As India’s data protection regime moves from legislation to enforcement, businesses are increasingly treating cyber insurance as a ready answer to their compliance worries. The Digital Personal Data Protection Act, 2023 (“DPDP Act”) became operational once the DPDP Rules were notified in November 2025, with phased implementation expected through 2027, and insurers are already reporting a sharp rise in enquiries as companies rush to shore up their risk cover.
This growing appetite for cyber insurance is a welcome development. However, a closer reading of the DPDP Act’s penalty framework, coupled with how commercial insurance policies actually operate in India, reveals a persistent and potentially costly misunderstanding among businesses that a cyber insurance policy can substitute for genuine data protection compliance. It cannot, and the scale of DPDP Act penalties, along with the peculiarities of Indian insurance law, make this distinction especially important for Indian businesses to grasp.
Chapter VIII of the DPDP Act, particularly Sections 33 and 34, sets out a stringent penalty regime enforced by the Data Protection Board of India (“Board”), a statutory authority empowered to inquire into personal data breaches and impose financial penalties on erring data fiduciaries. Penalties range from INR 10 crore for administrative lapses, such as failing to appoint a Data Protection Officer, to INR 200 crore for failing to implement reasonable security safeguards, and up to INR 250 crore for non-compliance with Board directions, capped overall at INR 500 crore per instance.
Unsurprisingly, insurers have reported a marked increase in demand for cyber insurance since these penalty provisions came into sharper focus, with businesses now treating such cover as a necessity rather than an optional add-on. Yet a large proportion of eligible businesses, particularly small and mid-sized enterprises, remain uninsured or under-insured, exposing a gap between growing awareness and actual preparedness.
At its core, cyber insurance is a mechanism of risk transfer. It shifts the financial burden of a cyber incident, such as forensic costs, business interruption, or third-party liability, from the insured business to the insurer, for a premium. Data protection compliance, by contrast, is a legal mandate, requiring businesses to implement safeguards such as consent management, breach notification protocols, and data protection impact assessments, regardless of whether they hold insurance.
These two concepts operate on different planes. A well-structured policy can soften the financial blow of a breach, but it does not extinguish the underlying statutory obligation to prevent that breach in the first place. Businesses that conflate the two often discover, only after a breach occurs, that purchasing a policy did nothing to reduce their regulatory exposure under the DPDP Act.
A recurring point of friction between policyholders and insurers arises from exclusions relating to negligence and inadequate security controls. Insurers increasingly scrutinise an applicant’s cybersecurity maturity before underwriting, and many policies now require documented proof of security controls, logging, monitoring, and incident response readiness as a condition of coverage.
Where a breach results from an organisation’s failure to maintain such baseline safeguards, insurers may treat this as negligence or gross misconduct falling outside the scope of the policy. Without adequate documentation of active security governance, claims may be reduced, delayed, or denied altogether. Insurers are beginning to expect the very compliance discipline some businesses assume the policy itself will excuse them from maintaining.
Perhaps the most significant misconception concerns whether regulatory fines under the DPDPA can be covered by insurance at all. Commercial cyber insurance in India typically operates through first-party coverage, addressing the policyholder’s own losses, and third-party liability coverage, addressing claims by affected individuals or entities. Within third-party coverage, insurers may offer defence cost coverage during regulatory proceedings and, in limited circumstances, coverage for certain fines where legally permissible.
However, Indian public policy principles generally disfavour the insurability of penalties arising from an organisation’s own wilful default, intentional misconduct, or gross negligence. Even where a policy nominally extends to regulatory fines, insurers are likely to resist indemnifying penalties stemming from a deliberate or reckless failure to comply with the DPDP Act. Businesses must therefore scrutinise policy wordings closely, particularly exclusions relating to intentional acts and statutory non-compliance, rather than assuming a large sum insured automatically translates into fine-shielding.
The Insurance Regulatory and Development Authority of India (“IRDAI”) has itself signalled the direction of travel. Its revised Information and Cyber Security Guidelines tighten governance expectations for insurers, mandating board-level oversight, an independent Chief Information Security Officer, and continuous monitoring rather than one-time audits. This logic increasingly filters down to policyholders: insurers underwriting cyber risk expect the businesses they cover to demonstrate ongoing, documented compliance, not a static, one-time security assessment.
For Indian businesses, cyber insurance is best understood as one layer within a broader risk management strategy, sitting alongside, and never replacing, lawful consent mechanisms, data governance frameworks, breach response procedures, vendor oversight, and employee training required under the DPDP Act. A cyber risk assessment, reviewed periodically as regulatory expectations evolve, remains essential to determining appropriate coverage limits and identifying vulnerabilities before an insurer, or the Board, identifies them first.
As India’s data protection enforcement architecture matures, businesses must resist the temptation to treat cyber insurance as a proxy for compliance. Risk transfer and legal mandate serve different purposes, and the growing sophistication of Indian insurers in scrutinising security posture at underwriting makes negligence-based exclusions a real threat to inadequately prepared policyholders. Equally, public policy limits on insuring wilful defaults mean that DPDP Act penalties cannot always be transferred away, however comprehensive the policy may appear on paper. The most resilient businesses will build genuine compliance infrastructure first, and layer cyber insurance on top as a financial safety net, rather than the other way around. As DPDP Act scrutiny intensifies, the real question may not be how much coverage a business can buy, but how well it can demonstrate, to regulators and insurers alike, that it was compliant all along.
For any queries or feedback, feel free to connect with mridusha.guha@amlegals.com or Khilansha.mukhija@amlegals.com
The Hon’ble Supreme Court has recently clarified that Section 74 of the CGST Act cannot be invoked merely by reproducing the expressions “fraud”, “wilful misstatement” or “suppression of facts”. Where the Department seeks to invoke the extended period of limitation, the show-cause notice (“SCN”) must disclose the material facts and circumstances which form the basis for such an allegation.
In M/s G.R. Infra Projects Limited, Ratlam v. State of Madhya Pradesh & Ors., Civil Appeal No. 11277 of 2026, the Supreme Court set aside the Section 74 SCN, holding that a mere “bland statement” alleging fraud or concealment, without setting out the underlying facts, cannot justify invocation of the extended limitation. The principle was reiterated in M/s Tata Steel Limited v. Union of India, Civil Appeal arising out of SLP (C) No. 16859 of 2026, decided on 25 August 2026, where the Court held that mechanically reproducing the statutory expressions does not, by itself, establish the basis for proceeding under Section 74. The proper officer must arrive at the requisite conclusion on the basis of material available on record.
These decisions are particularly important where the ordinary limitation under Section 73 has expired or is nearing expiry. The Department cannot overcome limitation merely by invoking Section 74 in general terms. The SCN must itself disclose the specific facts and material forming the basis of the allegation, failing which the invocation of the extended period becomes legally vulnerable.
In G.R. Infra Projects, the Department issued an SCN dated 13 June 2025 for FY 2018–19, invoking Section 74 after the period under Section 73 had expired. The Department relied on investigation material, including summons, inspection and statements, but the SCN itself merely alleged “fraud or concealment of facts” without explaining the basis for such allegation. The Supreme Court held that subsequent explanations in the Department’s counter-affidavit could not cure the defects in the SCN and set aside the notice, observing that the factual basis for invoking Section 74 must appear from the SCN itself.
Tata Steel reinforces the same principle. There, Section 74 was invoked for FY 2018–19 to 2020–21 on the basis of an audit objection concerning alleged ITC mismatch and short payment of tax. The Supreme Court examined whether the material on record actually justified resort to the extended limitation under Section 74, thereby reaffirming that Section 74 cannot be invoked mechanically and must be supported by material establishing the statutory grounds for the extended period.
The Hon’ble Supreme Court in G.R. Infra Projects held that the extended limitation under Section 74 is conditional upon the existence of fraud, wilful misstatement or suppression of facts, and cannot be invoked by mechanically reproducing the statutory language. The SCN itself must disclose the facts and circumstances forming the basis for such allegations. A mere “bland statement” of fraud or concealment, without explaining how the inference arose, is insufficient. The Court further held that the Department cannot supplement an otherwise defective SCN through its counter-affidavit. Since the proceedings under Section 73 were time-barred and the SCN lacked the foundational allegations necessary for Section 74, the SCN was set aside.
The principle was reaffirmed in Tata Steel, where the Supreme Court held that proceedings under Sections 73 and 74 require independent satisfaction of the proper officer. In Section 74 proceedings, an ITC mismatch or short payment alone is insufficient; the officer must be satisfied that it occurred due to fraud, wilful misstatement or suppression of facts. An audit objection cannot, by itself, substitute such satisfaction, nor does the GST framework recognise a “protective assessment” merely to overcome limitation. The SCN and consequential order were accordingly set aside, with liberty to initiate fresh proceedings under Section 74 only if permissible in law and supported by foundational facts.
The judgments in G.R. Infra Projects and Tata Steel safeguard against the mechanical invocation of the extended limitation under Section 74 of the CGST Act. The Supreme Court clarified that a mere tax short payment, ITC mismatch or audit objection does not, by itself, justify Section 74 proceedings. The proper officer must independently satisfy himself that the non-payment or short payment resulted from fraud, wilful misstatement or suppression of facts, and the SCN itself must contain the foundational facts supporting such satisfaction.
Importantly, where Section 73 proceedings are time-barred, the Department cannot merely reproduce the statutory expressions of fraud or suppression to invoke the extended limitation under Section 74. A defective SCN cannot subsequently be cured through counter-affidavits or other pleadings.
Thus, Section 74 is not a mechanism to overcome limitation under Section 73. Its invocation must be supported by specific factual allegations, a causal connection with the alleged tax shortfall, and proper application of mind by the proper officer. Conversely, where the SCN specifically explains what was suppressed, how it was suppressed, and how it resulted in non-payment or short payment of tax, the statutory requirements may be satisfied.
For any queries or feedback, feel free to connect with Hiteashi.desai@amlegals.com
In Babu Ram v. State of Rajasthan & Ors. Civil Writ Petition No. 17812/2026, the Rajasthan High Court set aside the termination of a government employee whose services were brought to an end solely on the strength of a subsequent medical board assessment that recorded a lower degree of disability than two earlier certificates on which his appointment and confirmation had rested. The Bench of Justice Mukesh Rajpurohit held that a mere variation between successive, independently valid disability assessments cannot, by itself, be treated as proof that the employee had practised fraud in securing employment.
The judgment is significant for clarifying that a certificate issued under the statutory framework of the Rights of Persons with Disabilities Act, 2016 continues to hold legal effect until it is displaced through the procedure the statute itself prescribes, and that an administrative authority cannot simply treat an earlier certificate as extinguished because a later medical opinion happens to differ from it.
The petitioner was issued a disability certificate in 2018 by the Chief Medical and Health Officer, Barmer, assessing more than 40% disability in his lower limb. On the strength of this certificate, he participated in the recruitment process for the post of Village Development Officer under the reserved category for persons with disabilities, was declared successful, and was posted in District Sirohi.
In 2023, he was examined afresh by a Medical Board of the Government District Hospital, Sirohi, which certified his disability at almost 50%. He was subsequently transferred to District Barmer, where he completed his probation period and his services were confirmed in the ordinary course.
Thereafter, upon a direction for re-examination issued by the Department of Personnel and the Department of Rural Development and Panchayati Raj, the petitioner was once again examined, this time by the Medical Board of the District Hospital, Barmer, in 2026. This assessment placed his disability at only 30.5%, below the threshold on which his original appointment had been premised. Relying solely on this 2026 report, the respondent-authorities terminated his services by a simpliciter administrative order, without issuing either the assessment report or a show-cause notice to him, and without affording him any opportunity of hearing. The petitioner challenged this termination before the High Court.
The Court held that the 2026 assessment could not, on its own, conclusively establish that the earlier certificates of 2018 and 2023 were false, forged, or fraudulently obtained, particularly in the absence of any finding or allegation of fraud, fabrication, or misrepresentation against the petitioner.
It observed that a certificate issued under the statutory framework of the Rights of Persons with Disabilities Act, 2016 is not a document that an administrative authority can simply disregard without examining its legal status, and that the statutory scheme itself contemplates a mechanism for questioning the decision of a certifying authority.
Accordingly, if the respondents were of the view that the earlier certificate required reconsideration, the matter had to be dealt with in accordance with that statutory framework and applicable procedure, rather than by treating the later medical opinion as automatically displacing the earlier one.
The Court further emphasised that the petitioner’s case stood on a materially different footing from one where an employee is found to have secured employment through a forged certificate or a deliberate false representation, no such allegation had been made against him. Coupled with this, the Court took note of the clear breach of natural justice: the petitioner, having been confirmed in service, had acquired the protections attached to that status, and a subsequent disability assessment of 30.5%, unaccompanied by any finding of fraud, fabrication, misrepresentation, or manipulation, could not by itself justify termination through a simpliciter administrative order.
The termination order was accordingly set aside, and the petitioner was directed to be reinstated to the post of Village Development Officer. The Court, however, clarified that this did not foreclose the State from undertaking verification proceedings in respect of the petitioner’s earlier disability certificates, in accordance with law. The petition was allowed
The judgment reinforces an important procedural safeguard for persons with disabilities in service: the legal effect of a validly issued disability certificate cannot be treated as automatically nullified merely because a later assessment yields a different figure. Disability, particularly in orthopaedic and similarly progressive or fluctuating conditions, can genuinely vary in degree over time for reasons unconnected with any misrepresentation at the time of the original certification, a point the Court implicitly recognised in insisting that any challenge to an earlier certificate be routed through the statutory mechanism rather than short-circuited by administrative fiat.
For any queries or feedback, feel free to connect with Hiteashi.desai@amlegals.com or Khilansha.mukhija@amlegals.com
On 13 May 2026, RBI introduced a new framework for facilitating outward remittances through non-bank entities in partnership with Authorised Dealer (AD) Category-I banks. The significant change was simple: non-bank entities no longer need prior RBI approval for such tie-ups. Instead, banks can enter into these arrangements within a prescribed regulatory framework.
This could appear to be merely another regulatory relaxation at first. However, it poses a much more significant question: should regulation become simpler or just more intelligent as fintech simplifies financial services?
Fintech platforms wanting to facilitate outward remittances through an AD Category-I bank faced an additional regulatory hurdle: the arrangement itself required RBI’s prior approval. That meant that even where the bank and the fintech were otherwise ready to work together, the partnership could not simply proceed without regulatory clearance. The new framework changes that approach. Instead of asking RBI for permission every time such a partnership is proposed, eligible non-bank entities can now work with AD Category-I banks subject to the conditions laid down by RBI.
The RBI has not abandoned regulation. Instead, it has shifted part of the accountability from obtaining prior authorization to maintaining compliance. While the AD bank continues to be the regulated organization between the customer and the foreign exchange system, the fintech sector has more space to develop. This is particularly relevant because the customer may not even realise where the “banking” part of the transaction begins. For them, the remittance may simply involve opening an app, entering the beneficiary details, checking the exchange rate and pressing “send”. Behind that seemingly simple transaction, however, sits a complex FEMA and banking framework.
The relaxation does not mean that fintech platforms can now operate without regulatory safeguards. AD Category-I banks continue to be responsible for ensuring compliance with the Foreign Exchange Management Act, 1999, applicable RBI directions, KYC and anti-money laundering requirements, customer protection standards and cybersecurity requirements. The framework also requires transparency regarding exchange rates, charges and transfer timelines.
The fact that remitter monies cannot be routed through third-party accounts in India is one very crucial safety measure. This is important because the ease of digital payments can occasionally mask the actual flow of money. Traceability becomes a regulatory need rather than just a technological one when a transaction crosses international borders. Therefore, the RBI’s diminution of expectations is not the true change. It has changed when and how those expectations are enforced.
This is where the framework becomes particularly interesting. A customer making a remittance may interact almost entirely with a fintech platform. The platform may handle the interface, customer communication and transaction journey, while the AD bank technically facilitates the foreign exchange transaction. Suppose a customer is misled about charges, a transaction is incorrectly processed, customer data is compromised or a remittance is delayed because of a compliance failure. Will the customer see the fintech as responsible, the bank as responsible, or both. RBI’s framework places significant responsibility on the AD bank. This makes sense from a regulatory perspective because banks remain the entities authorised to deal in foreign exchange. However, it also means that banks cannot treat fintech partnerships as merely technological arrangements.
Due diligence, monitoring, contractual safeguards and clear allocation of responsibilities become essential. For fintechs, this could mean that the easier entry into the market comes with a different kind of responsibility: the need to operate within the bank’s compliance architecture rather than outside it.
RBI appears to be moving towards a model where regulation does not necessarily prevent a transaction from happening but ensures that someone remains accountable when it does. This is an increasingly relevant approach for fintech regulation. Financial services are no longer delivered exclusively by traditional banks. Technology companies, payment platforms and digital intermediaries are becoming part of the financial chain. Requiring regulatory approval at every stage may slow innovation, but removing oversight altogether can create obvious risks.
The middle path is therefore risk-based regulation: let innovation move quickly, but make accountability move with it. For consumers, the benefits could be significant. For Indians sending money overseas, more fintech-bank alliances might mean greater flexibility, possibly reduced fees, and a seamless experience. Eliminating an extra permission layer could encourage the introduction and expansion of remittance solutions for companies.
But the success of the reform will ultimately depend on implementation. If banks respond by creating their own layers of excessive internal approvals, the practical benefit of RBI’s relaxation could be limited. However, the dangers of fraud, money laundering, cybersecurity breaches, and improper use of remittance channels may rise if compliance becomes overly lax.
RBI’s May 2026 framework reflects a broader regulatory trend: facilitating innovation by removing unnecessary procedural barriers while retaining accountability within the regulated financial system. It recognises the commercial reality that customers increasingly access financial services through fintech interfaces rather than traditional banking channels. The reform is therefore less about deregulation and more about redistribution of regulatory responsibility. Fintechs receive greater room to participate, while AD banks remain the principal compliance anchors.
Its long-term success will depend on whether this balance can be maintained. A flexible regulatory framework must still ensure that cross-border payments remain transparent, secure and traceable. If RBI’s approach succeeds, the reform could provide a useful model for regulating fintech partnerships more broadly: fewer ex ante permissions, but stronger continuing accountability.
For any queries or feedback, feel free to connect with Dhwani.tandon@amlegals.com
The internet has made Child Sexual Abuse Material (hereinafter referred to as “CSAM”) a profoundly transnational crime. A child may be located in India, the offender may operate from another jurisdiction, the platform may be incorporated in the United States, and the relevant electronic evidence may be stored across multiple servers. Yet, investigations continue to be constrained by legal frameworks built around territorial sovereignty, with cross-border evidence requests still largely routed through slow-moving instruments such as the India-US Mutual Legal Assistance Treaty in Criminal Matters officially known as “Treaty Between the Government of the Republic of India and the Government of the United States of America on Mutual Legal Assistance in Criminal Matters.”
This tension has recently come into sharper focus following concerns that India may need a formal data-sharing arrangement with the US to strengthen investigations into online CSAM. Reportedly, major US-based technology platforms continue to route reports concerning suspected CSAM through the US-based National Centre for Missing & Exploited Children (hereinafter referred to as “NCMEC”), while Indian authorities seek timely reporting and access to information necessary for domestic investigations. The issue is not merely one of technological cooperation. It represents a conflict between India’s interest in enforcing its criminal and intermediary obligations under statutes such as the Protection of Children from Sexual Offences Act, 2012 and the Information Technology Act, 2000, and the legal restrictions governing disclosure of data under US law, principally the Stored Communications Act.
The current reporting ecosystem is more complicated than it initially appears. Under US law, providers that become aware of certain apparent violations involving child sexual exploitation are required to report them to NCMEC’s CyberTipline, as mandated by Section 2258A of Title 18 of the United States Code. NCMEC functions as a clearinghouse and makes relevant reports and supplemental information available to appropriate domestic and foreign law-enforcement agencies. Significantly, the US statutory framework expressly contemplates the forwarding of reports to qualifying foreign law-enforcement agencies.
For India, however, the difficulty lies in the route through which information reaches domestic investigators. A suspected incident detected by a platform may travel from the platform to NCMEC, following which the report is routed through the relevant international law-enforcement mechanism before reaching the appropriate Indian agency. While NCMEC has maintained that its systems enable secure and rapid sharing, the recent concerns reported regarding possible delays demonstrate that the existence of a reporting mechanism is not equivalent to the existence of an efficient investigative mechanism.
In crimes involving children, this distinction is crucial. Digital evidence can disappear, accounts can be deleted, offenders can migrate across platforms and a delay in identifying a victim may mean continued exploitation. The legal system must therefore examine not only whether information is eventually shared, but also whether the reporting architecture is sufficiently transparent, accountable and swift.
India’s position is rooted in a legitimate concern. A platform operating in India cannot necessarily treat reporting to a foreign organisation as a complete substitute for obligations imposed by Indian law, particularly the reporting and record-preservation duties under Section 15 of the POCSO Act and Section 67B of the Information Technology Act, 2000, read with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. As reflected in the recent debate, Indian authorities have emphasised that suspected offences requiring reporting and investigation within India cannot be addressed solely by sending information into a foreign reporting ecosystem.
The platforms, however, confront a competing legal reality. Information held by US-based electronic service providers is subject to US law, including restrictions governing the disclosure of stored communications, principally the Stored Communications Act, 18 U.S.C. § 2701 et seq. The US framework does not simply permit a company to disregard domestic restrictions because another jurisdiction demands data. Section 2258A itself structures the reporting process around NCMEC and limits certain disclosures by providers, while also recognising disclosures to specified law-enforcement agencies and in response to legal process.
This creates what may be described as a compliance paradox. India may require meaningful cooperation with domestic authorities, while the platform may argue that directly transmitting particular categories of information to those authorities would expose it to legal constraints in the US.
The answer to this paradox cannot simply be to prosecute a local subsidiary and assume that criminal proceedings will produce data controlled elsewhere. Jurisdiction over a company is not always equivalent to practical control over the data sought. A local entity may not possess the relevant servers, accounts, communications or technical records. Consequently, domestic coercive measures, such as a notice for production of documents or electronic records under Section 94 of the Bharatiya Nagarik Suraksha Sanhita, 2023, or directions issued under Section 69 of the Information Technology Act, 2000, may establish legal accountability without necessarily solving the evidentiary problem.
The current discussion risks producing a false binary: either platforms directly hand over all information to Indian authorities, or India remains dependent upon a foreign intermediary. Neither position is entirely satisfactory. Direct and unrestricted access to platform data could undermine safeguards relating to privacy, legality and due process. At the same time, an opaque reporting chain in which authorities cannot identify where a report is delayed creates an equally serious accountability deficit.
Therefore, simply demanding “more data” may not be the correct policy response. India requires better access to legally obtainable, timely and actionable evidence, supported by a clear chain of responsibility.
A formal India-US arrangement, of the kind the US CLOUD Act, 2018 enables through bilateral executive agreements between the US and qualifying foreign governments, could provide that missing legal bridge. However, such an agreement should not be conceived as an unrestricted mechanism through which Indian authorities obtain direct access to all data held by US technology companies. Its objective should instead be to establish a predictable framework for serious investigations involving defined offences, particularly child sexual exploitation. The framework could clarify the competent authorities, categories of permissible information, standards for requests, emergency procedures, preservation obligations and timelines for response.
Importantly, it could also address the gap between reporting and investigation. A CyberTip may alert authorities to suspected CSAM, but an effective prosecution may subsequently require additional subscriber information, account data, preservation of relevant records or other electronic evidence. These are distinct stages requiring different legal mechanisms.
The recent proposal regarding “supplementary tips” is relevant in this context. Where platforms cannot directly share protected content or communications with Indian authorities, they may potentially assist investigations through lawfully shareable metadata or other information relating to India-connected reports. Such a model recognises an important principle: legal cooperation need not begin only after every cross-border disclosure issue has been resolved. Information that can lawfully be shared may still enable investigators to preserve evidence, identify jurisdiction and initiate urgent protective action.
The demand for stronger action against online CSAM is unquestionably justified. However, the present controversy demonstrates that platform liability alone cannot resolve a structural problem of cross-border evidence. India can impose obligations upon intermediaries operating within its jurisdiction under the Information Technology Act, 2000 and the POCSO Act, 2012, but digital evidence does not necessarily remain within that jurisdiction merely because the service is available there.
A formal India-US data-sharing arrangement may therefore be necessary, not as a concession to technology companies, but as recognition that cross-border crime requires cross-border legal infrastructure. Yet, the agreement must be designed around more than access. It must ensure speed without arbitrariness, cooperation without surrendering sovereignty and child protection without weakening privacy and due process.
The question, therefore, is no longer whether India can demand more from global platforms. The more difficult and important question is whether India and the US can build a legal bridge capable of making child protection effective across borders without turning cross-border cooperation into borderless state access to personal data.
For any queries or feedback, feel free to connect with mridusha.guha@amlegals.com or Khilansha.mukhija@amlegals.com
The question of whether the Government can retain an amount collected as tax despite the absence of a lawful statutory liability has repeatedly arisen under the erstwhile service tax regime. The issue becomes particularly significant where tax has been paid under an erroneous classification and the assessee subsequently establishes that the underlying activity was not taxable under the relevant category during the disputed period. In such circumstances, the Revenue has frequently relied upon the statutory limitation prescribed for refund claims to resist repayment of the amount.
The decision of the Customs, Excise and Service Tax Appellate Tribunal (“CESTAT”), Chennai in Commissioner of Service Tax, Chennai v. Hardy Exploration & Production (India) Ltd., Final Order No. 43135/2018, decided on 15.11.2018, provides an important illustration of this issue. The Tribunal examined the taxability of services relating to floating rigs and, after finding that the activity had been incorrectly classified as “Mining Service”, considered whether the refund could nevertheless be denied on the ground of limitation under Section 11B of the Central Excise Act, 1944.
The dispute in Hardy Exploration & Production (India) Ltd. arose in the context of petroleum exploration activities. Hardy Exploration & Production (India) Ltd. had entered into a production-sharing arrangement for petroleum operations and had obtained a floating rig from Aban Offshore Ltd. Service tax was charged on the transaction under the taxable category of “Mining Service”.
The relevant period was from 1.06.2007 to 15.05.2008. Hardy subsequently disputed the classification adopted for the transaction and contended that the supply of the floating rig could not legally be classified as “Mining Service” during the relevant period. According to the assessee, the transaction was more appropriately covered by “Supply of Tangible Goods Service”, which became taxable only with effect from 16.05.2008. The distinction was therefore material because, if the transaction fell within “Supply of Tangible Goods Service”, the same could not be subjected to service tax under that category before the date on which the taxable service was introduced.
Hardy consequently sought refund of approximately Rs. 13.88 crore which had been paid as service tax under the disputed classification. The classification issue had also been considered in the context of similar petroleum-related transactions in Indian National Shipowners’ Association v. Union of India, ultimately establishing the relevance of the distinction between “Mining Service” and “Supply of Tangible Goods Service”. The Commissioner (Appeals) accepted the assessee’s position and found that the floating rigs supplied by Aban for the relevant activities were not taxable under “Mining Service” during the disputed period. The refund claim was accordingly allowed. The Revenue challenged the order before the CESTAT.
The principal issues before the Tribunal were:
The first question before the Tribunal concerned the correct classification of the activity undertaken through the floating rigs. The Revenue sought to sustain the levy by treating the activity as “Mining Service”. The assessee, however, contended that the transaction was covered by “Supply of Tangible Goods Service”, a taxable category introduced only with effect from 16.05.2008. The classification was significant because the relevant statutory entry had to exist during the period for which the tax was sought to be collected. The mere fact that the activity was connected with petroleum exploration could not, by itself, bring the transaction within every taxable category associated with mining or exploration.
The Tribunal accepted the assessee’s position and proceeded on the basis that the activity did not fall within “Mining Service” during the relevant period. Consequently, the service tax collected under that classification lacked the necessary statutory foundation. The finding on classification therefore became decisive for the subsequent question of refund.
The Revenue’s principal defence was based upon Section 11B of the Central Excise Act, 1944. The provision prescribes a limitation period for claiming refund of duty or tax. The Revenue argued that the refund claim could not be entertained beyond the statutory period and that the assessee could not circumvent the limitation requirement merely by contending that the tax had been paid under an erroneous classification.
The Tribunal, however, distinguished between an ordinary delayed refund claim and a claim arising from an amount which was never legally payable as tax in the first place. Once the Tribunal had concluded that the activity was not taxable under “Mining Service” during the relevant period, the character of the payment itself became relevant. The amount could not simply be treated as a valid tax merely because it had been collected and deposited with the Government. The Tribunal consequently examined the issue in light of the constitutional limitation contained in Article 265.
Article 265 of the Constitution provides that “No tax shall be levied or collected except by authority of law.” The constitutional principle becomes particularly important in cases involving erroneous classification. A tax liability must arise from legislation. It cannot be created merely because an assessee or service provider mistakenly treats an activity as taxable under a particular category.
The Madras High Court directly considered this principle in 3E Infotech Ltd. v. CESTAT, 2018 (18) G.S.T.L. 410 (Mad.). The Court examined a refund claim where service tax had been paid under a mistake of law despite the absence of a statutory liability. It held that the Government could not retain an amount which was never legally payable merely because the statutory limitation period had expired.
The Court recognised that limitation is a procedural mechanism governing the exercise of a refund remedy and cannot itself create substantive authority for the Government to retain an amount that was collected without authority of law.
The distinction between limitation and substantive tax liability is central to the judgment. Section 11B regulates the procedure and period within which a refund claim ordinarily has to be made. However, it does not independently confer a taxing power upon the State. The expiry of a limitation period cannot retrospectively convert an amount that was never lawfully payable into a valid tax.
In other words, limitation can regulate a remedy, but it cannot create a levy. Where tax was legally payable and an assessee seeks refund after the prescribed period, Section 11B may operate as a statutory bar. However, the position is materially different where the assessee establishes that the payment arose from a mistake of law and that the underlying activity was never taxable under the classification relied upon by the Revenue. In such a situation, allowing the Revenue to retain the amount merely because the refund claim was delayed would effectively permit a procedural rule to provide the substantive authority for a collection which Article 265 does not permit.
The decision also reinforces an important principle of indirect taxation: classification does not merely determine the rate or manner of taxation; it determines whether the statutory charging provision applies to the transaction at all. In the present case, “Supply of Tangible Goods Service” became taxable with effect from 16.05.2008. If the activity was correctly covered by that category, it could not simply be brought within “Mining Service” for an earlier period merely because the transaction was connected with petroleum exploration.
The Government’s taxing power must therefore be traced to the relevant statutory provision applicable during the relevant period. Administrative treatment, an assessee’s mistaken payment or an incorrect classification cannot independently expand the scope of a charging provision. Once the classification adopted by the Revenue fails, the legal foundation of the collection must necessarily be reconsidered.
The judgment should not, however, be understood as establishing that every refund claim filed beyond the period prescribed under Section 11B is automatically maintainable. The principle is narrower and depends upon the substantive legality of the levy. Where tax was legally payable but the assessee subsequently seeks refund after the expiry of the statutory limitation period, Section 11B may continue to apply. The constitutional exception becomes relevant where the assessee demonstrates that the amount was paid under a mistake of law and that there was no legal authority for the original collection.
Thus, the decision does not eliminate limitation. Rather, it prevents limitation from being used as a substitute for the absence of a lawful tax liability.
The CESTAT accepted the position that the activity involving the floating rigs was not taxable under “Mining Service” during the disputed period. Having reached that conclusion, the Tribunal held that the service tax collected under the erroneous classification could not be treated as a lawful levy merely because the refund claim was subject to the limitation prescribed under Section 11B. The Tribunal relied upon the principle laid down in 3E Infotech and recognised that the Government could not retain an amount collected without authority of law by merely invoking limitation. The Revenue’s challenge to the refund was therefore rejected and the assessee succeeded in obtaining the benefit of the refund.
The decision in Hardy Exploration & Production (India) Ltd. is significant in reaffirming that a procedural limitation cannot become a substantive source of taxing power. The case demonstrates that the first question in a refund dispute must be whether the amount was lawfully chargeable in the first place. Where an activity is wrongly classified and tax is collected under a category that does not legally apply, the Revenue cannot simply rely upon the expiry of the refund period to legitimise the collection.
The judgment serves as a reminder that taxation must remain anchored in the statutory charging provision. The mere fact that an amount has been collected, reflected in an invoice or deposited with the Government cannot, by itself, establish the existence of a lawful tax liability.
Ultimately, the decision reinforces a fundamental constitutional proposition: misclassification cannot create a lawful levy, and limitation cannot cure the absence of authority of law. Where the substantive tax liability itself fails, the procedural defence of limitation cannot, by itself, provide the Revenue with a legal basis to retain the amount.
Team AMLEGALS assisted by Ms Anisha Joshi (Intern)
For any queries or feedback, feel free to connect with Dhwani.tandon@amlegals.com
The Hon’ble Supreme Court, in R.J. Gajendra Kumar v. Government of Tamil Nadu & Anr., 2026 INSC 911, has reiterated that amendments to Government Orders (“GOs”) modifying existing service conditions must be interpreted reasonably so as to avoid unnecessary hardship to persons who had no control over the subsequent change in the governing framework.
The judgment arose from a dispute concerning the eligibility of a government employee for promotion where his educational qualifications had been acquired through distance education under the rules prevailing at the relevant time. The subsequent introduction of stricter qualification requirements was sought to be applied retrospectively to deny him the benefit of promotion.
The Hon’ble Supreme Court held that a subsequent amendment or clarification cannot retrospectively invalidate a qualification which was validly acquired under the rules applicable when such qualification was obtained. The Court further reiterated that statutory rules are presumed to operate prospectively unless retrospective operation is expressly provided or necessarily implied.
The Appellant, Mr. R.J. Gajendra Kumar, was appointed as a Junior Assistant in the Tourism Department of the Government of Tamil Nadu in 1983 on compassionate grounds following the death of his father, who was also employed in the Department.
At the relevant time, the prevailing framework permitted employees to pursue higher education through distance education. The Appellant accordingly completed a foundation course and subsequently obtained a B.Com. degree through Madurai Kamaraj Open University through the distance education mode. The Government of Tamil Nadu subsequently issued various Government Orders concerning the recognition and equivalence of qualifications obtained through distance education. G.O. Ms. No. 180 dated 11.09.2000, in particular, recognised diploma, graduation and post-graduation courses obtained through distance education from recognised universities as equivalent to regular courses for purposes of employment in public services. The Appellant was thereafter promoted as Tourist Officer in 2011 and his service was regularised. His eligibility for the post was not questioned for several years.
However, when the Appellant sought promotion to the post of Assistant Director of Tourism, the Government rejected his claim in 2020 on the ground that his educational qualifications did not conform to the subsequently prescribed 10+2+3 pattern. The dispute consequently arose as to whether the subsequent changes in the qualification requirements could be applied to an employee who had acquired his qualifications when the earlier Government Orders were in force.
The principal issue before the Hon’ble Supreme Court was whether a subsequent amendment or modification to the educational qualification requirements under Government Orders could retrospectively invalidate qualifications acquired by an employee in accordance with the rules prevailing at the time when such qualifications were obtained, thereby affecting his eligibility for promotion.
The Appellant contended that his qualifications had been obtained in accordance with the Government Orders prevailing at the relevant time and had subsequently been recognised by the Government. It was further contended that his promotion as Tourist Officer had already taken place and had remained unchallenged for several years. Therefore, the Government could not subsequently rely upon amendments or clarifications introduced years later to question his eligibility and deny him further promotion.
The Appellant also relied upon the decision of the Madras High Court in P. Thavam v. State of Tamil Nadu, where the Court had held that the relevant Government Order could not operate retrospectively against persons who had acquired their qualifications prior to the change. The Special Leave Petition filed against the said judgment had also been dismissed by the Supreme Court. The Respondents, on the other hand, relied upon the subsequently amended qualification requirements and contended that the Appellant did not satisfy the prescribed educational criteria for promotion to the post of Assistant Director of Tourism.
The Hon’ble Supreme Court allowed the appeals and set aside the judgment of the Division Bench of the Madras High Court. The judgment of the learned Single Judge, which had directed consideration of the Appellant for promotion, was restored. The Court observed that the Appellant had acquired the requisite qualification under the Government Orders prevailing at the relevant time. Importantly, the Government Order governing such qualifications had remained in force for a substantial period before the subsequent change in policy.
The Hon’ble Court held that the Appellant could not be rendered ineligible by navigating through a series of subsequent Government Orders when the qualification had been validly acquired under the prevailing regime. The Court relied upon its earlier decision in P. Mahendran v. State of Karnataka, (1990) 1 SCC 411, and reiterated the settled principle that every statute or statutory rule is prospective unless it is expressly or by necessary implication made retrospective. In the absence of language indicating an intention to affect existing rights, an amendment cannot ordinarily be construed as operating retrospectively.
The Supreme Court further approved the reasoning adopted in P. Thavam v. State of Tamil Nadu. The Court noted that the Special Leave Petition against the said decision had already been dismissed, thereby reinforcing the principle that persons who had acquired qualifications before the relevant change could not be prejudiced by subsequently introduced requirements.
A significant observation of the Court was that Government Orders which modify or amend previous Government Orders must be interpreted in a reasonable manner so as to avoid unnecessary hardship to persons who had no control over the subject matter. Accordingly, the Court held that the Appellant was eligible to be considered for promotion to the post of Assistant Director of Tourism.
The judgment of the Hon’ble Supreme Court is significant in reaffirming the principle of prospectivity in service jurisprudence. Government authorities possess the power to modify service conditions and prescribe higher or different qualification standards in accordance with changing administrative requirements. However, such power cannot ordinarily be interpreted to retrospectively unsettle rights or qualifications that were validly acquired under the earlier regulatory framework.
The judgment therefore provides an important safeguard against administrative uncertainty. Where a Government Order is subsequently amended, the authorities must examine the language, purpose and intended operation of the amendment before applying it to persons who had already acquired qualifications or accrued rights under the earlier regime. The decision also reinforces the principle that administrative interpretation must remain reasonable and cannot create hardship merely through a mechanical application of successive Government Orders.
Team AMLEGALS assisted by Ms Anisha Joshi (Intern)
For any queries or feedback, feel free to connect with Hiteashi.desai@amlegals.com or Khilansha.mukhija@amlegals.com
India’s digital payments revolution is often defined by one word, UPI. The Unified Payments Interface has transformed the manner in which money moves, making transactions instant, interoperable and accessible. However, the next phase of India’s digital financial journey may not be about making payments faster. It may be about making financial opportunity easier to access.
The next stage of India’s digital financial ecosystem is likely to be shaped by the convergence of Artificial Intelligence (“AI”), Account Aggregators (“AAs”) and Digital Public Infrastructure (“DPI”). Together, these technologies can move the financial sector beyond payments and towards more personalised, data-driven and inclusive financial services.
The larger question, however, is whether India can move from a successful digital payments architecture to an ecosystem that delivers credit, investment, insurance and financial advice in a manner that is not only frictionless, but also responsible and trustworthy.
UPI solved a fundamental problem: how to move money instantly between parties. The next challenge is substantially more complex: how to enable individuals and businesses to access the right financial product at the right time.
A person may be able to make an instant payment while still facing difficulties in obtaining credit, demonstrating creditworthiness or understanding appropriate financial products. Thus, financial inclusion cannot be measured merely by the number of digital transactions. AI, AAs and DPI have the potential to address this gap. AI can analyse financial behaviour and generate personalised insights. AAs can facilitate consent-based access to financial information. DPI can provide interoperable infrastructure through which these services can operate.
The shift is therefore from transaction enablement to financial intelligence.
AI could fundamentally alter how financial institutions assess risk, detect fraud and interact with customers. Credit assessment, financial planning, customer support and fraud detection are all areas where AI can reduce cost and improve efficiency. However, financial decision-making cannot become a complete “black box”. If an AI-driven system rejects a loan application, identifies a transaction as suspicious or recommends a financial product, questions of explainability and accountability immediately arise. This becomes particularly significant where AI systems rely on alternative data. A model may identify correlations that are commercially useful but difficult for consumers to understand or challenge. Algorithmic bias may also reproduce existing inequalities while appearing technologically objective.
Consequently, the future of AI-driven finance should not be determined solely by accuracy. Explainability, auditability, human oversight and meaningful grievance redressal must form part of the architecture itself.
The Account Aggregator framework has the potential to address one of the structural problems of Indian finance: fragmented financial information.
Through consent-based data sharing, individuals can potentially provide lenders and financial institutions with a more comprehensive picture of their financial position. This may reduce information asymmetry and enable more efficient credit assessment. Yet the effectiveness of an AA ecosystem depends upon whether consent is genuinely meaningful. A consumer who clicks “accept” without understanding what information is being shared, with whom, for what purpose and for how long has technically provided consent, but may not have exercised meaningful informational control. As financial data becomes increasingly valuable, the regulatory challenge will therefore be to ensure that data portability does not become data exploitation. The consumer must remain at the centre of the consent architecture.
India’s DPI can provide the infrastructure required for financial services to move beyond traditional banking interfaces. Credit, insurance, investments and other financial services may increasingly become embedded within platforms that consumers already use.
This can significantly reduce friction. However, embedded finance also creates regulatory complexity because multiple entities may participate in a single financial transaction. If a consumer suffers loss, who should be accountable: the regulated financial institution, the technology platform, the intermediary or another service provider? The answer should increasingly depend upon function rather than form. Regulatory responsibility cannot disappear merely because a financial service is delivered through a technology platform.
India’s digital financial infrastructure has attracted global attention because it demonstrates how public infrastructure and private innovation can operate together at scale. However, replicating this model internationally cannot simply mean exporting technology.
The success of India’s digital ecosystem is also connected to its institutional architecture, regulatory environment and interoperability standards. As India seeks to internationalise its digital financial infrastructure, the focus should therefore remain on outcomes rather than adoption alone. The relevant questions should be whether such systems improve access to credit, reduce transaction costs, strengthen consumer protection and promote meaningful financial inclusion.
The evolution beyond UPI represents a fundamental shift in the philosophy of digital finance. UPI largely removed friction from the act of payment. The emerging ecosystem seeks to remove friction from the entire financial decision-making process. This distinction is important. When payments become instant, the principal risk is transactional fraud. When credit decisions, financial advice and product recommendations also become automated and real-time, the risks become substantially broader, including algorithmic bias, opaque decision-making, excessive data collection and inappropriate financial recommendations.
In our view, India’s competitive advantage should not be measured by how much financial activity can be digitised, but by how responsibly that activity can be digitised. The convergence of AI, Account Aggregators and DPI can create a financial ecosystem in which a consumer’s financial information moves seamlessly and financial services are delivered contextually. However, this ecosystem will succeed only if consumers retain meaningful control over their data and meaningful recourse against automated decisions.
Regulation, therefore, should not attempt to prevent technological evolution. Instead, it must ensure that innovation develops with appropriate safeguards built into the system from the outset. Privacy, cybersecurity, explainability and consumer protection should be treated as design principles rather than post-incident remedies.
Team AMLEGALS assisted by Ms Anisha Joshi (Intern)
For any queries or feedback, feel free to connect with Hiteashi.desai@amlegals.com or Khilansha.mukhija@amlegals.com
The Digital Personal Data Protection Act, 2023 (“DPDP Act”) borrows some of the European Union (“EU”)’s General Data Protection Regulation (“GDPR”)’s vocabulary a Data Fiduciary echoes a “controller,” a Data Principal echoes a “data subject” and the legal architecture behind those words is roughly the same.
In several places the DPDP Act gives a familiar-sounding concept a narrower role than its European counterpart. In others, it leaves out a safeguard a GDPR-trained reader instinctively expects to find. Reading a GDPR safeguard into a DPDP Act silence does not make the advice more careful. It just moves the error from understating a client’s obligations to overstating them or, now that the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) have started to follow, the other way round.
What follows sets out nine places where GDPR instinct and the DPDP Act’s actual text part ways, what the drafting history says about why, what has changed operationally since the DPDP Rules were notified in November 2025, and a short test for keeping European habit from quietly rewriting Indian law.
The term “Privacy” does not appear anywhere in the operative provisions of the DPDP Act. The constitutional backdrop is a separate document: Justice K.S. Puttaswamy (Retd.) v. Union of India, decided by a nine-judge Bench of the Supreme Court on 24 August 2017 and reported at (2017) 10 SCC 1, which held unanimously that the right to privacy is a fundamental right protected under Article 21, read with Articles 14 and 19, of the Constitution. The DPDP Act sits underneath that constitutional right it was never drafted to restate or codify it. It is a narrower statute, concerned specifically with the processing of digital personal data for lawful purposes.
The Act covers digital personal data only. It has no distinct tier for sensitive data. It says nothing about profiling as a standalone concept. It lets the State claim broad exemptions without an express proportionality clause in the text. And when the Data Protection Board of India levies a penalty, that money is credited to the Consolidated Fund of India not paid to the person who was actually harmed. None of this is buried in a footnote. It sits in the text. GDPR-trained readers tend to read past it anyway, because their training taught them to expect a different kind of statute.
The drafting history does not support that reading. “Deemed consent” in Section 8 of the 2022 Bill became “certain legitimate uses” in Section 7 of the final Act, and neither version carried an open-ended, GDPR-style legitimate-interests ground or the balancing test Article 6(1)(f) requires. The publicly-available-data exclusion in Section 3(c)(ii) moved the other way it was added between the 2022 Bill and the final Act, a deliberate widening rather than an accidental gap. Profiling and its territorial trigger went the way of deletion instead. The separate category for sensitive personal data disappeared earlier still, somewhere between the 2019 Bill and the 2022 draft. When a protection appears in an earlier version of the law and is gone by the time the Act is enacted, that is Parliament making a choice. It is not a gap for an adviser to quietly fill in on the client’s behalf.
The DPDP Act existed on paper without functioning machinery assented to on 11 August 2023, but waiting on rules to operationalise it. The Ministry of Electronics and Information Technology released draft DPDP Rules for public consultation on 3 January 2025, drawing several thousand stakeholder submissions over the following months. The final DPDP Rules, 2025 were notified on 13 November 2025, alongside separate notifications enforcing the Act’s provisions and establishing the Data Protection Board of India, a four-member body operating out of the National Capital Region.
Implementation is staggered across three dates. From 13 November 2025, the definitional provisions and the sections establishing and operating the Data Protection Board came into force immediately, so the Board now exists and can begin functioning. A second phase, effective 13 November 2026, brings in the framework for registering Consent Managers. The remaining substantive obligations the notice-and-consent architecture, breach notification timelines, data principal rights, children’s data safeguards, cross-border transfer rules, and the Significant Data Fiduciary obligations discussed above become enforceable on 13 May 2027, eighteen months after notification.
Two practical points follow. First, the Data Protection Board can already receive complaints and issue directions for corrective steps even though most monetary penalties will not be available until later phases so reputational and operational exposure can arrive well before financial exposure does. Second, Board orders are appealable to the Telecom Disputes Settlement and Appellate Tribunal within sixty days, with a further appeal on questions of law to the Supreme Court, giving the enforcement structure a defined judicial check that did not exist while the Act sat dormant.
Before carrying an EDPB position, or a GDPR recital, into DPDP Act advice, three questions are worth running through first:
There is no single right answer here what matters is being explicit with the client about which direction the advice moves them in: toward a voluntary best practice worth adopting anyway, or toward a legal obligation that, on the text of the DPDP Act, does not actually exist.
The DPDP Act should be read on its own terms, not as a shorthand translation of the GDPR. In several places it asks less of businesses than its European counterpart does, and Indian companies are entitled to that difference. That said, the Act not demanding a particular safeguard does not make the safeguard a bad idea a compensation clause in a vendor contract, or a human-review step before a high-stakes automated decision, can remain good governance even where the statute stays silent, particularly while the Data Protection Board is already active and the compliance clock is running toward May 2027. The job of the adviser is to keep those two things distinct, and here is what the law requires, and here is what we are recommending on top of it. Blur that line, even with good intentions, and the advice ends up describing a law that exists only in the adviser’s head, not in the Gazette.
Team AMLEGALS assisted by Preetam Takhar (Intern)
For any queries or feedback, feel free to connect with mridusha.guha@amlegals.com or Khilansha.mukhija@amlegals.com
In Vimpro Tech v. Commissioner of Customs (Gr.2), Chennai, decided on 5 August 2026 [(2026) 45 Centax 206 (Mad.)], the Madras High Court examined whether the statutory power to grant provisional release of detained goods under Section 110A of the Customs Act, 1962 can be curtailed by an executive circular of the CBIC. The Hon’ble Court held that a circular, being subordinate executive instruction, cannot override or restrict a specific statutory power, and that pendency of investigation cannot, by itself, be a ground to deny provisional release.
Reaffirming settled principles on the hierarchy between statute and executive circulars, the Hon’ble Court directed provisional release of the detained goods on suitably protective terms, while leaving the underlying questions of classification, misdeclaration and import policy violation open for determination in adjudication.
The petitioner, a manufacturer, had imported a consignment of plastic spare parts through Chennai Seaport under Bill of Entry No. 4355530 dated 07.09.2025. The goods were detained by the Customs authorities on the allegation that they had been mis-declared. According to the department, the goods were, in substance, plastic spares/parts for lighters classifiable under Chapter 96 of the Customs Tariff Act attracting Basic Customs Duty at 10%, whereas the petitioner had claimed classification under Chapter 13 and paid duty at 5%.
The petitioner sought provisional release of the goods, but the request was rejected by the third respondent by order dated 17.04.2026. The rejection order was issued on virtue of CBIC Circular No. 35/2017-Customs dated 16.08.2017, which contemplates that provisional release may not be appropriate where goods are prohibited or restricted, where there is non-compliance with statutory requirements, or where release may affect investigation or public interest. The department also cited possible violation of DGFT Notification Nos. 15/2023 and 36/2024-25, alleged misdeclaration, and the pendency of investigation as grounds for refusal.
Aggrieved, the petitioner approached the Hon’ble Madras High Court by way of a writ petition, producing an official memorandum dated 26.06.2025, issued by the Under Secretary to the Government, authorising import of goods described as “Employ Plastic Shell and Spare Parts for manufacturing of Gas Lighter with Plastic Holder Tray” – a description the petitioner contended corresponded to the goods actually imported.
The controversy essentially turned on the following questions:
The Hon’ble Madras High Court held that Section 110A of the Customs Act, 1962 specifically provides for provisional release of seized goods on such terms and conditions as may be imposed by the competent authority. Relying on the Delhi High Court’s decision in Additional Director General (Adjudication) v. Its My Name Pvt. Ltd. [2021 (375) E.L.T. 545 (Del.)], the Hon’ble Court reiterated that executive instructions may supplement a statute but cannot override or replace a statutory provision. CBIC Circular No. 35/2017-Customs could not, therefore, curtail the discretion vested under Section 110A.
The Hon’ble Court found that whether the imported goods were covered by the petitioner’s import authorisation, and whether there was any misdeclaration or violation of import policy, were matters to be determined in adjudication proceedings, and not at the stage of considering provisional release. Similarly, the question of correct classification and the resultant differential duty liability was left open for the competent authority to decide. The pendency of investigation could not, by itself, defeat the statutory power to grant provisional release, since the interest of Revenue could adequately be safeguarded through appropriate conditions.
Drawing on Navashakti Industries Pvt. Ltd. v. Commissioner of Customs, ICD, TKD, New Delhi [2011 (267) E.L.T. 483 (Del.)], as modified by the Supreme Court in Civil Appeal No. 3940 of 2011, and on the Division Bench decision in Commissioner of Customs, Tuticorin v. Empire Exports [2013 (287) E.L.T. 41 (Mad.)], the Hon’ble Court directed provisional release of the goods on the following terms: (i) payment of duty at 10% on the declared value, with credit for duty already paid; (ii) execution of a personal bond for the balance differential duty as may be determined in adjudication; and (iii) release without prejudice to the department’s right to continue investigation and complete adjudication. The Hon’ble Court also directed consideration of the petitioner’s request for a detention certificate under Regulation 6(1) of the Handling of Cargo in Customs Areas Regulations, 2009, and clarified that its observations were confined to the issue of provisional release and would not affect the merits of the adjudication.
The decision in Vimpro Tech reaffirms a settled but frequently contested principle in customs practice – that a departmental circular, however well-intentioned, cannot be used to whittle down a statutory power expressly conferred by Parliament. Section 110A is a substantive safeguard against prolonged, unexplained detention of goods pending investigation, and its exercise cannot be made contingent upon satisfaction of conditions that the statute itself does not prescribe.
The ruling is also significant for its clear separation of the provisional release inquiry from the merits of adjudication. By declining to pre-judge issues of classification, misdeclaration and import policy compliance, and confining itself to crafting revenue-protective conditions for release, the Hon’ble Court has offered a template that balances an importer’s commercial interest in the timely release of goods against the Revenue’s legitimate interest in securing its dues pending investigation.
For importers facing detention on classification or misdeclaration disputes, this judgment reinforces that provisional release is a statutory entitlement, not a discretionary concession contingent on the department’s Circular-based comfort, and that conditions such as payment of the higher rate of duty claimed by the department together with a bond for the balance can adequately protect Revenue without indefinitely stalling legitimate trade.
For any queries or feedback, feel free to connect with Dhwani.tandon@amlegals.com