Criminal framework

Information Technology Act 2000 sections 66E (violation of privacy) and 67/67A (publishing or transmitting obscene or sexually explicit material), plus BNS section 77 (replacing IPC s.354C). The statute was enacted IT Act 2000 amended 2008; BNS in force 1 July 2024. Section 66E: up to 3 years imprisonment or fine up to INR 2 lakh. Section 67A: first conviction up to 5 years and INR 10 lakh fine, subsequent up to 7 years.

Civil and data protection framework

Digital Personal Data Protection Act 2023 (right to erasure under section 12) provides the parallel civil route. Data Protection Board of India (under DPDP Act 2023) (DPB India) is the national supervisory authority and accepts complaints against any controller processing intimate imagery without lawful basis. The official site is https://www.meity.gov.in.

Direct takedown authority

Section 79 of the IT Act and the IT Rules 2021 require intermediaries to remove non consensual intimate imagery within 24 hours of complaint to retain safe harbour.

Official victim support

Cyber Crime Reporting Portal is the recognised support service. Available at https://cybercrime.gov.in.

Five step removal process for India victims

  1. 1

    Preserve evidence before any contact with the perpetrator

    Capture full page screenshots with URLs visible. Save the original files. Note timestamps. This evidence supports both the Information Technology Act sections 66E and 67/67A complaint and any Digital Personal Data Protection Act 2023 (right to erasure under section 12) request.

  2. 2

    File a criminal complaint under Information Technology Act sections 66E and 67/67A

    Report to local police or the national cybercrime unit. Cyber Crime Reporting Portal can assist with the report.

  3. 3

    Submit an erasure request under Digital Personal Data Protection Act 2023 (right to erasure under section 12)

    Send a written request to each platform's designated data protection contact citing the legal basis. DPB India can be petitioned if the platform fails to comply within 30 days.

  4. 4

    Send a US TAKE IT DOWN Act notice in parallel for covered platforms

    When the platform is subject to US jurisdiction, the 48 hour federal removal obligation applies in parallel with your domestic rights. ScanErase files these notices automatically.

  5. 5

    Track and escalate non compliant platforms

    Document every notice and every response. Use the regulator's takedown authority for non compliant platforms.

Frequently asked questions

What is the criminal NCII statute in India?

Information Technology Act 2000 sections 66E (violation of privacy) and 67/67A (publishing or transmitting obscene or sexually explicit material), plus BNS section 77 (replacing IPC s.354C). Enacted IT Act 2000 amended 2008; BNS in force 1 July 2024. Section 66E: up to 3 years imprisonment or fine up to INR 2 lakh. Section 67A: first conviction up to 5 years and INR 10 lakh fine, subsequent up to 7 years.

Who enforces data protection rights in India?

Data Protection Board of India (under DPDP Act 2023) (DPB India) is the national authority. Official site: https://www.meity.gov.in.

Is there an official victim support service in India?

Yes. Cyber Crime Reporting Portal provides direct help to victims. Site: https://cybercrime.gov.in.

Does any regulator in India have direct takedown power?

Section 79 of the IT Act and the IT Rules 2021 require intermediaries to remove non consensual intimate imagery within 24 hours of complaint to retain safe harbour.

Can a India resident also use the US TAKE IT DOWN Act?

Yes when the hosting platform is subject to US jurisdiction. The TAKE IT DOWN Act applies to covered platforms regardless of where the victim resides. ScanErase's scan finds every US covered platform hosting your images, so you can file notices there in parallel with Digital Personal Data Protection Act 2023 (right to erasure under section 12) requests.

Related guides