Cyber cafe rules in India: registration, ID, logs

Most cyber cafe owners hear the rules from a neighbour, a police constable or the person who set up the shop next door. Each of them says something slightly different, and each of them can be right, because the rules are not the same everywhere.

Here’s why. India’s national cyber cafe rules were notified on 11 April 2011 as G.S.R. 315(E). They leave registration and inspection to an agency that the “Appropriate Government” picks. That can be the Central Government, a State Government or a Union Territory administration. So two cafes in two states can be asked for different things.

We read the national rules on 17 October 2026, and Meghalaya’s 2012 rules as a state example. A search on that date found no amendment to either. But we can’t confirm that either text is in force today, so treat this page as a map, not as legal advice. If you’re planning a new cafe, the start-up checklist covers premises, equipment and costs. This page sticks to the rules.

Do these rules apply to your shop?

The rules were made under the Information Technology Act, 2000. They have five parts that matter to you: registration (Rule 3), user identification (Rule 4), the log register and monthly report (Rule 5), premises and computers (Rule 6) and inspection (Rule 7).

Section 2(1)(na) of the Act defines a cyber cafe as “any facility from where access to the internet is offered by any person in the ordinary course of business to the members of the public”.

So ask yourself one plain question. Does your counter offer internet access to the public as part of its business? If yes, the rules are probably about you. If you’re not sure, ask your registration agency before you guess.

How does registration work?

Rule 3 says every cyber cafe has to be registered with the agency your government has notified, and gets a unique registration number. The form asks for the name of your establishment, its address and email, and its legal form: individual, partnership, sole proprietorship, society or company. It also asks for the name of the owner or director, any registration with the Registrar of Firms, Companies or Societies, and the type of service you provide.

After that, an officer from the agency may visit in person. The agency is also supposed to publish registration details on its website.

What about an online portal? The government is only told to “make an endeavour” to set one up. That’s a goal in the text. It isn’t a promise that your state has one.

Rule 3(4) leaves the detailed process to a separate central notification. So ask the agency how it actually works for you. Neither the national rules nor the Meghalaya rules set fees or processing times, so don’t rely on anyone who quotes you a number.

One more thing about words. The national rules talk about registration. Meghalaya’s rules say “licence” and name the Deputy Commissioner of each district as the nodal agency. So if a neighbour tells you that you need a licence, that may be true in your state. Your state’s notification decides.

How must you identify users?

Under Rule 4, a cyber cafe can’t let a person use its computers until that person’s identity is established. The user can prove it with any document that satisfies the cafe. The examples in the rules are:

• a school or college identity card
• a photo credit or debit card from a bank or post office
• a passport
• a Voter Identity Card
• a PAN card
• a photo identity card from an employer or a government agency
• a driving licence
• a Unique Identification (UID) number

You keep a photocopy or scan of that document. The user signs it as authentic, and so does an authorised person from your cafe. Then you store it safely for at least one year.

The rules also say the user “may” be photographed with a webcam. If you do take the photo, it becomes part of the log register once it’s authenticated.

There are three more duties to know about:

• A minor who has no photo identity card must come with an adult, and that adult must show one of the listed documents.
• Anyone who comes along with a user must also show a listed document before entering. You record it the same way.
• If you have reasonable doubt or suspicion about a user, you must report it to the police straight away (Rule 4(6)).

Now the awkward bit. The national text doesn’t give an age and doesn’t define “minor”. Rule 6 adds that if your cafe has cubicles or partitions, minors can’t use a computer inside them unless a parent or guardian is with them. So where exactly does “minor” start? Ask your registration agency whether your state spells it out.

What goes in the log register and the monthly report?

Once you’ve identified the user, and anyone with them, you write the details in the log register. You may keep the register online. If you do, it has to be authenticated with a digital or electronic signature.

At a minimum the register holds:

• the user’s name, address, gender and contact number
• the type and details of the identification document
• the date and the identification of the computer terminal
• the log-in time and the log-out time

Each month you also prepare a report from the register, showing date-wise computer usage. You send a hard copy and a soft copy to the person or agency your registration agency names. The deadline is the 5th day of the next month (Rule 5(3)).

There’s more. The owner has to store and back up the history of websites opened on the cafe’s computers, along with the logs of any proxy server installed at the cafe. And you have to make sure nobody can alter the log register. For help with logs, the text points to a CERT-In document called “Guidelines for auditing and logging - CISG-2008-01”.

How long do you keep each record?

Your state or your registration agency may ask for longer, or for something different. A safe habit is to keep each record for the longest period any of them names.

What do the premises and inspection rules say?

Rule 6 is about the room itself. Partitions or cubicles can’t be taller than four and a half feet. Screens that sit outside cubicles have to face the common open space. And the clocks on your computers and server must be synchronised with Indian Standard Time.

You also have to take sensible precautions against illegal use. That means putting up a board that prohibits viewing pornographic sites and copying or downloading information the law prohibits. And you should take reasonable steps to stop users from tampering with system settings.

What about filtering software? The national text says computers “may be equipped” with commercially available safety or filtering software. That’s permissive wording. A state can turn it into a must.

Then there’s inspection. Under Rule 7, an officer authorised by the registration agency can inspect the cafe, its computers and its network at any time to check that you follow the rules. You have to hand over every related document, register and bit of information they ask for. So test yourself now: could you pull up one customer’s record from last month in a couple of minutes?

The national text doesn’t itself set out penalties. Your registration agency or a lawyer can tell you what applies in your state.

How can a state’s rules differ? Meghalaya as an example

The Government of Meghalaya notified its own Meghalaya Cyber Cafe Rules 2012 in the Gazette of Meghalaya dated 17 September 2012, citing section 90 of the Information Technology Act. They show how far a state can go beyond the national text.

You may be nowhere near Meghalaya. That’s fine, because the point of the table is the pattern. Words like “may” in the national rules turn into “shall” in a state’s rules, and extra duties appear. Your own state could have done the same.

One Meghalaya district, West Jaintia Hills, publishes its own list of enclosures for registration. The page is marked last updated 26 November 2020, and it doesn’t say which rules it applies under. So ask your own district office for the current form and the current list of enclosures.

What about the records your other services create?

The cyber cafe rules are about the people who sit at your computers. Other services at your counter come with their own record rules, and these are separate.

Take IRCTC. Its Policy for Integration of Principal Service Providers, Internet Cafe and B2B Schemes, effective 2 September 2020, says that if you book rail tickets as an IRCTC retail agent, you keep two records for six months. One is the customer’s written or electronic request. The other is a copy of the customer’s ID proof. This covers booking and cancellation. The policy sets a penalty of ₹5,000 plus taxes per case where the written request or the ID proof is missing.

IRCTC’s earlier Revised Agent Policy, effective 29 November 2019, carries the same six-month rule. IRCTC can revise its policies, so ask the provider you register through whether the six months still applies.

PAN applications answer to UTIITSL and the Income Tax Department. Money transfer answers to the Reserve Bank of India. SiOnline doesn’t register cyber cafes and isn’t the authority for any of these rules.

If you plan to add agent services, put three questions to your provider in writing. Which records do I have to keep? For how long? May I store a customer’s identity documents at all? Keep the answer where you can find it later. If you want to see what a SiOnline retailer account involves, you can ask about becoming a SiOnline retailer or look at the services page.

How do you check the current rule for your state?

1. Ask the district administration or your state’s IT department which agency is notified in your state.
2. Ask for the current notification and any amendment, plus the registration form and the list of enclosures. If the office can’t name the notification, ask for its number in writing.
3. Ask whether state rules say anything on photographing users, extra logs, the format of the monthly report, or the age of minors.
4. Keep dated copies of what you’re told, and ask again once a year.

Questions owners ask

Do I need a licence to open a cyber cafe?

The national rules ask for registration with an agency your government has notified. Meghalaya, for one, uses the word licence and names a district officer as the agency. Your state’s notification decides which word and which officer apply to you.

Must I photograph every user?

Under the national rules, a webcam photo is optional (the text says “may”). The Meghalaya rules say all users must be photographed. So check what your state requires before you decide.

Does a ticket counter need to follow these rules?

Only if your counter offers internet access to the public in the ordinary course of business. Ask your registration agency before you assume either way.

Sources

• Department of Information Technology: Information Technology (Guidelines for Cyber Cafe) Rules, 2011, G.S.R. 315(E), 11 April 2011, in the Gazette compilation hosted by Meghalaya Police, retrieved 17 October 2026.
• Government of Meghalaya: Meghalaya Cyber Cafe Rules 2012, Gazette of Meghalaya, 17 September 2012, retrieved 17 October 2026.
• Ministry of Law and Justice (India Code): Information Technology Act, 2000 (updated), section 2(1)(na), retrieved 17 October 2026.
• West Jaintia Hills District Administration: Registration of Cyber Cafe, page marked last updated 26.11.2020, retrieved 17 October 2026.
• IRCTC: Policy for Integration of Principal Service Providers, Internet Cafe and B2B Schemes, 2020 (w.e.f. 02.09.2020), retrieved 17 October 2026.
• IRCTC: Revised Agent Policy for e-ticketing Principal Service Providers, Internet Cafe and B2B Schemes (w.e.f. 29.11.2019), retrieved 17 October 2026.

Facts on this page were last checked on 17 October 2026. That check found no amendment or repeal of the 2011 national rules, but that doesn’t prove the text is still in force. Confirm the current rule with your registration agency before you act.