PECA after the 2025 amendments: what companies can no longer say — and what they still can

The Prevention of Electronic Crimes (Amendment) Act 2025 was enacted in January 2025. One year on, its machinery is being built out, constitutional challenges filed by journalist bodies and others remain pending before the High Courts [status as of January 2026 — TO BE VERIFIED BY REVIEWING LAWYER], and companies are discovering that the Act reaches well beyond journalism. Every press release, every executive's post, every marketing campaign now passes through a statute with criminal teeth. This briefing states the position as of late January 2026.

What the 2025 amendment did

Three changes matter most for businesses.

First, a new offence. Section 26A criminalises the dissemination of information that the sender knows, or has reason to believe, to be false or fake, where it is likely to cause fear, panic, disorder or unrest. The penalty is imprisonment of up to three years, a fine of up to two million rupees, or both [figures — TO BE VERIFIED BY REVIEWING LAWYER].

Second, new institutions. The amendment established a Social Media Protection and Regulatory Authority with powers to regulate and block online content and to require registration of platforms; Social Media Protection Tribunals to hear cases arising under the regime, with appeals to the Supreme Court; and a National Cyber Crime Investigation Agency, which replaces the FIA's Cybercrime Wing as the investigating body [institutional details and commencement — TO BE VERIFIED BY REVIEWING LAWYER].

Third, wider blocking powers. The grounds on which online content may be blocked or removed were expanded, and the definition of a social media platform was broadened to capture websites, applications and communication tools generally — not only the large networks.

What companies can no longer safely say

The centre of gravity is section 26A. Its critical elements are knowledge or reason to believe that the information is false, and a likelihood of fear, panic, disorder or unrest. On its text, it is not an offence to be wrong; it is an offence to circulate what you know or should know is untrue. But until the tribunals and courts settle how "reason to believe" and "unrest" will be read, prudent companies should assume a wide berth. Practical danger zones:

Statements about competitors. Aggressive comparative claims — about a rival's solvency, product safety or regulatory standing — were always actionable as defamation. They now also sit near section 26A and section 20, the offence against the dignity of a natural person. A campaign built on an unverified claim about a competitor is a criminal complaint waiting to be filed.

Crisis communications. A company minimising an incident — a data breach, a product failure, an industrial accident — in terms it knows to be inaccurate is publishing information it has reason to believe is false, on a subject apt to cause public concern. Reassurance must be accurate reassurance.

Employee and executive posts. The Act does not distinguish between the corporate account and the CEO's personal handle. Posts by identifiable senior people about markets, institutions or public affairs carry the company's risk with them.

Marketing at volume. Bulk messaging without consent engages the spamming provisions, and misrepresenting the source of a message engages the spoofing offence. Both predate 2025; both are enforced.

What companies can still say

The Act does not criminalise commercial speech. As of early 2026, a company remains free to publish truthful statements about its own products, prices and performance; to state opinions identified as opinions; to make disclosures required by the Companies Act 2017, the listing regulations or a regulator; to respond to allegations with its own account of the facts; and to complain to regulators, or to litigate, and say publicly that it has done so. Statements made in pleadings and before courts carry their own established protections. Truth, held in documents you can produce, remains the strongest defence available under any of these provisions — and the civil route under the defamation law remains open to companies on the receiving end of falsehoods, without invoking the criminal machinery.

Obligations that predate 2025 and still bind

The 2016 Act already imposed duties that companies overlook. Service providers must retain traffic data for a minimum statutory period and provide it to investigators under proper authorisation [section and period — TO BE VERIFIED BY REVIEWING LAWYER]. Investigating officers can require preservation of data on short notice. Intermediaries acting as neutral conduits have qualified protection, but that protection assumes they act on lawful takedown directions. A company running a platform, a marketplace or even a busy comments section should know which of these hats it wears before the first notice arrives.

The new enforcement path

Expect complaints to move faster. The amendment builds a dedicated pipeline — authority, tribunal, agency — designed for speed, with short statutory timelines for content decisions and appeals [timelines — TO BE VERIFIED BY REVIEWING LAWYER]. For a company, that means two clocks can run at once: a blocking or removal direction against content, and a criminal investigation against the people who posted it. The response to each is different, and the first days matter. A blocking direction can be contested through the tribunal route; an investigation requires the discipline of any criminal matter — preserve records, control communications, and appear through counsel.

What this means for you

Audit who speaks for the company online, and cut the list down. Put a verification step between drafting and publication for any statement about competitors, incidents, regulators or public affairs — one person, one checklist, documented. Update the social media policy to cover senior executives' personal accounts, and say plainly that the criminal law applies to them. Keep the evidentiary file for every factual claim in your public communications; if you cannot produce the document behind a sentence, do not publish the sentence. Map whether any part of your business is a service provider or intermediary under the Act, and build data-retention and takedown procedures to match. Finally, decide now who takes the call when a notice arrives from the new agency or the authority — the companies that respond well in the first week are the ones that decided these questions in advance.