India
India Recording Laws: One-Party Consent, Privacy Rights & Penalties (2026)
title: "India Recording Laws: One-Party Consent, Privacy Rights & Penalties (2026)" meta_description: "India follows one-party consent for recording. Learn how the Telecommunications Act 2023, DPDPA 2023, BNS 2023, IT Act, and Supreme Court rulings shape your rights." secondary_keywords:
- india recording laws
- is recording someone without consent legal in india
- one party consent india
- india wiretapping law
- india privacy law recording
- dpdpa 2023 recording
- bharatiya nyaya sanhita recording
- it act section 66e india
- recording phone calls india
- recording police india
- workplace recording india
- deepfake law india
- non consensual intimate imagery india
- public recording india
- admissibility of recordings india court
- telecommunications act 2023 india recording
India Recording Laws: One-Party Consent, Privacy Rights and Penalties (2026)
India follows a one-party consent standard for recording conversations. Any participant in a phone call, meeting, or video conference may record it without notifying the other parties, a rule rooted in the Supreme Court's 1973 decision in R.M. Malkani v State of Maharashtra (1973) 1 SCC 471. Recording a communication you are not part of is unlawful under the Telecommunications Act 2023 s.20, which replaced the Indian Telegraph Act 1885 as of June 26, 2024.
Information last verified on 2026-05-15. This article has not yet been reviewed by a licensed lawyer. It presents general legal information only and is not legal advice. Consult a lawyer licensed in India for guidance on your specific situation.
Jurisdiction scope: This article addresses the law of recording conversations in India under the Telecommunications Act 2023, the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023, the Bharatiya Sakshya Adhiniyam 2023, the Digital Personal Data Protection Act 2023, and the Constitution of India. It does not address US state-by-state recording consent rules; for those, see our US recording laws hub.
Quick Answer: Is Recording Legal in India?
Yes, recording is generally legal in India when you are a participant in the conversation being recorded. India follows a one-party consent standard. If you are part of a phone call, in-person meeting, or video conference, you may record it without disclosing that fact to the other parties.
The legal boundary is crossed when you record a conversation or interaction you are not part of. Intercepting a communication without the consent of at least one participant is prohibited under the Telecommunications Act 2023 s.20, which inherited and modernised the interception framework of the now-repealed Indian Telegraph Act 1885. Similarly, recording someone's private acts or intimate areas without consent is a distinct offence under the Information Technology Act 2000 s.66E and the Bharatiya Nyaya Sanhita 2023 s.77.
A layer of data-protection obligation now sits on top of the consent question. The Digital Personal Data Protection Act 2023 (DPDPA) treats recorded audio and video as personal data when a living individual can be identified from them. Entities that process such recordings as a Data Fiduciary must give notice and obtain meaningful consent before collection. Substantive compliance obligations under the DPDP Rules 2025 take full effect on May 13, 2027, under the phased implementation schedule.
The sections below explain each rule in detail, correct common misconceptions that circulate in older articles (including the now-repealed Telegraph Act references and the wrong BNS section numbers for voyeurism and stalking), and cover all key developments: the Telecommunications Act 2023, BNS 2023, BSA 2023, DPDPA 2023, DPDP Rules 2025, and IT Amendment Rules 2026.
The One-Party Consent Baseline
India has never enacted a standalone private-recording statute modelled on the US federal Wiretap Act. The framework is instead assembled from three sources: (1) the government-interception provisions of the Telecommunications Act 2023 (and its predecessor, the Telegraph Act 1885, for understanding the historical case law); (2) the Supreme Court's interpretation of constitutional privacy rights; and (3) the general criminal and data-protection statutes that govern specific recording scenarios.
The Supreme Court established the private-party recording right in R.M. Malkani v State of Maharashtra (1973) 1 SCC 471. A police officer, acting on instructions, recorded a telephone conversation with one participant's knowledge and consent. The Court held the recording admissible and reasoned that there is no general prohibition on recording a call you are a party to, provided the recording does not amount to unlawful interception. The one-party consent principle flows directly from this: a party to the conversation is, by definition, not intercepting it from outside.
The High Courts have applied Malkani consistently. In Rayala M. Bhuvaneswari v Nagaphanender Rayala AIR 2008 AP 98, the Andhra Pradesh High Court admitted a secret recording made by a wife during conversations with her husband in matrimonial proceedings. The court held that recording one's own conversation is permissible even without informing the other party, and that the wife's act did not constitute an illegal interception.
What one-party consent does NOT permit:
- Recording a conversation between third parties when you are not present.
- Placing a device in a room to capture conversations after you have left.
- Intercepting communications in transit -- for example, tapping a phone line to capture calls between two other people.
- Recording a private call you have joined without the knowledge of any genuine participant in that call.
All four scenarios involve recording a communication without any participatory basis. They engage the Telecommunications Act 2023 s.20 framework and, depending on the method used, may also engage IT Act 2000 ss.43 and 66 (unauthorised computer access) and BNS 2023 s.78 (stalking by electronic surveillance).
Right to Privacy as a Fundamental Right
Two Supreme Court decisions form the constitutional backbone of Indian recording law.
PUCL v Union of India (1997) 1 SCC 301 arose from concerns about government interception of telephone conversations. The Court held that the right to privacy -- including the privacy of telephone conversations -- is a fundamental right protected under Article 21 (right to life and personal liberty). It directed the government to issue procedural safeguards for State interception, leading to the framework codified in Rule 419A of the Indian Telegraph Rules 1951 and now carried forward by the Telecommunications Act 2023 and its subordinate rules. The PUCL safeguards -- prior written authorisation, an eight-week time limit, and review committee oversight -- remain in force under the transitional provisions in Telecommunications Act 2023 s.61.
Twenty years later, a nine-judge bench in K.S. Puttaswamy (Privacy) v Union of India (2017) 10 SCC 1 confirmed that privacy is an intrinsic component of Articles 14, 19, and 21. The Court identified informational privacy as a distinct dimension: individuals have a right to control how information about them -- including recordings of their voices, images, and activities -- is collected, stored, and disseminated. Any State action or legislation permitting private action that curtails this right must satisfy a three-part test: (a) legality (existence of a law); (b) legitimate aim; and (c) proportionality between the means and the aim.
Puttaswamy has been relied upon in subsequent cases to challenge surveillance programmes, to support claims against non-consensual publication of photographs, and to argue for deletion of personal data held by private entities. The DPDPA 2023 is the legislative response to the Court's call for a comprehensive data-protection framework.
Key Laws Governing Recording in India
Telecommunications Act 2023, Section 20 (Replaced the Indian Telegraph Act 1885)
The Telecommunications Act 2023 (No. 44 of 2023, Presidential assent December 24, 2023) formally repealed and replaced the Indian Telegraph Act 1885 and the Indian Wireless Telegraphy Act 1933. The core interception provisions -- sections 1, 2, 10 to 30, 42 to 44, 46, 47, 50 to 58, 61, and 62 -- came into force on June 26, 2024.
Section 20 authorises the Central Government or a State Government, or an officer specially authorised, to take temporary possession of any telecommunication service or network and to direct the interception or disclosure of messages on the occurrence of a public emergency or in the interest of public safety. The conditions and procedural safeguards from the PUCL framework (prior written authorisation, review committee, eight-week limit) continue in force by virtue of s.61, which preserves existing rules made under the 1885 Act until superseded by new subordinate legislation.
For private individuals, the Telecommunications Act 2023 does not create a direct criminal offence for private-party recording of conversations you are not part of, any more than the Telegraph Act did. However, recordings obtained through unlawful interception remain constitutionally suspect, are generally inadmissible, and may support civil or criminal claims under other statutes (IT Act ss.43 and 66, BNS provisions on fraud, stalking, or extortion).
Watch out: Many older articles and court filings still cite "Indian Telegraph Act 1885 s.5(2)" as the governing interception provision. That statute was formally repealed as of June 26, 2024. The current governing provision is Telecommunications Act 2023 s.20. Any brief or legal argument relying solely on the Telegraph Act cites a repealed statute.
Information Technology Act 2000, Section 66E
Section 66E prohibits intentionally capturing, publishing, or transmitting the image of a person's private area without consent in circumstances where the person has a reasonable expectation of privacy. "Private area" is defined to include the naked or undergarment-clad genitals, pubic area, buttocks, or female breast.
Punishment: imprisonment up to three years, a fine up to two lakh rupees, or both.
This provision captures hidden-camera offences (changing rooms, bathrooms, locker rooms) and is the statute most commonly invoked in voyeurism cases that come to light through circulating videos. It applies regardless of whether the perpetrator is in a public or private space -- the test is the victim's reasonable expectation of privacy in the moment.
Bharatiya Nyaya Sanhita 2023 (BNS)
The BNS (No. 45 of 2023) replaced the Indian Penal Code 1860 with effect from 1 July 2024. Offences relevant to recording include:
-
Section 77 (voyeurism): watching or capturing the image of a woman engaged in a private act without her consent. "Private act" is defined to include situations where the victim's genitals, buttocks, or breasts are exposed or covered only by underwear; use of a lavatory; or sexual conduct not ordinarily performed publicly. Explanation 2 clarifies that consent to image capture does not authorise distribution -- sharing without distribution consent is a separate offence.
Punishment: not less than 1 year and up to 3 years' imprisonment for the first offence, plus fine. Not less than 3 years and up to 7 years' imprisonment for a second or subsequent conviction, plus fine. The offence is cognizable and bailable for first offences; non-bailable for repeat offences.
-
Section 78 (stalking): following a woman and contacting or attempting to contact her repeatedly despite a clear indication of disinterest, or monitoring her use of the internet, email, or any form of electronic communication without her consent. Electronic monitoring -- including placing tracking software on a device or capturing communications -- falls within this definition.
Punishment: up to 3 years' imprisonment for the first conviction, plus fine; up to 5 years for a second or subsequent conviction, plus fine.
Exceptions: conduct by State-authorised persons for crime prevention or detection, conduct mandated under law, or conduct "reasonable and justified" in particular circumstances.
-
Section 308 (extortion): threats using recordings to extract money or property.
-
Section 318 (cheating): obtaining consent through deception, including misrepresenting the purpose of a recording.
Note on section numbering: The existing IPC (now repealed) assigned voyeurism to s.354C and stalking to s.354D. The BNS renumbered these. Voyeurism is now BNS s.77; stalking is now BNS s.78. BNS s.79 covers "word, gesture or act intended to insult the modesty of a woman" -- a distinct, non-recording offence. Do not confuse BNS s.79 with stalking.
Digital Personal Data Protection Act 2023 (DPDPA)
The DPDPA (No. 22 of 2023, assented 11 August 2023) is India's first comprehensive data-protection statute. Understanding its operative status requires attention to the phased implementation schedule.
DPDP Rules 2025 and Phased Implementation
The Digital Personal Data Protection Rules 2025 were notified on 13 November 2025 (G.S.R. 846(E)). Operationally, the implementation follows three phases:
| Phase | Date | What Takes Effect |
|---|---|---|
| Phase I | 13 November 2025 | Rule 1 (short title), Rule 2 (definitions), Rules 17-21 (constitution of Data Protection Board) |
| Phase II | 13 November 2026 | Rule 4 (consent manager registration and obligations) |
| Phase III | 13 May 2027 | All other substantive rules (Rules 3, 5-16, 22-23) including notice, consent, security, retention, and cross-border transfer obligations |
Practical implication for recording: businesses and individuals that process personal data through recordings -- call centres, HR departments, video-conferencing platforms -- have until May 13, 2027 to achieve full compliance with the notice-and-consent obligations in the Rules. The Data Protection Board is, however, already constituted and operational for enforcement of the Act's provisions from Phase I.
What Counts as Personal Data Under the DPDPA?
The DPDPA defines "personal data" as any data about an individual who is identifiable by or in relation to that data. A recording of a person's voice during a phone call, a video of a meeting where participants are named or recognisable, or an audio file of an interview all constitute personal data when the speaker can be identified.
The DPDPA includes a household exemption: processing personal data for purely personal or domestic purposes falls outside its scope. An individual recording a private conversation for personal reference is unlikely to qualify as a Data Fiduciary. The DPDPA applies when recording is done in a professional or commercial capacity.
Obligations for Data Fiduciaries Recording Personal Data
A Data Fiduciary -- any person or entity that determines the purpose and means of processing personal data -- must, before or at the time of collection:
- Give the Data Principal (the person whose data is being collected) a clear notice in plain language describing what data is being collected, for what purpose, and how long it will be retained.
- Obtain free, informed, specific, and unambiguous consent for data not falling within a listed legitimate-use category.
- Allow the Data Principal to withdraw consent at any time, after which processing must cease and data must be erased unless another ground applies.
Legitimate uses that do not require prior consent include processing for the performance of a contract to which the Data Principal is a party, compliance with a legal obligation, and certain public-interest functions. An employer who records meetings for compliance documentation would likely rely on the contract or legal-obligation basis, but employees retain the right to be told about the recording.
Penalties Under the DPDPA
The Data Protection Board may impose financial penalties up to:
| Violation | Maximum Penalty |
|---|---|
| Failure to implement reasonable security safeguards | Rs. 250 crore (approx. USD 30 million) |
| Failure to notify a personal data breach | Rs. 200 crore |
| Non-compliance with children's data obligations | Rs. 50 crore |
| Failure of a Data Principal to comply with their own obligations | Rs. 10,000 |
Admissibility of Recordings in Court
From the Indian Evidence Act to the BSA 2023
Courts deciding whether a recording is admissible now apply the Bharatiya Sakshya Adhiniyam 2023 (BSA) (No. 46 of 2023), which replaced the Indian Evidence Act 1872 with effect from 1 July 2024. Section 63 of the BSA governs electronic records, replacing the old section 65B of the Evidence Act.
The Dual-Certification Model Under BSA s.63
A significant change introduced by the BSA is a dual-certification requirement:
- Part A: A certificate from the person responsible for the device on which the recording was stored, identifying the device, confirming it was functioning properly, and certifying that the electronic record is a true copy.
- Part B: A certificate or endorsement from a qualified expert -- specifically a notified Examiner under the IT Act 2000 framework -- confirming the integrity and authenticity of the electronic record through forensic verification.
Both parts must be filed together with the electronic record at the stage it is formally sought to be exhibited in evidence. The Supreme Court's core doctrine from Arjun Panditrao Khotkar v Kailash Kushanrao Gorantyal (2020) 7 SCC 1 -- that the certificate is a substantive condition of admissibility, not a procedural technicality -- remains in force under the BSA. However, the BSA also introduced limited exceptions for cases where procurement of the certificate is impossible (such as the death of the responsible official or destruction of the electronic system).
Why Shafhi Mohammad No Longer Applies
Shafhi Mohammad v State of Himachal Pradesh (2018) 2 SCC 801 relaxed the certificate requirement for cases where the party seeking admission did not have custody of the device. That decision was overruled by the Constitution Bench in Arjun Panditrao Khotkar v Kailash Kushanrao Gorantyal (2020) 7 SCC 1, which reinstated strict compliance. The BSA 2023 now supersedes both decisions, carrying forward the certificate requirement with the added dual-certification layer.
Anvar P.V. v P.K. Basheer
Anvar P.V. v P.K. Basheer (2014) 10 SCC 473 remains foundational for the proposition that electronic records cannot be admitted merely as secondary evidence and that the certificate requirement is not a technicality. The BSA 2023 codifies this approach.
Practical consequence: if you record a conversation intending to use it as evidence, you must:
- Preserve the original device (or a forensically verified copy).
- Obtain the Part A certificate from the person responsible for the device.
- Obtain the Part B expert certification from a qualified IT Examiner.
- Be able to establish a complete chain of custody.
A recording produced without both parts of the certificate will ordinarily be refused admission even if its contents are genuine.
Key Court Decisions on Recording
| Case | Court | Year | Holding |
|---|---|---|---|
| R.M. Malkani v State of Maharashtra (1973) 1 SCC 471 | Supreme Court of India | 1973 | Participant recording of a phone call is admissible; one-party consent principle established |
| PUCL v Union of India (1997) 1 SCC 301 | Supreme Court of India | 1997 | Privacy of telephone conversations is a fundamental right under Article 21; procedural safeguards required for State interception |
| Rayala M. Bhuvaneswari v Nagaphanender Rayala, AIR 2008 AP 98 | Andhra Pradesh High Court | 2008 | Recording one's own conversation without informing the other party is not illegal interception |
| Anvar P.V. v P.K. Basheer (2014) 10 SCC 473 | Supreme Court of India | 2014 | Electronic records require a certificate to be admissible; secondary-evidence route not available |
| K.S. Puttaswamy v Union of India (2017) 10 SCC 1 | Supreme Court of India (nine-judge bench) | 2017 | Privacy is a fundamental right under Articles 14, 19, and 21; informational privacy includes control over personal recordings |
| Arjun Panditrao Khotkar v Kailash Kushanrao Gorantyal (2020) 7 SCC 1 | Supreme Court of India (Constitution Bench) | 2020 | Overruled Shafhi Mohammad; certificate for electronic records is a substantive condition of admissibility |
| Rajat Prasad v CBI (2014) 6 SCC 495 | Supreme Court of India | 2014 | Sting-operation recordings are admissible where investigator did not induce the offence |
Penalties for Illegal Recording
| Offence | Statute | Maximum Penalty |
|---|---|---|
| Unlawful interception of communications | Telecommunications Act 2023 s.20 | Constitutional remedy; exclusion of evidence; potential criminal liability under other provisions |
| Capturing or publishing images of private areas without consent | IT Act 2000 s.66E | 3 years' imprisonment and/or Rs. 2 lakh fine |
| Voyeurism (capturing images of woman in private act) | BNS 2023 s.77 | 1-3 years' imprisonment (first offence); 3-7 years (repeat offence) |
| Stalking / electronic surveillance without consent | BNS 2023 s.78 | Up to 3 years' imprisonment (first offence); up to 5 years (repeat) |
| Failure to implement data security safeguards | DPDPA 2023 | Fine up to Rs. 250 crore |
| Failure to notify data breach | DPDPA 2023 | Fine up to Rs. 200 crore |
| Failure to comply with children's data obligations | DPDPA 2023 | Fine up to Rs. 50 crore |
| Not removing NCII after complaint (2-hour window) | IT Rules 2026 | Loss of safe harbour under IT Act s.79; civil and criminal liability |
| Not removing AI deepfake per court/government order (3-hour window) | IT Rules 2026 | Loss of safe harbour; civil and criminal liability |
Phone Calls and Participant Recording
Recording your own phone calls in India is lawful under the one-party consent principle. You do not need to announce the recording, obtain the other party's agreement, or play a beep tone.
Several practical and legal considerations apply:
Evidence use: if you plan to use the recording in court, you must preserve the original device, obtain both the Part A and Part B certificates required under BSA s.63, and be prepared to establish chain of custody. Simply playing a recording on a phone or laptop without the dual certificate will likely be inadmissible.
DPDPA notice obligations: if you are a business (Data Fiduciary) recording customer calls for training, compliance, or dispute resolution, the DPDPA requires you to inform callers at the start of the call. The notice must explain the purpose, the retention period, and their right to withdraw consent. Full compliance with the detailed notice-and-consent rules is required from Phase III (May 13, 2027), but the Act's general obligation to have a lawful basis for processing is operative now. Many call centres already play a pre-recorded message to satisfy this obligation.
No interception of third-party calls: you cannot record a call between two other people, even if one of them gives you permission. The non-consenting party's rights under the Telecommunications Act 2023 and under Article 21 are engaged. Law-enforcement agencies may intercept calls only under the procedural framework established in PUCL and carried forward under the Telecommunications Act 2023.
Cross-network recording: intercepting a call at the network level without authorisation amounts to unauthorised computer access under IT Act 2000 ss.43 and 66, carrying civil liability and criminal penalties.
In-Person and Workplace Recording
General In-Person Conversations
The one-party consent standard applies equally to face-to-face conversations. A participant may record a meeting, interview, or discussion without informing the others. A third party who plants a recording device in a room and then leaves has no participatory basis for the recording, and the resulting audio may constitute unlawful surveillance.
Workplace Recording
There is no specific Indian statute regulating workplace recording by employers. However, several frameworks converge:
DPDPA 2023: employees are Data Principals. An employer who records meetings, phone calls, or computer screens as part of monitoring employees is a Data Fiduciary and must give notice, state the purpose, and not retain data beyond what is necessary. The Act's general obligations apply now; the detailed procedural rules under the DPDP Rules 2025 take full effect May 13, 2027, but employers should begin building compliance frameworks now.
Contract and policy: many employers include recording consent clauses in employment agreements or workplace policies. Where such clauses exist and are clearly communicated, they can serve as the basis for ongoing recording -- but employees retain the right to withdraw consent to data processing not covered by a legitimate use under the DPDPA.
BNS 2023: covert recording of colleagues in private areas (bathrooms, changing rooms) is voyeurism under BNS s.77. Recording a colleague's private communications for purposes of harassment or blackmail triggers BNS s.308 (extortion) and BNS s.78 (stalking by electronic surveillance).
Whistleblowing: there is no express statutory protection for employees who secretly record workplace misconduct and disclose it to regulators. However, the Whistle Blowers Protection Act 2014 provides some safeguards for public-sector disclosures, and courts have been reluctant to penalise employees whose recordings exposed genuine wrongdoing.
Attorney-Client and Professional Meetings
Recordings of privileged communications do not automatically become admissible just because they are technically lawful. The Advocates Act 1961 and Bar Council of India Rules impose professional confidentiality obligations on lawyers. A client who records a consultation with counsel and then seeks to produce it in litigation may face objections on privilege grounds, depending on who is seeking to introduce it and for what purpose.
Recording Police and Government Officials
Article 19(1)(a) of the Constitution guarantees freedom of speech and expression, which courts have interpreted to include the right to receive and communicate information. Recording a public official -- including a police officer -- performing public duties in a public place is generally within the ambit of Article 19(1)(a).
There is no Indian statute that expressly prohibits citizens from filming police in public. Courts have consistently held that obstructing a journalist or civilian from recording a public act by a police officer cannot be justified unless the recording genuinely obstructs law enforcement or creates a public order concern.
Practical risks: even if the recording itself is lawful, police officers in some jurisdictions have invoked charges of obstruction or unlawful assembly against people who film them. These charges have frequently been struck down on appeal, but the initial arrest risk is real.
Government premises: recording inside courts, legislatures, or government offices is regulated by the specific rules of those institutions. Many courts prohibit cameras in the courtroom. Recording in a court corridor or in a public-facing government office is generally permissible.
RTI and public interest: the Supreme Court has affirmed in several cases that the public has a legitimate interest in how officials exercise their powers. Recordings that document abuse of power, corruption, or unlawful detention serve a recognised public interest and are unlikely to attract legal liability even if made covertly.
Voyeurism: BNS s.77 and IT Act s.66E
Voyeurism is addressed by two overlapping statutes. Understanding the scope of each is important because the penalties and procedural rules differ.
BNS 2023 s.77 covers watching or capturing the image of a woman engaged in a private act without her consent. The definition of "private act" covers situations where the victim's genitals, buttocks, or breasts are exposed or covered only by underwear; use of a lavatory; or engagement in sexual conduct not ordinarily performed in public. Importantly, Explanation 2 makes distribution a separate offence: consent to being photographed does not authorise distribution.
Punishment under BNS s.77 is graduated: minimum 1 year, maximum 3 years' imprisonment for the first offence (plus fine); minimum 3 years, maximum 7 years for a second or subsequent conviction (plus fine). The offence is cognizable and bailable for a first conviction; non-bailable for repeat offences.
IT Act s.66E takes a wider approach. It covers capturing, publishing, or transmitting the image of the private area of any person (not just women) without consent, in circumstances where the person has a reasonable expectation of privacy. Punishment is up to 3 years' imprisonment and/or a fine of up to Rs. 2 lakh. Unlike BNS s.77, s.66E can apply to both genders.
In practice, prosecutors typically charge both provisions together in hidden-camera cases, giving courts flexibility in sentencing.
Deepfakes and Non-Consensual Intimate Imagery
The Legal Landscape Before 2026
Before dedicated deepfake rules, victims relied on a patchwork: IT Act s.66E (private area images), IT Act s.67A (publishing obscene electronic material), BNS s.77 (voyeurism), and civil remedies in tort. Enforcement was inconsistent, and intermediary platforms were slow to act without a clear legal obligation.
IT Amendment Rules 2026 (in force 20 February 2026)
The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules 2026 were notified on 10 February 2026 and came into force on 20 February 2026. They introduced a dedicated non-consensual intimate imagery (NCII) and deepfake (Synthetically Generated Information, or SGI) framework.
Key obligations on Significant Social Media Intermediaries:
Two-hour NCII takedown window: upon receiving a complaint from any person about NCII or a deepfake depicting them, the intermediary must remove or disable access to the content within two hours.
Three-hour SGI/deepfake window for court or government orders: where a court or the government directs removal of AI-generated or AI-altered content (SGI), the intermediary must comply within three hours of the order.
Proactive detection: intermediaries must deploy technology to detect and prevent the upload of known NCII hashes.
No-re-upload obligation: once content is removed, intermediaries must prevent its re-upload by the same user or via substantially similar files.
Labeling requirements: intermediaries must implement persistent labels and tamper-resistant origin metadata for synthetically generated content, so provenance remains traceable downstream.
Reporting: intermediaries must report NCII complaints and take-down actions to a government-designated nodal officer.
Failure to comply causes the intermediary to lose the "safe harbour" protection under IT Act s.79, exposing it to civil and criminal liability for the content hosted.
Practical Advice for Victims
Do not create, distribute, or possess (with intent to distribute) AI-generated intimate imagery of a real person without their verified consent. The combination of BNS s.77, IT Act s.67A, and the 2026 Rules creates serious criminal exposure for creators and distributors.
Victims should file a complaint with the nearest cyber crime police station and use the National Cyber Crime Reporting Portal (cybercrime.gov.in) to escalate takedown requests. Platform complaints citing the two-hour NCII window under the IT Rules 2026 are the fastest route to removal.
Public Places and Visual Recording
India has no equivalent of the European "right to one's image" statute. Recording in a public place is generally lawful. The key qualifier is the reasonable expectation of privacy:
- A person walking on a public street, attending a public event, or appearing in a government building has a low expectation of privacy with respect to their general appearance and movements.
- A person in a changing room at a gym, a public toilet, or a hotel room has a high expectation of privacy even though the room may technically be accessible to others.
Hidden cameras placed in locations where a person has a reasonable expectation of privacy violate IT Act s.66E and BNS s.77 regardless of whether the space is legally "public" or "private."
Street photography and video journalism in public places do not generally require the consent of incidental bystanders. However, commercial use of footage containing identifiable individuals may require consent for DPDPA compliance if the footage is processed as personal data.
Cross-Border Recording: India, US, and UK
DPDPA Extraterritoriality
Section 3 of the DPDPA applies to the processing of personal data of Data Principals in India, regardless of where the processing occurs. A US company that records a video conference with an Indian client is a Data Fiduciary subject to the DPDPA and must comply with notice, consent, and retention obligations once Phase III comes into force (May 13, 2027), and with the Act's general lawful-basis obligations now.
The DPDP Rules 2025 identify countries to which personal data may be freely transferred. Entities must confirm that the destination country is on the approved list or obtain explicit consent for cross-border transfer.
India-US Calls
If a call is between India and a US state that requires two-party (all-party) consent -- such as California, Florida, or Illinois -- the more protective law generally governs each participant's obligations in their respective jurisdiction. The Indian participant may lawfully record under Indian one-party consent; the US participant may not record without disclosing to the Indian party if their state law requires all-party consent.
India-UK Calls
The United Kingdom's Investigatory Powers Act 2016 and the UK GDPR impose consent and lawful-basis requirements on recording. A UK business recording a call with an Indian counterpart must have a lawful basis under UK GDPR for processing the Indian party's voice data. India's DPDPA simultaneously applies to the extent the UK entity processes personal data of Indian residents.
Sting Operations and Investigative Journalism
Indian courts have not prohibited sting operations categorically. The Supreme Court in Rajat Prasad v CBI (2014) 6 SCC 495 acknowledged that evidence obtained through a sting could be admissible if the investigator did not induce the offence and the recording was genuine. The Court did not endorse entrapment but accepted that documenting existing criminal activity through covert recording may serve a legitimate purpose.
Investigative journalists in India have used sting recordings to expose corruption, bribery, and public misconduct. Where the recording captures a public official committing an offence, courts have generally admitted it. The Press Council of India's Norms of Journalistic Conduct note that sting operations should be a last resort and only when the subject matter is of genuine public interest, the story cannot be obtained by other means, and the broadcaster is prepared to defend the methodology publicly.
Journalists should be aware that: (a) DPDPA obligations apply to media organisations that process personal data systematically; (b) the two-hour takedown rule under IT Rules 2026 can result in removal of legitimate news content if a subject files a spurious NCII complaint; and (c) there is no express statutory shield for journalists against defamation claims arising from published recordings.
Summary Table: Recording Legality in India
| Scenario | Legal? | Key Rule |
|---|---|---|
| Recording your own phone call | Yes | One-party consent (Malkani 1973) |
| Recording a meeting you are attending | Yes | One-party consent |
| Secretly recording a conversation you are NOT part of | No | Telecommunications Act 2023 s.20; Article 21 (PUCL 1997) |
| Placing a hidden device in a room where you will not be present | No | Telecommunications Act 2023 s.20; IT Act s.66E if private area |
| Filming in a public place | Generally yes | Reasonable expectation of privacy analysis |
| Hidden camera in changing room or bathroom | No | IT Act s.66E; BNS s.77 |
| Recording police in public | Generally yes | Article 19(1)(a); Puttaswamy proportionality |
| Business recording customer calls without notice | No (DPDPA violation once fully operative) | DPDPA 2023 s.6; DPDP Rules 2025 (Phase III from May 2027) |
| Creating a deepfake of a real person | No | BNS s.77; IT Act s.67A; IT Rules 2026 |
| Sting operation documenting pre-existing crime | Conditionally yes | Court-by-court assessment; no inducement required (Rajat Prasad) |
| Electronic surveillance of a woman's internet/email use without consent | No | BNS 2023 s.78 (stalking) |
Disclaimer
This article presents general legal information about recording laws in India as of 2026-05-15. It does not constitute legal advice. Laws and regulations may have changed since this article was verified. The information in this article covers the Telecommunications Act 2023, the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023, the Bharatiya Sakshya Adhiniyam 2023, the Digital Personal Data Protection Act 2023, and selected Supreme Court of India decisions. It does not address the laws of any other jurisdiction. Readers should consult a lawyer admitted to practise in India for advice on their specific situation.
Authorities Cited
- R.M. Malkani v State of Maharashtra (1973) 1 SCC 471. https://main.sci.gov.in/
- PUCL v Union of India (1997) 1 SCC 301. https://main.sci.gov.in/
- Rayala M. Bhuvaneswari v Nagaphanender Rayala, AIR 2008 AP 98. https://indiankanoon.org/doc/1560121/
- Anvar P.V. v P.K. Basheer (2014) 10 SCC 473. https://main.sci.gov.in/
- Rajat Prasad v CBI (2014) 6 SCC 495. https://main.sci.gov.in/
- K.S. Puttaswamy v Union of India (2017) 10 SCC 1. https://main.sci.gov.in/
- Arjun Panditrao Khotkar v Kailash Kushanrao Gorantyal (2020) 7 SCC 1. https://main.sci.gov.in/
- Telecommunications Act 2023 (No. 44 of 2023), s.20. https://indiacode.nic.in/handle/123456789/20101
- Information Technology Act 2000, s.66E. https://indiacode.nic.in/bitstream/123456789/13116/1/it_act_2000_updated.pdf
- Bharatiya Nyaya Sanhita 2023 (No. 45 of 2023), ss.77, 78, 308. https://indiacode.nic.in/bitstream/123456789/20062/1/a2023-45.pdf
- Bharatiya Sakshya Adhiniyam 2023 (No. 46 of 2023), s.63. https://indiacode.nic.in/bitstream/123456789/19743/1/bharatiya-sakshya-adhiniyam-2023.pdf
- Digital Personal Data Protection Act 2023 (No. 22 of 2023). https://www.meity.gov.in/content/digital-personal-data-protection-act-2023
- Digital Personal Data Protection Rules 2025, G.S.R. 846(E), notified 13 November 2025. https://www.meity.gov.in/documents/act-and-policies/digital-personal-data-protection-rules-2025-gDOxUjMtQWa?pageTitle=Digital-Personal-Data-Protection-Rules-2025
- IT (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules 2026, notified 10 February 2026, in force 20 February 2026. https://www.meity.gov.in/
- National Cyber Crime Reporting Portal. https://cybercrime.gov.in/
Last updated: 2026-05-15. Statutes cited reflect their in-force versions as of 2026-05-15.