Digital Evidence Before Indian Courts: Trends Every Business Should Watch

Indian courts decide commercial disputes, employment matters, fraud cases, and regulatory proceedings on the basis of evidence that is increasingly digital. WhatsApp messages, email chains, CCTV footage, device extractions, GPS records, cloud storage contents, and AI-generated outputs are now routine exhibits in Indian litigation. The legal framework governing this evidence has changed significantly with the enactment of the Bharatiya Sakshya Adhiniyam, 2023 (BSA), which replaced the Indian Evidence Act. At the same time, judicial approaches to authenticating, weighing, and admitting digital evidence continue to evolve. For businesses, the critical insight is that the outcome of digital evidence disputes is largely determined before litigation begins by the quality of document management, evidence preservation, and chain-of-custody practices already in place. This article identifies the major trends shaping digital evidence in Indian courts today and translates them into practical steps for business readiness.

The BSA Framework: What Changed from Section 65B

The most significant statutory change in digital evidence law is the transition from the Indian Evidence Act, 1872 to the Bharatiya Sakshya Adhiniyam, 2023. The BSA’s Section 63 extends and replaces the certification regime previously understood under Section 65B. The practical requirements a certificate from a responsible person identifying the computer, the conditions of the computer’s operation, and the process by which the electronic record was produced are preserved in substance. However, the BSA introduces explicit provisions on electronic records generated by automated systems and stored in cloud environments, reflecting a legislative acknowledgement that digital evidence no longer originates primarily from standalone computers operated by individual users. Courts are still developing a consistent interpretive approach to the new provisions, and there is ongoing judicial divergence on questions such as: who qualifies as the responsible person for a cloud-hosted record; what degree of system description is required in the certificate; and whether a certificate can be provided in respect of records extracted from a third party’s server pursuant to a court order. Businesses should not assume that the practices compliant with the Section 65B regime automatically satisfy Section 63.

Cloud Evidence: Jurisdiction, Access and Authentication

A significant proportion of business records emails, documents, communication histories, application logs are now stored on cloud infrastructure hosted outside India. When these records become relevant to Indian litigation, the procedural and evidentiary questions are complex. The Indian party seeking to produce the records may need to obtain them from the cloud service provider under the provider’s terms of service, which may require a legal process in the provider’s home jurisdiction. Alternatively, records may be obtained through the Mutual Legal Assistance Treaty (MLAT) process for criminal matters, or through the provider’s Indian subsidiary if one exists. Once obtained, the records must be authenticated under Section 63 by a person who can speak to the conditions of the computer system that produced them a challenge when the system is operated by a third-party provider whose cooperation cannot be assumed. Businesses operating primarily in cloud environments should audit their data retrieval capabilities: in a dispute, the ability to produce records promptly and with appropriate authentication is a material litigation advantage.

Messaging Evidence: WhatsApp, Telegram and Encrypted Communications

Messaging application records are among the most contested categories of digital evidence in Indian courts. WhatsApp messages, Telegram conversations, and similar communications are routinely produced in commercial disputes, employment terminations, and fraud proceedings. The evidentiary challenges are layered. First, the messages must be extracted from the device in a forensically sound manner a screenshot is not equivalent to a forensic extraction because screenshots are easily manipulated and carry no metadata. Second, the extracted records must be authenticated: the parties to the conversation must be identified, the integrity of the export must be established, and the relevant metadata timestamps, delivery and read receipts, message IDs must be preserved and produced. Third, end-to-end encryption means that the platform itself cannot provide records of message content; only device-side extraction or backup retrieval can yield the messages. Courts have shown increasing sophistication in identifying doctored screenshots and in requiring proper forensic extraction before admitting messaging evidence. For businesses conducting or anticipating investigations involving employee communications, engaging a qualified digital forensics practitioner from the point of collection not at the point of dispute is essential.

Metadata and Timestamps: The Evidence Behind the Evidence

Metadata data about data has emerged as a central battleground in digital evidence disputes. Document metadata records creation dates, modification histories, author information, and revision sequences. Email metadata captures sending and receiving server information, routing paths, and delivery timestamps that can corroborate or contradict the apparent date and content of a message. File system metadata records when files were created, accessed, and modified on a storage device. In several recent commercial fraud cases, metadata analysis has been decisive: documents purporting to have been executed at an earlier date were shown by metadata to have been created after the alleged execution date. Conversely, metadata has been used to establish the authenticity of records that were disputed on other grounds. The practical implication for businesses is twofold: first, document creation and version histories should be maintained with metadata integrity, not stripped as a matter of policy; second, when receiving documents in litigation or due diligence, metadata should be requested and examined alongside the document itself.

AI-Generated Evidence: Authenticity and Weight

AI-generated records outputs from language models, automated decision systems, fraud detection algorithms, and surveillance analytics are beginning to appear as evidence in Indian proceedings. No Indian court has yet issued definitive guidance on the authenticity standards for AI-generated outputs, but the analytical framework of Section 63 of the BSA which requires identification of the computer system and the conditions under which the electronic record was produced will apply. AI outputs present distinctive authentication challenges: the “computer” in the relevant sense may be a complex system combining training data, model architecture, inference infrastructure, and application code, and the output may be probabilistic rather than deterministic. A party seeking to rely on an AI-generated output as evidence should be prepared to establish: what model produced it; what data was used; whether the output is reproducible; and whether the model has been validated for the task in question. A party challenging an AI-generated output should seek discovery of these particulars and, where appropriate, expert evidence on model reliability.

Expert Witnesses in Digital Evidence: Standards and Pitfalls

Courts increasingly appoint or accept expert witnesses on digital evidence matters. The quality of expert evidence varies considerably, and courts have shown greater willingness in recent years to scrutinise the methodology and independence of digital forensics experts. A credible expert report will document: the tools used for evidence collection and analysis; the hash values of collected items verifying their integrity; the chain of custody from collection to analysis; the methodology applied; and the basis for each conclusion. Reports that state conclusions without methodology, or that are prepared by experts whose qualifications are overstated or whose independence from the instructing party is unclear, have been challenged successfully. For businesses commissioning forensic investigations, selecting a practitioner with verifiable qualifications recognised certifications, documented methodology, and experience in producing court-admissible reports is a prerequisite to the investigation being useful in subsequent proceedings.

What Every Business Should Do Now

The common thread across these trends is that digital evidence readiness is a pre-litigation function, not a litigation response. Businesses that have maintained proper document management, preserved metadata, documented chain of custody for important communications, and established forensic collection protocols will be materially better positioned in any dispute than those that attempt to reconstruct their evidentiary record after proceedings begin. Concrete steps include: reviewing document retention and deletion policies to ensure legally significant records are preserved; establishing secure, timestamped collection procedures for communications on personal devices used for business; identifying which cloud systems hold business-critical data and understanding the data retrieval procedures applicable to each; and engaging qualified forensic advisors before an investigation commences rather than mid-crisis. The legal and reputational cost of inadequate digital evidence preparation far exceeds the cost of establishing proper practices in advance.