What it means
- Run a 24x7 process that removes or disables unlawful content within the legal clock, starting from when the order or complaint arrives.
- Key Indian clocks under the IT Rules as amended in 2026:
- 3 hours from a court order or a written, reasoned intimation from an authorised officer,
- 2 hours from a complaint about content showing a person's private areas, nudity, sexual acts or impersonation including morphed images,
- 36 hours to resolve complaints asking for removal of Rule 3(1)(b) content (some sub-clauses excepted),
- 36 hours for reported deepfakes at SSMIs (per the 2023 advisory).
- Act quickly on synthetic content violations found by your own monitoring too: remove, suspend the account without destroying evidence, and take the other required steps.
- ISO 27001 reuse: None. New for AI, not covered by ISO 27001. Incident response tooling and on-call practices from ISO 27001 A.5.26 can be reused, but the obligation itself is a content law duty.
Why it matters
- Missing these clocks risks losing safe harbour under Section 79 of the IT Act.
- Two hours leaves no room for an inbox that is checked once a day; it needs on-call staff and tooling.
- Victims of intimate deepfakes suffer harm by the minute.
Checklist
- Set up dedicated intake channels for government orders, court orders and user complaints, monitored 24x7.
- Configure ticket categories with SLA timers for 2, 3 and 36 hours; timer starts at receipt.
- Maintain an on-call roster with authority to remove content without waiting for senior sign-off.
- Build tooling to remove or geo-block content and all copies quickly, including re-uploads (SC-AI-034 Unlawful and prohibited content safeguards).
- Preserve removed content and related logs under legal hold (SC-AI-032 Logging and record keeping).
- Verify authorised officer intimations come from the right authority and are reasoned, without delaying action unduly.
- Notify the uploader where required and offer an appeal route (SC-AI-028 Customer grievance redressal for AI).
- Track SLA performance weekly; run root cause on every breach.
- Run a timed drill quarterly for the 2-hour and 3-hour clocks.
Evidence examples
- Takedown SOP with the legal clocks and decision authority.
- On-call roster and escalation contacts.
- Ticket export showing receipt time, action time and SLA status.
- Drill reports with measured response times.
- Legal hold records for removed content.
- SLA breach root cause analyses.
Common pitfalls
- Clock measured from when someone reads the email, not from receipt.
- Content removed from one URL but copies remain.
- Evidence deleted with the content, hampering police investigation.
- No weekend or night cover.
Satisfies
- SupervisoryMeitY AI and Deepfake Advisories
Standards crosswalk
Clause references only. Check the standard itself for the exact wording.
ISO/IEC 42001
- 7.4 communication
- A.8.3 external reporting
ISO/IEC 27001
No direct equivalent
SOC 2
No direct equivalent
Key takeaways
- Know the clocks: 2 hours, 3 hours, 36 hours, all from receipt.
- Meeting them needs 24x7 intake, on-call authority and fast tooling.
- Remove content but keep evidence.