Digital business in India: overview

The key laws and regulations governing e-commerce in India are as follows:

The main laws on e-commerce are the:

Common online payment methods are net banking, credit cards, debit cards, mobile banking and online wallets.

The primary law governing online payments is the Payment and Settlement Systems Act 2007 (PSSA) and the Payment and Settlement Systems Regulations 2008 made under that Act. The PSSA governs payment systems. Operators of payment systems must be authorised by the Reserve Bank of India (RBI). The RBI has issued the following (among others) notifications relating to online modes of payment:

The key laws on personal data are:

In addition to the above, sector-specific regulators have issued guidelines including:

Foreign investments in India are regulated by the Foreign Exchange Management Act 1999 (FEMA), regulations made under it and the Foreign Direct Investment Policy (FDI Policy). The FDI Policy regulates investments on a sectoral basis, allowing investments into these sectors either by an ‘automatic route’ or a ‘Government route’. Sectors falling within the ‘automatic route’ can receive foreign investments without any prior government approval, while investments into sectors falling within the ‘Government route’ require prior permission from the Government of India. The relevant sector for a digital business varies based on the nature and model of the digital business. Under the FDI Policy, e-commerce is defined as buying and selling of goods and services including digital products over digital and electronic networks. Under the FDI Policy, foreign investment in (B2B) e-commerce is permitted 100% under the automatic route (that is, it does not need prior government approval). However, e-commerce entities with foreign investment cannot engage in B2C e-commerce.

Also, 100% foreign investment is permitted under the automatic route in a marketplace model of e-commerce where an information technology platform on a digital network acts as a facilitator between buyer and seller.

A manufacturer is permitted to sell products manufactured in India, including through e-commerce, without government approval.

Parliament has the power to make laws relating to telecommunications and information technology.

Currently, there is no standalone authority regulating all aspects of digital business. Some of the regulatory bodies which make regulations governing different aspects of digital business are the:

Various registrations and approvals are required for digital businesses, from the incorporation stage to rolling out the business.

The Ministry of Company Affairs has simplified the process of incorporating a company. Applications can be made for reservation of a name, incorporation of a new company, Director Identification Number, Permanent Account Number (PAN) and Tax Deduction Account Number through a single form known as SPICe (simplified proforma for incorporating company electronically) which can be used for a maximum of seven subscribers to the Memorandum of Association of the proposed company.

Once the company is incorporated, the following types of registration are typically required (although these vary depending on the type of business):

The nature of agreements required depends on the business model of the company. Broadly, the following categories of agreements are required for operating a digital business:

An app for a digital business can be developed by an entity through internal resources or through professional developers. With respect to distribution, information technology companies across the globe provide online stores/consoles through which an app can be distributed. A digital business provider must agree and comply with the terms and conditions of these providers.

The owner/operator of the app would be considered as an intermediary under the ITA and as such required to comply with the Intermediary Guidelines issued by the Ministry of Electronics and Information Technology. (see Question 38 and Question 39).

The ITA (see Question 1, General laws) recognises contracts formed electronically. However, the general principles of formation of contracts are set out in the Contract Act. An agreement is legally binding if there is a valid offer and acceptance, consideration, the object is lawful, and the parties are competent to contract. The same principles are applicable to electronic contracts.

In B2C models, electronic contracts are generally standard form contracts. Such contracts offer consumers little or no bargaining power and hence could be considered unreasonable and against public policy under the Contract Act. It is therefore important that the terms of such contracts are reasonable and not onerous or one-sided.

An instrument will not be accepted by the Indian courts as evidence unless it is duly stamped. To be chargeable with stamp duty an instrument must be executed, in other words, signed. Hence, a view may be taken that electronic contracts which do not contain electronic signatures are not executed and need not be stamped.

In relation to enforceability of electronic contracts, some points to note are:

The principal governing laws for e-commerce contracts are the:

The limitations of electronic contracts include:

Any contract for the sale or conveyance of immovable property or any interest in such property belongs to a class of documents which by law cannot be concluded electronically (First Schedule, ITA).

Sensitive Personal Information must not be retained for longer than is required (rule 5(4), Data Protection Rules). However, there is no definition of a reasonable retention time in the Data Protection Rules and a digital business can retain the data for as long as is necessary for the required lawful purpose under the terms of its privacy policy.

Generally, websites use a Hyper Text Transfer Protocol Secure (HTTPS) for authentication and credibility of a website. The most popular is the Secure Socket Layer (SSL) certificate, which can be obtained through appropriate vendors.

Remedies for breach of an electronic contract can be contractual and/or statutory.

The Contract Act provides for compensation for loss or damage caused by a breach and liquidated damages if specifically provided for in the contract. Indemnification against loss caused by the conduct of the promisor or any third party can be provided in the contract. Remedies can also be granted under the following statutes in the relevant circumstances:

If legally required, any document can be authenticated by digital signature affixed in a manner prescribed by the Central Government (section 5, ITA).

Further, section 10A of the ITA recognises contracts formed through offer and acceptance by electronic forms or by means of electronic records.

The Ministry of Electronics and Information Technology has prescribed a procedure for authentication through electronic signature under the Electronic Signature or Electronic Authentication Technique and Procedure Rules 2015 (ESEATPR) and Digital Signature (End Entity) Rules 2015 (DSER). The ESEATPR prescribes the procedure of authenticating any electronic record by using Aadhaar e-KYC services. The DSER stipulates, among other things, the procedures for creating, authenticating and verifying digital and xml signatures, and the standards of such digital and xml signatures.

An electronic signature is defined as the authentication of any electronic record by a subscriber by means of the electronic technique specified in the Second Schedule to the ITA and includes a digital signature (section 2(1)(ta), ITA).

A digital signature is defined in section 2(1)(p) of the ITA read with section 3 and 3A but in practice digital signatures have only been recognised by the Government of India under the ESEATPR (passed under the Second Schedule to the ITA) and DSER (under Section 87 of the ITA).

Section 67A of the Indian Evidence Act 1872 recognises electronic documents signed with a secured electronic signature, but where the electronic signature is not secure, the authenticity of the signature needs to be proved.

Digital signatures are widely used in forms and documents submitted to government authorities. The ESEATPR and DSER prescribe the standards and procedures for authenticating electronic records filed with public authorities. However, in a transaction between two private parties or individuals, the use of an electronic signature is optional. The parties can sign the signature page and exchange it by e-mail, for practical convenience.

Where electronic contracts contain terms of use of a website, digital business entities frequently adopt a click-wrap format (see Question 6) by means of which a user can expressly give consent to the electronic contract

There are no specific limitations on the use of e-signatures but where the Central Government prescribes any procedure for the authentication of electronic records through e-signature, that procedure must be followed. For example, the ESEATPR prescribes the procedure for authentication of electronic records by affixing an e-signature.

The Data Protection Rules recognise two categories of personal data:

Personal information is information that relates to a natural person, which when combined with other information is capable of identifying the person (Rule 2(i), Data Protection Rules).

Sensitive personal data or information includes:

The data protection requirements and compliance are higher in relation to sensitive personal data (see Question 16).

The responsibility for compliance with data protection lies with the entity which collects or receives the data. The entity must provide a privacy policy on its website containing the following points:

The entity must obtain the owner’s consent for collecting, storing and processing the data.

Unlawful disclosure of personal information by an intermediary or contractual party resulting in wrongful gain or wrongful loss can incur a term of imprisonment of up to three years or a fine of up to INR500,000 or both (section 72A, ITA).

Any authority or entity empowered under the ITA for collecting, processing and storing personal information which contravenes the provisions of the ITA or the Data Protection Rules is liable for a term of imprisonment of up to two years or a fine of up to INR100,000 or both.

Sector specific regulators have also issued certain guidelines applicable to a particular business sector, such as:

Personal information and sensitive personal data or information of an end-customer is regulated (see Question 14). Business information is typically governed through contractual obligations such as non-disclosure agreements.

The Data Protection Rules set out the following limitations on the collection, processing and storage of sensitive personal data (see Question 14):

For digital business relating to banking, the RBI has issued guidelines on the storage of data in the cloud based in India. Further, cloud service providers providing services to the Government of India are separately regulated by the government’s rules and regulations.

The use of cookies is not regulated by Indian laws, however, it can be governed through contractual terms and conditions or the policies of the service provider.

Contracting companies must, among others:

If an e-commerce website knowingly fails to protect customers’ sensitive personal information, resulting in a wrongful gain or loss, it is liable to imprisonment for a term up to three years or a fine of up to INR500,000 or both (section 72A, ITA).

Generally, if an intermediary (such as an e-commerce website) fails to implement a secure data protection mechanism prescribed under the Data Protection Rules, it can incur a fine of up to INR25,000 (section 45, ITA).

In addition to the above, the RBI requires “two factor authentication” for CNP transactions (payment through credit cards) and adopting the Payment Card Industry Data Security Standard for online payments.

In the business sector, encryption requirements vary in accordance with the guidelines issued by the respective sector regulator. For example, the RBI prescribes 128-bit as minimum level of encryption for banking transactions. The Securities Exchange Board of India has prescribed 64- or 128-bit encryption level for confidentiality and integrity of the data. However, the Department of Telecommunication has mandated under the Unified Licence Agreement that telecom service providers do not have to use bulk encryption equipment in the telecom network.

The Government of India and any other specified government body is empowered under the Data Protection Rules to instruct intermediaries holding or controlling personal data to disclose it to them. The government agencies can also instruct intermediaries to obtain information including sensitive personal data or information, for verifying identity or for preventing, detecting, investigating, prosecuting or punishing offences, including cyber incidents.

The PSSA (see Question 1) is the primary law governing the payment system in India together with the various rules, regulations and circulars issued by the RBI. Any intermediary wanting to set up a payment system must apply to the RBI for registration. See Question 1, Laws relating to online payment for the relevant laws and regulations applicable to electronic payments.

Children under the age of 18 cannot make valid electronic contracts and websites targeting children should appropriately state that any underage person must subscribe to the products or services through a guardian aged over 18 and who is contracting on their behalf.

The publication and transmission of materials depicting children in an obscene, indecent or sexually explicit manner is an offence (section 67B, ITA). The Supreme Court has directed the Government of India to take serious and positive steps to get rid of child sexual abuse materials (Kamlesh Vasvani v Union of India (2013)). Accordingly, the government has ordered all intermediaries to subscribe to the list of dynamically updated websites/URLs maintained by the Internet Watch Foundation.

While the mere acts of linking, framing or caching are not unlawful under Indian law, these acts can lead to civil and criminal sanctions if they either direct or expose a computer or computer network to any virus, Trojan, spam or other form of malicious code (sections 43 and 66, ITA) or if they direct or expose the user to obscene content (section 67, ITA and section 292, Indian Penal Code 1860).

Unauthorised linking or framing or server-level caching for providing unauthorised offline content can be considered as copyright infringement since they violate the copyright owner’s rights of publication and adaptation. Similarly, the unauthorised use of metatags can constitute trade mark infringement or passing off if it causes sufficient confusion about the source of a product or service.

The Madras High Court in Consim Info Pvt Ltd v Google India Pvt Ltd (2012) and the Bombay High Court in People Interactive (I) Pvt Ltd v Gaurav Jerry (2014) have passed orders which recognise meta-tagging as an act of trade mark infringement.

While there is no express statutory protection in India for domain names, the rights of a trade mark owner in domain names have been granted a degree of protection. The principles contained in ICANN’s Uniform Domain Name Disputes Resolution (UDNDR) Policy 1999 and the rules framed by the World Intellectual Property Organization in relation to domain name registration are followed by trade mark registries in India in the event of any claim made by a trade mark owner against a domain name. The trade mark registrar also has the right to refuse registration of a domain name, if he believes the trade mark of another person may be infringed. Licensing of a domain name by the registered owner is governed by the provisions of the Trade Marks Act 1999.

The country code Top Level Domain (ccTLD) .in is available for registration by any individual, company, firm or other organisation, whether resident in India or overseas. The .in ccTLD is operated by the National Internet Exchange of India, a Central Government body. Any person registering on this ccTLD will be subject to Indian laws and is responsible for ensuring the webpage’s security, reliability and operational stability.

The close association between a domain name and a trade mark right has been recognised by the Supreme Court (Satyam Infoway Ltd v Sifynet Solutions Pvt Ltd (2004)). The court held that where a domain name is used in connection with a business, it must be necessary for allowing the business name to be recognised as a trade mark. Therefore, domain names that are capable of distinguishing the goods or services made available to potential internet users have the same characteristics as trade marks and can be registered and protected as trade marks at the national and international levels. Consequently, if any person registers or seeks to register a domain name with the intent to cause confusion with a trade mark, a claim of infringement or passing off can be made. This ruling is very similar to the requirements of rule 4(a) of the UDNDR Policy of ICANN, under which a trade mark owner can raise a domain name dispute against an alleged infringer.

There is no express statutory protection for mere domain names, nor does a domain name by itself create any proprietary rights for the registered owner. The registration of a domain name is, prima facie, governed by the contract between the domain name owner and the domain registry.

A business in India can be structured in any of the following forms:

The names for businesses are governed by statutory requirements. Further, if the business name or any brand created by it is required to be protected as a trade mark, the provisions of the Trade Marks Act 1999 will apply. Broadly, the requirements to be satisfied for registration of a business name under the Companies Act 2013 are:

In addition, to be capable of registration a trade mark must not:

For registration of a business as a company or limited liability partnership, the business owner must first submit an application for reservation of a name. This application can be rejected by the Registrar if the proposed name does not fulfil all the requirements described above, in which event the business owner must resubmit an application for a different business name.

The ITA applies to the whole of India and is extra-territorial in its application in that any offence committed outside India by any person irrespective of nationality can be punished if the act or conduct constituting the offence involves a computer, computer system or computer network located in India.

An aggrieved person can file a suit for compensation for wrongs to person or goods in the following territories (Code of Civil Procedure 1908):

In other cases, the claimant can start proceedings in the court where the defendant resides at the start of the suit or where the defendant carries on business or works, otherwise the action can be started where the cause of action arises or partially arises.

For copyright infringement (section 62(2), Copyright Act 1957) and trade mark infringement (section 134(2), Trade Marks Act 1999), the claimant’s place of residence determines territorial jurisdiction.

The jurisdiction of internet