The Ministry of Finance has issued a notification on the Income-tax Rules, 2026 on March 20, 2026. The Rules will come into effect on April 1, 2026. The Rules were framed under the Income-tax Act, 2025, and they implement search and seizure powers provided in Section 247. As we approach a new system, an extension of search and seizure powers in the digital sphere sparks an...
The Ministry of Finance has issued a notification on the Income-tax Rules, 2026 on March 20, 2026. The Rules will come into effect on April 1, 2026. The Rules were framed under the Income-tax Act, 2025, and they implement search and seizure powers provided in Section 247. As we approach a new system, an extension of search and seizure powers in the digital sphere sparks an interesting constitutional issue: do we risk breaching the fundamental right to privacy as a State increasingly enters personal digital space? This is an issue of interest in an increasingly digital economy where financial transactions, records, and even ownership are increasingly digital rather than physical.
How do the Act and Rules expand digital search powers?
Section 247 of the Act is a clear shift from previous systems, as it specifically includes “information in electronic form or on a computer system” as a subject for search. It vests authority in the officers to not only search but also requires any person in control of electronic records to grant access. It further requires the person to provide technical assistance in the form of passwords or access codes. In case of denial of access, the officer is empowered to override the access controls. It further provides for the seizure of computer systems, which would allow the electronic records to enjoy the same status as the physical records of accounts and documents.
The procedural part of the search is regulated by Rule 148 of the Income Tax Rules, 2026. Sub-rule (8) of Rule 148 requires the person who is in possession or control of the computer system to allow access to the information contained therein. Sub-rule (9) of Rule 148 further reinforces the power by providing authority to the officer to take necessary action, overriding the password, if compliance is not provided.
However, the actual scope of the regulations can only be understood when interpreted with the Interpretation clause under Section 261. Section 261(e) extends the definition of "computer system" broadly, where "virtual digital space" is included. Section 261(j) further extends the scope of "virtual digital space" to cover the entire gamut of digital space, ranging from email servers to social media, online banking, investment accounts, websites containing information about ownership, cloud servers, digital application space, "any other space of similar nature."
It is, therefore, evident from the definitions and explanations provided for the scope of the regulations that the scope of the search has now become transformative. It is no longer limited to the physical space or objects. It is now extended to cover the entire digital space of an individual, which includes a wide array of space not physically located at the place of search. A device located at the premises can now access other servers or accounts remotely, thereby providing an expansive scope for the power of search.
Do these powers risk infringing on privacy?
The guidelines for the assessment of the constitutional validity of such powers were laid down by the Supreme Court in the case of Justice K.S. Puttaswamy v. Union of India, wherein it was held that the right to privacy is a fundamental right under Article 21 of the Constitution. It has to be noted that any invasion of the right to privacy by the State has to fulfill the following requirements: it has to be legal, legitimate, and proportionate. The legal requirement under Section 247 and Rule 148 is obviously fulfilled, but the question of necessity and proportionality is what is at the heart of the debate.
Digital searches are qualitatively different from physical searches in terms of their delicacy. A physical locker or almirah has only a limited number of articles. However, a computer system has years of personal and professional life, emails, financial transactions, personal communications, photographs, and many other documents. Accessing a computer system is not merely a search of property, but it is an invasion of the right to privacy of a person.
Moreover, the power to override access codes further adds to the concern. It is one thing to break open a physical lock and access a certain place, and quite another to break open a digital lock and access the entire data environment. This brings us to the concern of the authorities accessing information not only outside the scope of the investigation but also outside what is reasonable. There is no specific requirement in the law that the search has to be limited to only the relevant information, and there is no specific requirement in the law to exclude information of a personal nature not related to the financial transaction.
This brings us back to the concern of searches that may not meet the test of proportionality.
The addition of “virtual digital space” brings us back to the aforesaid concerns. The law specifically includes access to email accounts, social media, and cloud services. This brings us back to the concern of information of a very personal nature, which is not only beyond the scope of financial transactions but is also beyond the scope of what can be reasonably expected. This information is also likely to be stored remotely, possibly even beyond the boundaries of India. The access to this information through a device present at the search location can, therefore, possibly extend beyond the boundaries of a search.
What safeguards exist, and what lies ahead?
Rule 148 provides a list of procedural safeguards that have been traditionally provided in search and seizure cases. This includes the need to obtain prior authorization and to conduct searches in the presence of independent witnesses, and to draw up detailed lists of seizures. However, while these safeguards are undoubtedly important, they may not necessarily be effective in the digital context.
In the digital context, it is also noticeable that there is a lack of safeguards in this context. There is no requirement to follow data minimization policies—i.e., to access only that data which is relevant to the case. There is no requirement to differentiate between personal and professional data or to avoid accessing irrelevant data. There is also no requirement to follow forensic search techniques, including creating mirror images of digital devices and storing hash values to authenticate digital evidence. Such a lack of safeguards not only violates the right to privacy but also impacts the admissibility of evidence under the Bharatiya Sakshya Adhiniyam, 2023.
As this new set of Rules comes into effect on April 1, 2026, it will be interesting to see how this power is exercised in practice. The extension of search powers is a recognition of the digital economy, where undisclosed income may not be in physical form but in digital form. However, it is also necessary to follow constitutional imperatives that require powers to be exercised in a manner that is necessary and proportionate and in a manner that respects individual rights.
The issue here is not so much whether or not the State has the power to conduct digital searches but how far this power extends without violating individual rights to privacy. This will likely be determined over time through case law and administrative practice. As India increasingly becomes a data-driven society, it will be interesting to see how this power is exercised in practice and how it balances the constitutional guarantee to individual rights to privacy.
Author is an Assistant Professor at the School of Law, Justice & Governance, Gautam Buddha University. Views are personal.