IT Act Section 79 Safe Harbour: What Intermediaries Must Do to Keep Immunity

By LegalInk Editorial · 2026-07-27

IT Act Section 79 Safe Harbour: What Intermediaries Must Do to Keep Immunity

Section 79 of the Information Technology Act, 2000 grants an intermediary immunity from liability for third-party content hosted or transmitted on its platform — but that immunity is conditional, not automatic. An intermediary loses the Section 79 safe harbour the moment it fails to satisfy the due-diligence requirements set out in the provision and the Intermediary Guidelines framed under it.

What Section 79 Actually Covers

Section 79 carves out a liability shield for intermediaries — defined broadly to include network service providers, search engines, online marketplaces, social media platforms, and cloud service providers. The immunity applies to civil and criminal liability arising from content that the intermediary did not originate, select, or modify.

The premise is that the intermediary acts as a conduit, not a publisher. So long as it remains neutral to the content and complies with takedown obligations, it cannot be held liable as if it were the author.

The immunity does not extend to situations where the intermediary has conspired with a user, induced an unlawful act, or failed to act on actual knowledge of unlawful content.

The Three Structural Conditions

For the Section 79 safe harbour to apply, the intermediary must satisfy all three of the following:

• Its function is limited to providing access to a communication system over which third-party information is transmitted or temporarily stored.
• It did not initiate the transmission, select the receiver, or modify the information in transit.
• It observed due diligence and complied with the guidelines prescribed by the Central Government.

Failure on any single limb collapses the immunity entirely.

Due Diligence Obligations Under the Intermediary Guidelines

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 — framed under the IT Act — operationalise what "due diligence" means for intermediaries. Technology counsel advising platforms must ensure clients have implemented the following.

Published Terms of Use and Privacy Policy

The intermediary must publish, in English and at least one vernacular language, its rules, regulations, privacy policy, and user agreement. These documents must clearly prohibit specified categories of harmful content, including content that threatens national security, is obscene, infringes intellectual property, or impersonates another person.

Courts have treated a terms-of-use document that is vague or non-compliant with the Rules as a weakness in the due-diligence defence. Drafting these documents with precision is a compliance necessity, not a formality.

Grievance Redressal Mechanism

All intermediaries must appoint a Grievance Officer based in India and publish the officer's name and contact details prominently. The officer must acknowledge complaints within 24 hours and resolve them within 15 days.

Significant social media intermediaries — those with over 50 lakh registered users — carry additional obligations: a resident Chief Compliance Officer, a nodal contact person for law enforcement coordination, and a monthly compliance report.

Takedown on Actual Knowledge

Once an intermediary receives actual knowledge — typically through a court order, a government notification, or a valid takedown complaint — it must act expeditiously to remove or disable access to the offending content. The Rules specify a 36-hour window for taking down content flagged by the government in categories such as national security or public order.

Delay beyond the prescribed window destroys the Section 79 immunity retroactively from the point of knowledge.

The Data Security Overlay

Technology counsel cannot advise on intermediary compliance in isolation. The IT Act separately imposes liability on a body corporate that handles sensitive personal data and fails to implement reasonable security practices.

An intermediary that is also a body corporate — which includes most commercial platforms — must therefore maintain documented security standards. The relevant rules specify categories of sensitive personal data (passwords, financial information, health records, biometric data) and require a clearly articulated privacy policy governing their collection and use.

A data-security breach does not automatically negate the Section 79 safe harbour, but it creates independent liability and — in regulatory proceedings — signals systemic non-compliance that undermines the intermediary's overall due-diligence posture.

Where Intermediaries Most Commonly Lose the Shield

In practice, the Section 79 immunity breaks down in three recurring scenarios.

Editorial intervention. When a platform curates, recommends, or algorithmically promotes specific third-party content, regulators and courts examine whether that constitutes "modification" or "selection" of content — either of which brings the intermediary outside Section 79's protection.

Inaction after notice. Receiving a valid takedown notice and failing to act within the prescribed window is the most common reason platforms lose immunity. Technology counsel should ensure clients have internal escalation protocols that trigger immediately on receipt of any government notification or court order referencing hosted content.

Deficient grievance infrastructure. An unresponsive or non-India-resident Grievance Officer has been treated as evidence of non-compliance in enforcement actions. The appointment must be substantive, not nominal.

Use LegalInk's compliance framework tool to map your client's existing infrastructure against each of these obligations before a notice arrives.

Building a Defensible Compliance Record

The Section 79 safe harbour is, at its core, a documentation defence. When a regulator or court scrutinises a platform's conduct, the intermediary must be able to demonstrate — with records — that it observed due diligence throughout.

Counsel should advise clients to maintain timestamped logs of all takedown notices received, actions taken, and timelines adhered to. The monthly compliance reports required of significant social media intermediaries should be treated as litigation-ready documents from the moment they are generated.

Where an intermediary is responding to a court summons or a government inquiry, a structured brief setting out the platform's compliance history is essential. The brief generator at legalink.co.in can help technology counsel assemble that record efficiently.

Frequently asked questions

Does Section 79 immunity apply to e-commerce marketplaces?

Yes. E-commerce platforms that host third-party seller listings qualify as intermediaries under the IT Act. However, if the platform exercises significant control over pricing, fulfilment, or content presentation, courts may examine whether it has moved beyond neutral conduit status.

Can an intermediary lose Section 79 immunity for user-generated content it was unaware of?

The immunity holds until the intermediary has actual knowledge of the unlawful content — typically through a court order or government notification. Absent such notice, lack of awareness is generally a valid defence, provided the platform's due-diligence infrastructure is otherwise in place.

What counts as "expeditious" removal after a takedown notice?

The Intermediary Guidelines prescribe a 36-hour window for government-directed removals in specified categories. For other complaints, the Grievance Officer must resolve the matter within 15 days. "Expeditious" in court proceedings has generally been read against these benchmarks.

Does the data-security obligation apply to all intermediaries or only large platforms?

It applies to any body corporate that possesses, deals with, or handles sensitive personal data in a computer resource. There is no size threshold. Any commercial intermediary collecting passwords, payment information, or health data falls within its scope.

Statute citations in this article are verified against LegalInk's verified law registry before publication. Always confirm the current text of any provision before relying on it.

← Back to all posts