Encryption Law by Country
Where strong encryption is a right, restricted, or compelled. National law and policy, mirrored per country.
Source: Global Partners Digital, World Map of Encryption, updated 2026-07-02. Full data at www.gp-digital.org/world-map-of-encryption
Encryption Law by Country (196)
General right to encryption
No known legislation or policies.
Mandatory minimum or maximum encryption strength
Section 84A of the Information Technology Act 2000 allows the government to set nationally permitted “modes or methods” for encryption, however no such modes or methods have been prescribed. A copy of the law can be found here .
Licensing/registration requirements
No known legislation or policies.
Import/export controls
No known legislation or policies.
Other restrictions
No known legislation or policies.
Obligations on individuals to assist authorities
No known legislation or policies.
Obligations on providers to assist authorities
Section 69 of the Information Technology Act 2000, as amended by the Information Technology (Amendment) Act 2008, gives the central and state governments the power to direct any agency to intercept, monitor or decrypt, or cause to be intercepted, monitored or decrypted any information transmitted, received or stored through any computer resources. The government must be satisfied that “it is necessary or expedient to do so in the interest of the sovereignty or integrity of India, defense of India, security of the State, friendly relations with foreign States or public order or for preventing incitement to the commission of any cognizable offence relating to above or for investigation of any offence”. In consequence, the agency may required any “subscriber or intermediary or any person in charge of the computer resource” to “extend all facilities and technical assistance” necessary to decrypt the information. Failure to do so is a criminal offence punishable by up to seven years’ imprisonment, a fine, or both. A copy of the law can be found here .
Assessment Text Area
Limitations exist on the use of strong encryption in India as internet service providers may not deploy “bulk encryption” on their networks, and users cannot use encryption with greater 40-bit key length without prior permission. The law provides central and state governments the power to direct any agency to intercept, monitor or decrypt, or cause to be intercepted, monitored or decrypted any information transmitted, received or stored through any computer resources and requires any “subscriber or intermediaries” to provide technical assistance necessary to decrypt information, without adequate safeguards. Failure to do so is a criminal offence punishable by imprisonment, a fine, or both.
Murphy's Law