When income-tax officers arrive for a search, most companies picture them going through files, cupboards and lockers. Since April 1, 2026, when the Income-tax Act, 2025 came into force, they can go much further. Section 247 of the new Act extends search and seizure powers from physical premises to what the law calls “virtual digital space”.

That term is defined broadly. It covers email servers, social media, online banking and investment accounts, cloud servers and digital application platforms. It also includes “any other space of similar nature”. If no one provides the password, the officer can override it. The Income-tax Rules, 2026, require whoever controls a device to provide access and allow the officer to break the password if they do not receive it.

In practice, a laptop or phone found at your office can become a gateway to your company’s cloud drives, email history, banking portals and trading accounts, regardless of where in the world the servers are located.

Didn’t the Supreme Court look at this?

It did, very briefly. In March 2026, a petition challenging these powers was withdrawn after the Supreme Court declined to entertain it, giving the petitioner liberty to make a representation to the Government instead.

The Court didn’t rule on whether any particular digital search is proportionate. It also acknowledged that provisions capable of misuse may need to be examined at a later stage. The real test will come in challenges to individual searches before the High Courts. What a business does on the day of the search could shape the outcome of those challenges.

What’s missing from the rules

Neither the Act nor the Rules require officers to:

• Copy only data relevant to the investigation.
• Separate personal data from business data.
• Follow forensic safeguards such as mirror imaging and hash values that can help establish that the data has not been altered.

Seized information can also be shared with other government agencies notified by the Centre. A search that starts as a tax matter can therefore extend well beyond the original investigation.

What businesses should do now

1. Have a search-response protocol. Decide in advance who will coordinate the company’s response to the search, who will call counsel, and who will stay with the officers. Refusing access won’t stop a digital search, since the law allows officers to override passwords, and obstruction carries its own legal risk. The aim is controlled cooperation, not resistance.
2. Keep legal advice separate. Store communications with external lawyers in clearly labelled, separate folders or accounts. It is much easier to assert legal privilege over material that is identifiable than over material buried in a general inbox.
3. Separate personal and business devices. Directors and senior staff who mix personal and business use on one phone expose both sets of data to scrutiny. Separation also strengthens the argument that personal data is irrelevant to the search.
4. Make the record during the search. Ensure the official record of the search (the panchnama) lists every device, account and server accessed and notes whether access was provided or the password overridden. Put objections to accessing privileged, personal or third-party data in writing at the time. Ask in writing for copies of the data collected and any hash values.
5. Move quickly if the search overreaches. A High Court petition filed while the seized material is still being examined may have a better chance of obtaining directions to separate, return or protect data than one filed after an assessment order has been passed.

The new digital search powers are now the law of the land, and the Supreme Court hasn’t struck them down. But how far they can go in practice is still being decided case by case in the High Courts. Companies that prepare now will be better placed to ensure that a tax search remains confined to matters relevant to taxation.

*Views are personal.