Platform Liability & Evidence

Section 67C: The Invisible Obligation—How Platforms Must Preserve Your Digital Footprints

Published on January 3, 2026 • 13 min read

Imagine this: A cybercrime occurs—a financial fraud, a data breach, or an online extortion case. The police identify the platform where the crime occurred: a social media site, an email service, a messaging app. They issue a formal request: "Preserve all data related to this user for the past 90 days."

If the platform deletes that data before the investigation is complete—the IP logs, the message history, the transaction metadata—the case collapses. The perpetrator walks free. And the platform? They've just violated Section 67C of the Information Technology Act.

Section 67C is the unsung workhorse of cyber law enforcement. It doesn't make headlines like hacking or identity theft provisions, but without it, digital investigations would be impossible.

Section 67C Data Preservation

What is Section 67C? The Legal Framework

Section 67C is titled "Preservation and retention of information by intermediaries." It states:

"The intermediary shall preserve and retain such information as may be specified for such duration and in such manner and format as the Central Government may prescribe. Any intermediary who intentionally or knowingly contravenes the provisions of sub-section (1) shall be punished with an imprisonment for a term which may extend to three years and shall also be liable to fine."

In simpler terms: platforms must keep certain data for a specified period when directed by law enforcement. Failure to do so is a criminal offense.

Who is an "Intermediary"?

Section 2(1)(w) of the IT Act defines an intermediary as:

  • Telecom service providers (Airtel, Jio, BSNL)
  • Internet service providers (ISPs)
  • Web hosting providers (AWS, GoDaddy)
  • Search engines (Google, Bing)
  • Social media platforms (Facebook, Twitter, Instagram)
  • Messaging apps (WhatsApp, Telegram, Signal)
  • E-commerce platforms (Amazon, Flipkart)

Essentially, any entity that transmits, stores, or provides access to electronic communication or data is an intermediary.

What Information Must Be Preserved?

The IT (Intermediaries Guidelines) Rules 2021 and the IT (Procedure and Safeguards for Interception, Monitoring, and Decryption of Information) Rules 2009 specify the types of data that must be retained:

1. Traffic Data

  • IP addresses (source and destination)
  • Timestamps (when communication occurred)
  • Duration of sessions
  • Data volume transferred

2. User Information

  • Registration details (name, email, phone)
  • Account creation date
  • Payment information (for commercial transactions)
  • Device identifiers (IMEI, MAC address)

3. Content (When Ordered)

  • Messages, emails, posts (when specifically requested by law enforcement)
  • Media files (photos, videos shared)
  • Transaction logs

How Long Must Data Be Retained?

Standard Retention Period

Under the IT Rules 2011 and subsequent amendments:

  • General Data: 180 days (6 months) from the date of generation
  • Cyber Security Incident Data: As per CERT-In directions (typically 180 days)
  • Financial Transaction Data: 5 years (as per RBI and SEBI regulations for relevant intermediaries)

Preservation Orders

When law enforcement issues a preservation order under Section 67C:

  • Initial Period: 90 days from the order date
  • Extension: Can be extended for additional 90-day periods upon request
  • Maximum: No statutory maximum, but typically data is preserved until investigation concludes or court directs otherwise

Real-World Context: When 67C Is Invoked

Case Study 1: The WhatsApp Extortion Case

A businessman received threatening messages via WhatsApp demanding ₹50 lakh. He reported it to cybercrime police, who immediately issued a preservation order to WhatsApp. The platform preserved:

  • The IP address used to send messages
  • Device metadata (IMEI, phone number linked)
  • Timestamps of all messages

This data allowed police to trace the perpetrator through ISP logs and make an arrest within 10 days.

Case Study 2: The E-Commerce Fraud

A fake e-commerce website scammed hundreds of customers. By the time police were alerted, the site had gone offline. However, the payment gateway (an intermediary) had retained transaction logs for 180 days, including:

  • Bank account details where funds were transferred
  • IP addresses of the site operators
  • Timestamps of all transactions

The data led to the recovery of ₹12 lakh and convictions under Sections 66D and 420 IPC.

Penalties for Non-Compliance

  • Imprisonment: Up to 3 years
  • Fine: Amount unspecified, at court's discretion
  • Loss of Safe Harbor: Platforms that don't comply lose immunity under Section 79 (can be sued for user-generated content)

For Intermediaries: Compliance Best Practices

1. Implement Retention Policies

  • Automated systems to retain data for 180 days minimum
  • Secure, tamper-proof storage for preserved data
  • Clear documentation of data lifecycle management

2. Establish Legal Response Teams

  • Dedicated personnel to handle preservation orders
  • 24/7 contact point for law enforcement
  • Standardized process for receiving and executing orders

3. Balance Privacy with Compliance

  • Encrypt stored data to prevent unauthorized access
  • Limit internal access to preserved data (only legal/compliance teams)
  • Audit trails for all data access

The Privacy vs. Security Debate

Section 67C sits at the intersection of two competing interests:

Security Argument (Pro-67C)

  • Without data preservation, cybercrime investigation is impossible
  • Digital evidence degrades or disappears quickly; timely preservation is critical
  • Platforms have a civic duty to assist law enforcement

Privacy Argument (Anti-67C)

  • Mass data retention enables surveillance
  • User data can be misused if preservation orders are overbroad
  • Encryption (end-to-end) becomes meaningless if metadata is preserved

The Supreme Court in K.S. Puttaswamy v. Union of India (2017) held that privacy is a fundamental right. Section 67C must be balanced against this right, ensuring preservation orders are:

  • Issued only for legitimate investigations
  • Proportionate (not sweeping entire user databases)
  • Subject to judicial oversight

For Users: What Does This Mean for Your Data?

What Platforms Know About You

  • Every message timestamp, even if content is encrypted
  • Your IP address with every login
  • Devices you've used to access the service
  • Your contact lists, group memberships

What You Can Do

  • Use E2E Encryption: Platforms can't preserve what they can't read (content), but metadata is still retained
  • VPN Usage: Masks your IP address from the platform (though VPN provider becomes the new data custodian)
  • Ephemeral Messaging: Apps like Signal allow disappearing messages, but metadata is still logged
  • Data Rights: Request your data from platforms (under DPDP Act 2023) to see what's being retained

Conclusion: The Silent Guardian of Digital Justice

Section 67C is invisible to most users. You'll never receive a notification that a platform preserved your data in response to a police order. You'll never see the logs that helped catch a cybercriminal. But without this provision, the digital world would be a lawless frontier.

For platforms, it's a compliance obligation that requires infrastructure, legal teams, and vigilance. For law enforcement, it's the foundation of every cyber investigation. For users, it's a reminder that nothing online is truly ephemeral.

Section 67C ensures that when a crime is committed in the digital realm, the evidence doesn't vanish into the void. And in the battle between justice and impunity, that's a silent victory worth preserving.

Need guidance on data preservation compliance or challenging a preservation order? Our practice advises both intermediaries on regulatory compliance and individuals on privacy rights. Contact Our Cyber Law & Privacy Team.

← Back to Legal Analysis