Regulatory aspects
Besides the three criminal laws (see Legal basis), DigiFIR is shaped by data protection law, the rules on Aadhaar, cyber security directions, telecom, electronic signature and government web standards, and the states' own FIR and evidence rules. This page lists each and what the design does about it.
NOTE
The repositories name these Acts and directions, but their texts were not checked line by line as the criminal codes were. Each item needs confirmation by the department's legal team before the pilot.
| Law or direction | What it requires of DigiFIR | How the design addresses it |
|---|---|---|
| Digital Personal Data Protection Act, 2023 | Notice and consent, purpose limitation, security safeguards, the data principal's rights | Consent receipts recorded with the notice's version and hash; personal data kept to private collections and the encrypted vault; no personal data in read views, events, pushes or logs; every private read audited. Section 17(1)(c) exempts processing for preventing, detecting, investigating or prosecuting offences, so case data is erased only by court order or statutory rule. See Data protection. |
| Aadhaar Act, 2016, and UIDAI regulations and circulars | Aadhaar cannot be mandatory (Act s.4(3), s.4(6), s.8(2) proviso; the Puttaswamy judgment of 2018); regulation 16A(2) bars offline verification on behalf of another entity; a hash of the Aadhaar number may not be used as a reference key | Aadhaar is never mandatory and never stored; DigiLocker or Meri Pehchaan, or verification at a station; the earlier offline e-KYC route through an aggregator was retired; production Aadhaar e-KYC only through a State AUA/KUA after SWIK approval and a gazette notification |
| CERT-In directions of April 2022 (under the IT Act, 2000) | Logs of every system kept in India for 180 days; incidents reported within 6 hours; clocks synchronised to NIC or NPL | India-hosted, write-once log store; 180-day retention; NTP to NPL and NIC with a one-second start-up check; incident routing in the monitoring |
| Information Technology Act, 2000, and the CCA's eSign rules | A legally valid electronic signature | Device signatures are attribution evidence only; the complainant's s.173(1)(ii) signature and certificates use Aadhaar eSign through a CCA-licensed provider, or a signature at the station |
| Bharatiya Sakshya Adhiniyam, 2023, s.63 | A certificate with the hash value for electronic records given in evidence | SHA-256 of every clip and sealed report kept on the ledger; the backend renders BSA s.63 certificates from the ledger's records, to be eSigned by the responsible person |
| State FIR rules (for example the Delhi BNSS FIR Rules, 2025) | CCTNS is the legal FIR register; e-Sakshya is the evidence-capture system where notified; e-Forensics is the laboratory system | DigiFIR records the CCTNS FIR number and the FIR document's hash and anchors e-Sakshya and laboratory references; a daily reconciliation finds mismatches. Becoming the system of record needs a State Government Order and a CCTNS integration. |
| TRAI's DLT rules for commercial SMS | Registered entity, sender header and message templates | All SMS go through DLT-registered templates on the NIC SMS gateway; statutory notices are flagged and their delivery receipts kept |
| Guidelines for Indian Government Websites (GIGW 3.0) | Accessibility, security and content standards for government web applications | An audit is a go-live gate; the officials' console is already checked against WCAG 2.1 A and AA on every page in two languages |
| State Emblem of India (Prohibition of Improper Use) Act, 2005 | Restricts use of the State Emblem | The app logos carry the Emblem, so the apps are published only from the authorised department's developer account, or the logo is replaced |
| MeitY cloud empanelment and government hosting policy | Government data hosted in India | The pilot runs on NIC, NBF, a State Data Centre or a MeitY-empanelled cloud |
| Google Play policy on SMS permissions | SEND_SMS is restricted | The court and lab apps can open the Messages app instead (composer mode) for Play builds, or are distributed privately to managed devices |
Approvals the pilot needs
The regulatory items above turn into approvals with lead times: a State Government Order or MoU, India hosting, eSign provider onboarding, TRAI DLT registration, DigiLocker requester registration, GIGW and CERT-In audit clearance, and SWIK approval for Aadhaar e-KYC. External systems lists each with its approver, lead time and fallback.
Sources: digifir-backend docs/architecture/DECISIONS.md ADR-01 (C12), ADR-08, ADR-17 and ADR-20, docs/architecture/BACKEND.md sections 15.4 and 15.5, docs/PLAN.md section 6; the apps' docs/legal-references.md, docs/07-publish-play-store.md and the citizen app's docs/04-identity.md on the migration branch; digifir-backend docs/CONSOLE.md.