a complaint by the aggrieved person for an offence under BNS Section 356. Ordinary defamation is non-cognizable, so it should not be treated as though every defamatory post automatically requires a police FIR. The appropriate complaint route, forum and evidence should be identified first.
Section 223(1) BNSS states that a Magistrate shall not take cognizance of an offence on complaint without giving the accused an opportunity of being heard. In Parvinder Singh v. Directorate of Enforcement, 2026 INSC 519, the Supreme Court treated non-compliance with that first proviso as vitiating the cognizance order in the case before it. The provision is a procedural safeguard, not immunity from a properly supported complaint, and its application should still be considered with the governing complaint procedure and any special law.
Subject to the BNSS and any applicable special law, the Magistrate deals with examination of the complainant and witnesses under Section 223 and may use the inquiry or investigation mechanism under Section 225 before deciding whether sufficient ground exists to proceed. If there is no sufficient ground, Section 226 provides for dismissal of the complaint with reasons. The precise sequence can depend on the offence, residence of the accused and the procedural setting.
The Portal is intended for reporting cybercrime incidents and is especially important for cyber offences against women and children and financial cyber fraud. A purely civil reputation dispute, contract disagreement or routine platform-policy complaint may require a different or additional route. The facts should be classified before choosing the forum.
Preserve available evidence without delaying urgent safety measures. Use the relevant platform emergency or intimate-content mechanism, contact local police or the cybercrime system where an offence is suspected, secure compromised accounts and seek urgent legal relief where necessary. Imminent physical danger should be treated as a safety matter rather than merely a reputation dispute.
G. Pre-Publication Discipline and Common Risk Controls
Confirm the evidentiary basis for every serious factual allegation, separate facts from allegations and opinion, verify quotations and dates, seek and fairly represent a response where appropriate, redact unnecessary personal data, check copyright and confidentiality, review legal status words such as “accused”, “charged” and “convicted”, and review the headline, thumbnail, captions and promotional snippets for overstatement.
Ordinarily not without corroboration appropriate to the seriousness of the allegation. Assess how the source knows the facts, possible motive, documentary support, consistency with independent material and whether anonymity prevents meaningful verification. Preserve source material and do not convert an unverified tip into a statement of proven fact.
No universal rule makes a right-to-reply request mandatory in every private publication, but seeking a response can be an important part of responsible verification and fairness, particularly for serious allegations. The nature, urgency, safety concerns, existing public record and risk of evidence destruction can affect whether and how a response is sought.
Common mistakes include publishing because material is “true” without considering privacy; relying on cropped screenshots; calling an allegation a conviction; invoking omitted Section 66A; treating every fake account as identity theft or cheating; exposing addresses, children or unrelated third parties; assuming doxxing is one single offence; ignoring the current two-hour intimate-content platform route; using stale intermediary timelines; threatening criminal action without matching statutory ingredients; and circulating accusations to employers, customers or family without necessity.
Identify the exact statement or content; preserve the full electronic record; separate fact, allegation and opinion; verify the person or entity concerned; assess defamation, privacy, confidence, data, cyber-offence and copyright issues separately; check current BNS, BNSS, IT Act and intermediary-rule provisions; redact unnecessary personal data; identify the appropriate platform, civil or criminal route; record limitation and urgent deadlines; and define the actual relief sought before publishing, sending a notice or filing a complaint.
If you have a post, notice, platform report, electronic record or urgent online-removal issue requiring matter-specific review, you may send a preliminary enquiry.
Subject to conflict check, scope confirmation, professional terms and express acceptance by the responsible Advocate.
Last reviewed: 12 September 2026