Income-tax Bill 2025: Digital data and the question of power and privacy

A Parliamentary Select Committee reviewing the Bill is expected to submit its report during the monsoon session

The Income-tax Bill, 2025, introduced in the Lok Sabha on February 13, seeks to modernise India’s tax code. However, buried in its text are provisions that could fundamentally shift the relationship between Indian citizens and the digital state. 

The Bill is under review by a 31-member Parliamentary Select Committee tasked with studying the draft and recommending changes. The committee is expected to submit its report during the Monsoon Session, which begins on July 21. 

Two specific sections have been in focus: Sections 247 and 249,, which grant income tax authorities unprecedented powers to access, search and seize digital data, which, digital rights groups warn, could enable expansive surveillance with minimal oversight. 

Section 247 empowers tax officers to inspect not just physical premises, but any “virtual digital space”, a term broadly defined to include email accounts, cloud servers, social media platforms and even encrypted messaging services. Officers are permitted to override passwords and encryption protocols during a raid if they suspect relevant digital evidence exists.  

The threshold for triggering such an inspection could simply be a “reason to believe” that relevant information is present. Critics argue this standard is overly vague and susceptible to misuse. Section 249 compounds these concerns by preventing disclosure of the reason for initiating such a search. As the Bill states, “The reason to believe or reason to suspect... shall not be disclosed to any person or authority or the Appellate Tribunal.” 

 

“The search and seizure provisions appear overbroad,” said N S Nappinai, senior advocate and founder of Cyber Saathi, a non–profit focused on cyber laws and cyber safety. “Whilst ‘reason to believe’ may be sufficient for undertaking search and seizure, it is settled law that the same has to be based on material and cannot be ambiguous or arbitrary,” she said, adding that some sub-clauses build in arbitrariness in that “a search is also made permissible on assumptions or inference”. 

 

On professional privilege and due process, Nappinai cautioned that the matter of searching all electronic devices or storage mediums is already supported in law, as long as the person being searched is amenable to the jurisdiction of the authority. However, the existing provision does not imply an absolute privilege to search or do so without due process.

 

Harsh Walia, telecom, media and technology (TMT), and data privacy partner at Khaitan & Co, has a different view. On whether the “reason to believe” threshold offers adequate protection, he said these grounds for inspection are already present in the Income-tax Act of 1961 and “have stood the test of proportionality over time”. He added that “the 2025 Bill seems to offer as much judicial oversight as the 1961 Act does, which has survived any challenges so far”.

 

Regarding professional privilege, Walia explained: “Professional privilege is, in any case, subject to disclosures required under the law to law enforcement authorities in case of crime or fraud.” He explained that there have been instances in the past where professional offices and spaces have been raided by tax authorities; “however, courts have emphasised the need for IT officers to obtain a warrant and give prior notice to such professionals.”

 

On concerns about procedural fairness and the secrecy imposed by Section 249, Walia pointed to Section 251, which “provides avenues of relief for persons affected by decisions taken by the competent authority under Sections 247 and 249”.

 

Subhead: Security and safeguard

 

Civil society organisations, including the Internet Freedom Foundation, have raised red flags. They argue that compelling individuals to reveal passwords or granting state access to encrypted digital spaces undermines core digital security measures. 

 

The Global Encryption Coalition, in a recent article, warned that “weakening encryption security could erode trust in India’s digital economy”, making businesses more wary and systems more vulnerable to breaches.

 

Walia also acknowledged these risks, particularly with regard to shared infrastructure. 

 

“It is possible that the inspection powers of tax authorities, under the Bill, may risk unauthorised disclosure of documents and data belonging to individuals other than the assessee,” he said. “However, we will have to wait and see how safeguards in this respect are developed, either by the industry through technical barriers, through privacy laws, or by judicial pronouncements.” 

 

Comparing the Bill to international standards, Walia noted that provisions for collecting digital evidence exist in jurisdictions such as the United States, United Kingdom, and the European Union as part of their criminal laws. “The US tax authority, i.e. the IRS (Internal Review Service), has also been given powers to inspect and seize digital records for tax enforcement purposes,” he said. “Hence, the Bill’s approach is not far from international standards.”

 

However, critics point out that in many of those jurisdictions, warrants and judicial authorisation are necessary. India’s approach embeds these powers in a fiscal Bill rather than a dedicated surveillance or data protection framework. 

 

On the same, Walia said that “such investigative powers over electronic records and documents are part of the existing Income-tax Act as well. Similar powers are already granted under criminal procedure laws in India and may, in some cases, prove to be relevant for tax enforcement purposes.”

 

As a safeguard, he recommended that an extensive review and appeal provisions be made available to affected individuals, to ensure that no tax authorities misuse their inspection and seizure powers in an arbitrary and unchecked manner. “Additionally, these powers of tax authorities should be restricted to books of accounts and other documents that directly pertain to the ongoing investigation,” he said.

 

With respect to constitutional scrutiny, Walia admitted that “questions could be raised” under the Supreme Court’s Puttaswamy judgment. That ruling held that state surveillance must be “lawful, necessary and proportionate”. Walia noted that challenges could be mounted on grounds such as whether the Bill’s digital access powers are specific, necessary and include sufficient safeguards.

 

If enacted in its current form, the law is expected to come into effect on April 1, 2026. In the meantime, privacy advocates have petitioned the committee to introduce stricter safeguards. 

 

As it stands, the Bill’s digital search provisions remain in flux. On one hand, they aim to strengthen enforcement against tax fraud; on the other, they raise concerns about digital rights. The Select Committee’s report, expected during the Monsoon Session, will be a key test of the path India chooses: expanding state powers or reinforcing data privacy protections.