Permission limit for Encryption is 40 bit key per length in RSA algorithms
This is totally nonsensical.
First some history: There was a time when key lengths were commonly restricted, particularly but not exclusively by the US government in export control regulations. (This was because encryption was considered a "dual use technology" with both civilian and military applications, and the alleged aim was to reduce the availability of encryption outside of the US that the US could not break. An easy way to do that is to restrict the key length, and the most accessible means for a government to do so is in national and export regulations.)
This key length was, for a long time, capped at 40 bits for symmetrical ciphers. The limit was eventually raised to 56 bits and later the limit was abandoned completely.
However, RSA is not a symmetrical cipher. It is an asymmetric cipher, which means that it uses different keys for encryption and decryption. There's a lot of math behind how this works, which is not necessary to understand, but which you can read about in Wikipedia's articles on public-key cryptography and the RSA cryptosystem specifically if you are curious. Basically, you pick numbers such that given a subset of those numbers the calculations involved in encryption are easy to do, but the calculations involved in decryption are difficult; you then distribute the set of numbers that make encryption easy, but keep the set of numbers that make decryption easy a secret.
Because this requires that keys have certain mathematical properties, keys must be significantly longer to provide a comparable level of security. RSA keys need to be a few thousand bits long to provide security comparable to that of 128-bit symmetric keys, which is generally considered the smallest symmetric key size that can be considered reasonably secure today. Compare Amount of simple operations that is safely out of reach for all humanity? here on Information Security SE. For RSA, absent a more exact specification, the "key size" generally refers to the size of the public modulus, which in RSA is a multiplicative product of two prime numbers. For RSA these days, the absolute minimum is generally considered to be a 1024 bits modulus, with 2048 bits strongly preferred wherever possible.
A 40-bit RSA key would be absolutely trivial to break.
Even a 40-bit symmetric key would be very easy to break with modern consumer hardware and naiive implementations.
Just to give you an idea, I'm browsing Stack Exchange over HTTPS, and they are using a 2048-bit RSA key.
I don't know about the legal situation in India, but yes, governments have historically limited civilian access to "strong" encryption. What actually is considered "strong" encryption has changed over time. However, the specific limit as you wrote it is utterly nonsensical; there is no reason to use RSA with a 40-bit modulus, because you pay all the complexity in terms of implementation but gain nothing in terms of security because the key is so short. You would be better off not using encryption at all and knowing that you aren't, than using 40-bit RSA, and it is highly unlikely that any software will even allow you to create a 40-bit RSA key.