Preservation and Retention by Intermediaries

In one line

An intermediary must preserve removed content for a hundred and eighty days, keep a user's registration information for a hundred and eighty days after the registration ends, keep logs of all its systems for a hundred and eighty days inside India, and, from 2027, keep personal data and its logs for at least a year.

Section 67C

67C. Preservation and retention of information by intermediaries.

(1) Intermediary shall preserve and retain such information as may be specified for such duration and in such manner and format as the Central Government may prescribe.

(2) Any intermediary who intentionally or knowingly contravenes the provisions of sub-section (1) shall be liable to penalty which may extend to twenty-five lakh rupees.

Three things to notice.

The section prescribes nothing. It is an enabling provision: what is preserved, for how long, and in what manner and format are all left to rules. Section 67C on its own imposes no obligation at all.

The sanction changed. As inserted in 2008, sub-section (2) provided that the intermediary "shall be punished with an imprisonment for a term which may extend to three years and also be liable to fine". It is now a civil penalty of up to twenty-five lakh rupees, and the imprisonment has gone. So section 67C is no longer an offence, and it is adjudicated under section 46 like any other penalty. Chapter 1120.

And the mental element survives: the contravention must be intentional or knowing.

The three obligations that actually bind

One: rule 3(1)(g) of the IT Rules 2021, preserving removed content for 180 days.

Where, upon receiving actual knowledge under clause (d), on a voluntary basis on violation of clause (b), or on the basis of grievances received under sub-rule (2), any information has been removed or access to which has been disabled, the intermediary shall, without vitiating the evidence in any manner, preserve such information and associated records for one hundred and eighty days for investigation purposes, or for such longer period as may be required by the court or by Government agencies who are lawfully authorised.

Four features. It is triggered by removal, not by hosting, so it applies precisely to material that has gone. It covers the information and associated records, so the account details and the upload log go with it. The words "without vitiating the evidence in any manner" impose a chain of custody obligation on a private party. And the period may be extended by a court or an authorised Government agency, with no maximum.

Two: rule 3(1)(h), retaining registration information for 180 days after registration ends.

Where an intermediary collects information from a user for registration on the computer resource, it shall retain his information for a period of one hundred and eighty days after any cancellation or withdrawal of his registration.