Cyber law and the IT Act

In short

Cyber law is the body of Indian statutes, rules and case law that gives legal recognition to electronic records and signatures and punishes computer-related offences. The core statute is the Information Technology Act, 2000 (substantially amended in 2008), supported by rules on sensitive personal data, intermediaries and incident reporting, and now by the Digital Personal Data Protection Act, 2023. It is examined in BCA "IT law / professional practice / cyber security" papers and asked in interviews for security, compliance, fintech, BPO and IT-services roles, where every developer is expected to know what logs must be kept, what a breach must be reported in, and what the company's safe-harbour duties are.

Explained

Scope, structure and e-transactions

• The IT Act, 2000 came into force on 17 October 2000, modelled on the UNCITRAL Model Law on Electronic Commerce; it has extra-territorial reach (Section 75) if the offence involves a computer located in India.
• Section 4 gives electronic records the same legal effect as writing; Section 5 gives e-signatures the effect of a signature; Section 10A confirms contracts formed electronically are valid (click-wrap, e-mail acceptance).
• Sections 3 and 3A: a digital signature uses asymmetric crypto and a hash function (PKI), certified by a Certifying Authority licensed by the Controller of Certifying Authorities (CCA); electronic signature is the wider, technology-neutral term (includes Aadhaar e-Sign).
• Excluded from e-form by the First Schedule: negotiable instruments (except cheques), powers of attorney, trusts, wills, and contracts for sale of immovable property.
• Digital Locker, e-Gazette and e-filing rest on these provisions.

Offences and civil liability

• Section 43 (civil): unauthorised access, downloading, virus introduction, damage, denial of access, tampering — liable to pay compensation to the person affected; no upper ceiling since 2008.
• Section 65: tampering with computer source code — up to 3 years and/or ₹2 lakh.
• Section 66: dishonestly or fraudulently doing any Section 43 act — up to 3 years and/or ₹5 lakh.
• 66B receiving a stolen computer/device; 66C identity theft (misuse of password, e-signature, unique identification); 66D cheating by personation using a computer (phishing, fake customer-care fraud); 66E capturing/publishing private images violating privacy — each up to 3 years.
• Section 66F: cyber terrorism — attacking critical systems or unity, integrity and security of India — punishable up to life imprisonment.
• Section 67 / 67A / 67B: publishing obscene, sexually explicit, and child sexual abuse material — 67B carries up to 5 years and ₹10 lakh on first conviction.
• Section 70: unauthorised access to a protected system (notified critical infrastructure; NCIIPC is the nodal agency) — up to 10 years. Section 72: breach of confidentiality by an official.
• Section 66A (offensive messages) was struck down as unconstitutional in Shreya Singhal v. Union of India (2015) for violating Article 19(1)(a) — a near-certain exam question.
• Under Section 77B, offences punishable with imprisonment of three years and above are cognizable, and those punishable with three years are bailable; investigation is by an officer of Inspector rank or above (Section 78).
• Conventional crimes committed online are charged under the Bharatiya Nyaya Sanhita, 2023 (in force 1 July 2024, replacing the IPC) — cheating, forgery, criminal breach of trust, extortion — usually alongside IT Act sections.

Data protection, intermediaries and government powers

• SPDI Rules, 2011 (under Section 43A) require a privacy policy, consent, purpose limitation and "reasonable security practices" — ISO/IEC 27001 is the named benchmark — for sensitive personal data (passwords, financial, health, biometric, sexual orientation).
• DPDP Act, 2023: consent-based processing of digital personal data; roles of Data Fiduciary, Data Processor, Data Principal, Consent Manager; rights to access, correction, erasure and grievance redressal; a Data Protection Board of India; penalties up to ₹250 crore for failure to take reasonable security safeguards and ₹200 crore for breach of children's-data obligations. The DPDP Rules, 2025 were notified on 13 November 2025 with a phased roll-out: the Board and definitions came into force that day, Consent Manager registration from 13 November 2026, and the Data Fiduciary duties (notice, consent, security safeguards, breach intimation, erasure) from 13 May 2027. Section 44(2), which omits Section 43A of the IT Act, also takes effect on 13 May 2027 - until then the SPDI Rules continue to apply.
• Section 79 (safe harbour): an intermediary is not liable for third-party content if it is a mere conduit, exercises due diligence and removes content on actual knowledge via a court order or government notification. The IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 add grievance officers, timelines, traceability for significant social media intermediaries and Grievance Appellate Committees.
• Sections 69 / 69A / 69B: powers to intercept and decrypt, to block public access to content, and to collect traffic data; refusal to assist is itself punishable (up to 7 years under Section 69).
• Section 70B / CERT-In: CERT-In is the national incident-response agency. Its Directions of 28 April 2022 require reporting specified cyber incidents within 6 hours of noticing them, retention of ICT logs for 180 days within India, and KYC/subscriber records by VPN, cloud and data-centre providers for 5 years.
• Electronic evidence: admissibility is now governed by the Bharatiya Sakshya Adhiniyam, 2023 (replacing the Indian Evidence Act from 1 July 2024) — electronic records are documents, and a certificate for computer output is required (the provision that was Section 65B of the old Act).
• Remedies: claims up to ₹5 crore go to an Adjudicating Officer (a state IT Secretary); larger claims to a civil court; appeals lie to the TDSAT (which absorbed the Cyber Appellate Tribunal) and then the High Court. Complaints can be filed on the National Cyber Crime Reporting Portal (cybercrime.gov.in) or helpline 1930.

Key points

• IT Act, 2000 - India's primary cyber law; major amendment in 2008 inserted Sections 43A, 66A-66F, 67A-67C, 69A/69B and recast Section 79.
• Section 43 vs 66 - same acts; 43 is civil compensation, 66 adds dishonest/fraudulent intent and criminal punishment.
• Section 66A - struck down in Shreya Singhal (2015); citing it as live law is a standard exam trap.
• Section 66F - cyber terrorism, the only IT Act offence punishable with life imprisonment.
• Section 79 - intermediary safe harbour, conditional on due diligence and takedown on actual knowledge.
• Digital signature - PKI-based, hash plus private key, issued by a CA under the CCA; e-signature is the broader term.
• SPDI Rules, 2011 - consent, privacy policy and reasonable security practices (ISO/IEC 27001) for sensitive personal data.
• DPDP Act, 2023 - consent, data fiduciary duties, Data Protection Board, penalties up to ₹250 crore; Board in place since 13 Nov 2025, fiduciary duties from 13 May 2027.
• CERT-In Directions, 2022 - 6-hour incident reporting, 180-day Indian log retention, 5-year KYC for VPN/cloud.
• Section 69 - lawful interception, monitoring and decryption; non-cooperation punishable up to 7 years.
• Adjudicating Officer - decides compensation claims up to ₹5 crore; appeal to TDSAT.
• Electronic evidence - admissible under the Bharatiya Sakshya Adhiniyam, 2023 with the required certificate.
• Extra-territorial application - Section 75 covers offences abroad involving a computer in India.

Examples

Case 1 - Phishing loss and the right forum. A customer's net-banking password is obtained through a fake bank e-mail and ₹4.2 lakh is transferred out.

1. The fake e-mail impersonating the bank → Section 66D (cheating by personation using a computer resource) and Section 66C (misuse of password/identity).
2. Unauthorised access to and extraction from the account → Section 43(a), (b) read with Section 66; cheating is also charged under the BNS, 2023.
3. Compensation: the claim is ₹4.2 lakh, which is below ₹5 crore, so it is filed before the Adjudicating Officer (state IT Secretary), not a civil court; appeal would lie to TDSAT.
4. Criminal complaint goes to the cyber crime police station or cybercrime.gov.in; the bank's liability for unauthorised electronic transactions is separately governed by RBI's customer-protection circular, where prompt reporting by the customer limits the customer's loss.
5. Evidence: server logs, headers and CCTV of ATM withdrawals, produced with the certificate required for computer output under the Bharatiya Sakshya Adhiniyam, 2023.

Case 2 - Startup breach: the compliance clock. A BCA graduate's SaaS firm stores 1.2 lakh users' names, phone numbers and card tokens. At 14:30 on a Monday the team notices database exfiltration.

1. CERT-In's 6-hour rule: the incident must be reported by 20:30 the same day — 14:30 + 6 h.
2. Logs: ICT system logs must already be maintained for 180 days and within India, and be producible on CERT-In's order.
3. Card data: PCI DSS obligations apply contractually through the payment gateway; the RBI tokenisation mandate means raw card numbers should not have been stored at all.
4. Data protection: today (November 2026) the firm's duty is under Section 43A and the SPDI Rules, 2011 (reasonable security practices). Once the DPDP Data Fiduciary duties apply from 13 May 2027, it must also intimate the Data Protection Board and each affected Data Principal; failure of reasonable security safeguards then attracts a penalty of up to ₹250 crore, and failure to intimate the breach up to ₹200 crore.
5. Civil exposure: affected users can claim compensation from the firm under Section 43A (negligence in maintaining reasonable security practices for sensitive data such as card details) - Section 43 is the route against the attacker, and Section 72A is a criminal offence for intentional wrongful disclosure, not a compensation route; the firm's defence is documented ISO/IEC 27001-grade security practices, which is why the ISMS paperwork matters as much as the code.

Where it is used

• IT services and product firms (TCS, Infosys, Wipro, Zoho): contract, privacy-policy and DPA drafting, data-localisation clauses, breach-notification runbooks.
• Banking, fintech and insurance: KYC, RBI cyber-security framework, tokenisation, grievance redressal; roles in risk and compliance teams.
• Security and audit roles: SOC analyst, GRC/ISO 27001 lead implementer, DPO under the DPDP Act, forensic analyst preparing admissible electronic evidence.
• Government and policing: state cyber cells, CERT-In, NCIIPC for protected systems; cybercrime.gov.in and helpline 1930 handle citizen complaints.

Interview questions

• Q: What is the difference between Section 43 and Section 66 of the IT Act? A: Section 43 imposes civil liability to pay compensation for unauthorised access or damage; Section 66 makes the same acts a criminal offence when done dishonestly or fraudulently.
• Q: Why is Section 66A no longer applied? A: The Supreme Court struck it down in Shreya Singhal v. Union of India (2015) as a vague and overbroad restriction on free speech under Article 19(1)(a).
• Q: What is intermediary safe harbour? A: Under Section 79 an intermediary is not liable for third-party content if it only transmits or hosts it, follows the due-diligence duties in the IT Rules, 2021, and removes content on a court or government order.
• Q: How soon must a cyber incident be reported in India? A: Within 6 hours of noticing it, to CERT-In, under its directions of 28 April 2022; ICT logs must be retained for 180 days within India.
• Q: What makes a digital signature legally valid in India? A: It must be affixed as prescribed under Sections 3 and 5 using a Digital Signature Certificate from a Certifying Authority licensed by the CCA.
• Q: Which forum hears a ₹20 lakh claim for data theft? A: The Adjudicating Officer, since claims up to ₹5 crore fall within that jurisdiction, with appeal to TDSAT.
• Q: What does the DPDP Act, 2023 add beyond the IT Act? A: A consent-based framework with data fiduciary obligations, data principal rights, a Data Protection Board and penalties up to ₹250 crore; it also omits Section 43A of the IT Act with effect from 13 May 2027, when most Data Fiduciary duties begin.

Common mistakes

• Quoting Section 66A as valid law, or confusing it with 66B/66C/66D.
• Saying the IT Act applies only in India — Section 75 gives it extra-territorial effect where a computer in India is involved.
• Treating all data as "sensitive personal data"; the SPDI Rules list is specific, and the DPDP Act uses a different, consent-centred scheme.
• Claiming wills, powers of attorney or property-sale contracts can be executed electronically — the First Schedule excludes them.
• Citing "Section 65B of the Indian Evidence Act" for electronic evidence without noting that the Bharatiya Sakshya Adhiniyam, 2023 now governs it.

Related topics

• Information security fundamentals · Software testing basics · System design basics for freshers · Git and version control · BCA final-year project guide