BNSS Rules, 2025 (Electronic Evidence)

The Bharatiya Nagarik Suraksha Sanhita (BNSS) Rules, 2025 establish procedures for collection, preservation, and presentation of electronic evidence in criminal proceedings. They prescribe standards for digital forensics, chain of custody, and obtaining data from intermediaries and service providers. Organisations must navigate the intersection between data protection obligations and the duty to preserve and produce electronic evidence.

When electronic evidence is required for legal proceedings, organisations may need to preserve personal data that would otherwise be subject to DPDPA's data minimisation and retention limits. Section 7(e) of the DPDPA provides for processing necessary for compliance with judgments, decrees, or orders issued under any law in India. This creates a specific exception to the general erasure and minimisation principles - data that is subject to legal hold or preservation orders must be retained regardless of DPDPA retention limits.

Digital forensic investigations often involve broad access to systems containing personal data. The BNSS Rules prescribe chain of custody requirements that may at first appear to conflict with DPDPA's access control principles. However, Section 17(1)(c) of the DPDPA provides a near-total exemption for the 'prevention, detection, investigation or prosecution of any offence,' meaning that most DPDPA obligations (Notice, Consent, Rights) do not apply during a criminal investigation - which substantially reduces the conflict in practice. Organisations should still: (a) implement protocols for responding to legal data requests; (b) segregate forensic copies from operational systems; (c) ensure that forensic access is documented and limited to what is legally required; and (d) maintain records demonstrating the legal basis for any data preservation.

To reconcile BNSS and DPDPA requirements: (a) establish a legal hold policy that activates when litigation or investigation is anticipated; (b) train relevant staff on evidence preservation obligations; (c) ensure IT systems support selective preservation without over-collection; (d) document the legal basis for all data preserved beyond DPDPA retention limits; and (e) review and release preserved data when the legal obligation ceases.