Prevention of Electronic Crimes (Amendment) Act, 2025

What it is

The Amendment Act was passed by the National Assembly on 23 January 2025 and by the Senate on 28 January 2025, and received presidential assent in late January 2025. It rewrites significant parts of the Prevention of Electronic Crimes Act, 2016. The headline provision is a new section 26A: a person who intentionally disseminates information that he knows or has reason to believe to be false or fake, and that is likely to cause fear, panic, disorder or unrest, faces imprisonment of up to three years, a fine of up to two million rupees, or both.

The Act also builds new institutions. It establishes the Social Media Protection and Regulatory Authority, with power to require registration of social media platforms, issue directions and order the blocking of unlawful content. It creates a Social Media Complaint Council to receive grievances, and Social Media Protection Tribunals whose decisions are appealable to the Supreme Court within sixty days. It replaces the Federal Investigation Agency's cybercrime wing with a National Cyber Crime Investigation Agency as the investigating body for offences under PECA. The definition of "social media platform" is broad and extends to websites and communication tools.

What changed

The 2025 Act is itself the change; what has moved since is implementation and challenge. The National Cyber Crime Investigation Agency has been constituted and has taken over cybercrime complaints and pending investigations from the FIA [the handover notifications and the agency's current rules TO BE VERIFIED BY REVIEWING LAWYER]. The constitution of the Social Media Protection and Regulatory Authority, its registration regime for platforms, and the tribunals' establishment were at earlier stages [status as of mid-2026 TO BE VERIFIED BY REVIEWING LAWYER]. Journalist bodies and press freedom organisations filed constitutional challenges to the Act in the high courts shortly after enactment; those petitions were pending [status and any interim orders TO BE VERIFIED BY REVIEWING LAWYER]. As of mid-2026 the Act is in force and section 26A is being invoked in registered cases.

Who is affected

Anyone who publishes online is within reach of section 26A: journalists and media houses, but also companies and their communications teams, marketing agencies, employees posting about their employers, and private individuals. Social media platforms face registration and compliance obligations once the new Authority's regime is operational. Complainants — including businesses targeted by false online material — gain a new grievance route. Persons already under FIA cybercrime investigation now deal with a different agency.

What to do

Review and tighten internal policies on public statements and social media posting, and train the people who post in the company's name. Verify claims before publication and keep records showing the basis for what was said — intent and knowledge of falsity are elements of the offence. If the National Cyber Crime Investigation Agency issues a notice or summons, engage counsel before responding and preserve all relevant devices and records. Platforms and digital businesses should track the Authority's registration requirements and build a takedown-response procedure now rather than after a direction arrives.