Intermediary Due Diligence under IT Rules 2021: Compliance Audits for Significant Social Media Intermediaries (SSMI)

I. I. The Evolution of Platform Governance in the World's Largest Digital Democracy

With over 900 million active internet users, India represents the single largest open digital market for global social media platforms, communication networks, cloud aggregators, and digital media enterprises. For the first two decades of the internet era, these digital platforms operated under the benevolent umbrella of the 'Safe Harbor' doctrine codified in Section 79 of the Information Technology Act, 2000. Modeled after Section 230 of the US Communications Decency Act, Section 79 shielded intermediaries from liability for third-party user content.

However, the weaponization of social media for viral communal disinformation, non-consensual deepfakes, copyright piracy, and electoral manipulation prompted the Indian government to radically reform platform governance. In February 2021, the Ministry of Electronics and Information Technology (MeitY) notified the *Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021* (IT Rules 2021).

The IT Rules 2021 dismantled the era of passive intermediary immunity. They established a sophisticated, two-tier compliance architecture, imposing rigorous due diligence obligations on all intermediaries, while creating an elite category of **Significant Social Media Intermediaries (SSMIs)** subject to heightened accountability under threat of total loss of safe harbor.

II. II. The Core Due Diligence Mandates under Rule 3

Rule 3 of the IT Rules 2021 articulates the baseline due diligence obligations that *every* intermediary—regardless of size—must observe to preserve its statutory immunity under Section 79(2)(c) of the IT Act.

Under Rule 3(1)(a), the intermediary must prominently publish on its website or mobile application its rules, regulations, privacy policy, and user agreement. Under Rule 3(1)(b), the intermediary must inform users that they are prohibited from hosting, displaying, uploading, modifying, publishing, transmitting, or sharing content that belongs to another person, is defamatory, obscene, pornographic, pedophilic, invasive of bodily privacy, encourages money laundering, threatens the unity and integrity of India, or contains software viruses.

Furthermore, under Rule 3(1)(d), upon receiving actual knowledge in the form of a court order or an order from an authorized government agency under Section 69A of the IT Act, the intermediary **must remove or disable access to the unlawful content within thirty-six hours**. In addition, the intermediary must appoint a Grievance Officer resident in India, acknowledge complaints within 48 hours, and resolve them within fifteen days under Rule 3(2).

III. III. Significant Social Media Intermediaries (SSMI): Heightened Rule 4 Mandates

The IT Rules 2021 introduced a specialized regulatory classification: the Significant Social Media Intermediary (SSMI), defined as any social media intermediary having registered users in India above the threshold of **fifty lakh (5 Million) users**.

Under Rule 4, SSMIs are subjected to intense structural governance requirements. First, an SSMI must appoint three designated senior executives who must be citizens and residents of India: (a) a **Chief Compliance Officer (CCO)**, who is personally liable for ensuring compliance with the Act and Rules; (b) a **Nodal Contact Person**, available 24/7 for coordination with law enforcement; and (c) a **Resident Grievance Officer (RGO)**.

Second, under Rule 4(1)(d), an SSMI must publish a **Monthly Compliance Report** detailing the details of complaints received, action taken, and specific monitoring efforts. Third, under Rule 4(4), messaging platforms providing services primarily in the nature of messaging must enable the **Identification of the First Originator** of information when commanded by a judicial or government order under Section 69—a requirement that has triggered monumental constitutional litigation regarding end-to-end encryption.

IV. IV. The High-Stakes Consequence: Forfeiture of Section 79 Safe Harbor

The compliance teeth of the IT Rules 2021 are absolute. Rule 7 establishes the catastrophic legal consequence of non-compliance: 'Where an intermediary fails to observe these rules, the provisions of sub-section (1) of section 79 of the Act **shall not apply to such intermediary** and the intermediary shall be liable for punishment under any law for the time being in force including the provisions of the Act and the Indian Penal Code.'

Once Section 79 safe harbor is stripped, the platform loses its legal shield as a neutral conduit. The platform stands in the shoes of a publisher, facing direct co-conspirator and abetment liability.

If a user uploads a defamatory deepfake, infringes copyright, or publishes hate speech, the platform can be sued directly for civil damages and prosecuted criminally under Section 356 BNS (defamation), Section 336 BNS (forgery), and Section 51 of the Copyright Act. Corporate officers, including the Chief Compliance Officer, face direct arrest and prosecution under Section 85 of the IT Act.

V. V. Constitutional Challenges and the Shreya Singhal Doctrine

The aggressive compliance mandates of the IT Rules 2021 have been challenged before multiple High Courts across India, including the Delhi, Bombay, and Madras High Courts, by digital media organizations, messaging platforms, and civil liberties federations.

The legal challenges center on the landmark Supreme Court ruling in *Shreya Singhal v. Union of India* (2015 5 SCC 1), which held that intermediaries can only be required to take down content upon receiving a court order or an authorized government order under Section 69A, striking down private takedown regimes as unconstitutional restrictions on Article 19(1)(a) free speech.

While High Courts have stayed certain provisions relating to digital news publishers (Part III of the Rules) and fact-checking units, the core intermediary due diligence requirements under Rule 3 and Rule 4 remain fully operational, commanding unyielding compliance from enterprise technology platforms.

VI. VI. Chambers Platform Governance and Intermediary Practice

Advocate Ritik Khurana Chambers provides specialized platform governance counsel, statutory due diligence auditing, and regulatory defense representation to global technology platforms, social media intermediaries, OTT streaming services, and domestic digital startups across India.

Our practice conducts Comprehensive Intermediary Due Diligence Audits, drafts localized terms of service and grievance redressal architectures, and structures Chief Compliance Officer protocols that satisfy Rule 3 and Rule 4 mandates. In regulatory investigations initiated by MeitY or law enforcement agencies, our team delivers decisive legal defense to protect Section 79 safe harbor.

In high-stakes free speech and copyright litigation before High Courts, our chambers defends platform neutrality, balancing strict regulatory compliance with constitutional principles of open digital commerce.