IT Act 2000 explained: sections, Amendment 2008 and a complete guide

What the IT Act 2000 is

The IT Act 2000, formally the Information Technology Act 2000, passed by Parliament as Act No. 21 of 2000 and assented to on 9 June 2000, is the statute on which Indian cyber law rests. Its long title describes a law to give legal recognition to transactions carried out by electronic data interchange and other means of electronic communication, commonly referred to as electronic commerce, and to facilitate electronic filing of documents with government agencies. The Act also amended four existing laws so that they could work with electronic records: the Indian Penal Code, the Indian Evidence Act 1872, the Bankers’ Books Evidence Act 1891 and the Reserve Bank of India Act 1934.

People searching for the information technology act 2000 usually want one of three things: the text of a particular section, the punishment for an offence committed online, or an explanation of how the law is applied. The Act answers each of them in a different place. The first group of chapters deals with electronic records, signatures and certificates. Chapter IX deals with civil compensation. Chapter XI deals with crime. Keeping those three layers apart removes most of the confusion about what the Act does.

The legal position of this cyber law act has not stood still. It was rewritten in part in 2008, one of its offence sections was struck down in 2015, and the tribunal that hears appeals was replaced in 2017. The sections below describe the IT Act 2000 as it stands in the amended text, and a reader who wants only the offences can go straight to the table of offence sections further down.

Complete guide to the chapters of the Act

The amended Act is divided into thirteen chapters, with a further chapter (XIIA) inserted between the twelfth and the thirteenth. The table lists what each chapter is about.

Chapters II to V are the part of the IT Act 2000 that matters to businesses and to government departments: they give an electronic record the same standing as a paper document where the law asks for writing, and they allow contracts to be formed and accepted by electronic means. Chapters VI to VIII build the system of certifying authorities that makes a digital certificate trustworthy. Most readers who arrive with a criminal question need Chapter XI, and the next section is devoted to it.

Sections of the IT Act 2000 that create offences

Chapter XI, headed Offences, runs from section 65 to section 78. The table below lists the principal offence sections and the punishment each carries, taken from the amended text of the Act. Where a section sets a different punishment for a later conviction, both are shown.

Section 66 and the acts listed in section 43

Section 66 does not describe conduct itself. It refers back to section 43, which sits in the civil Chapter IX under the heading penalty and compensation for damage to computer, computer system and similar resources, and it makes any act listed there a crime when it is done dishonestly or fraudulently. The same conduct can therefore lead to a claim for compensation before an adjudicating officer and to a prosecution, depending on the intent behind it. Loose talk about hacking in the Indian context nearly always comes down to this pair of sections.

Identity theft and cheating by personation

Sections 66C and 66D were written for the commonest online frauds. Section 66C covers the fraudulent or dishonest use of another person’s electronic signature, password or other unique identification feature. Section 66D covers cheating by personation by means of a communication device or computer resource. Each carries imprisonment of up to three years together with a fine of up to Rs 1 lakh. A case that involves a stolen password used to empty an account will normally be framed under both, alongside the offence of cheating in the general criminal law.

Privacy and cyber terrorism

Section 66E punishes capturing, publishing or transmitting an image of a private area of a person without consent, in circumstances violating privacy. Section 66F, on cyber terrorism, is the most serious provision in the Act, with imprisonment which may extend to life. It applies where a person acts with intent to threaten the unity, integrity, security or sovereignty of India, or to strike terror, by denying access to a computer resource, by unauthorised access, or by introducing a computer contaminant, and the conduct causes or is likely to cause death, injury or serious damage. A separate page on cyber terrorism looks at that section in detail.

Obscene and sexually explicit material

Sections 67, 67A and 67B deal with publishing or transmitting obscene material, material containing a sexually explicit act, and material depicting children in a sexually explicit act. The punishments rise in that order, and each is heavier on a second or later conviction. How the three sections fit together is covered in the reference on sections 67, 67A and 67B.

Amendment 2008: what changed

The Information Technology (Amendment) Act 2008 was brought into force as Act No. 10 of 2009, with effect from 27 October 2009. It replaced sections 66 and 67 with the versions in force today and expanded Chapter XI into the family of sections numbered 66A to 66F. It also replaced the older idea of a digital signature with the wider notion of an electronic signature.

Two further changes in the amended text matter in practice. Offences punishable with imprisonment of three years and above are cognizable, and the offence punishable with imprisonment of exactly three years is bailable (section 77B). And a court of competent jurisdiction may compound offences other than those punishable with life imprisonment or with imprisonment for more than three years (section 77A), subject to conditions about previous convictions and offences that affect the socio-economic conditions of the country.

Section 66A: struck down in 2015

Section 66A punished the sending of offensive messages through a communication service. The section was added by the Amendment Act of 2009, in force from 27 October 2009. On 24 March 2015 the Supreme Court of India, in Shreya Singhal v. Union of India, held the section unconstitutional. Because the section was struck down, it is no longer law, even though consolidated printed texts of the Act may still reproduce its words. Anyone reading an older commentary on the cyber law act should check whether it still treats section 66A as a live offence.

Who investigates and who decides

Investigation is placed with the police. Under section 78, a police officer not below the rank of Inspector investigates any offence under the Act. Civil claims for compensation under Chapter IX go instead to an adjudicating officer appointed by the Central Government, who must be not below the rank of Director to the Government of India or an equivalent State officer. That officer has jurisdiction where the claim for damage does not exceed Rs 5 crore; claims above that figure go to the competent court. The words “injury or” were removed from section 46(1A) by the Jan Vishwas (Amendment of Provisions) Act, 2023.

Appeals from the adjudicating officer go to the Appellate Tribunal. Since 26 May 2017, by an amendment made through the Finance Act 2017, the tribunal for the purposes of the Act is the Telecom Disputes Settlement and Appellate Tribunal established under the Telecom Regulatory Authority of India Act 1997. The former Cyber Appellate Tribunal no longer exists as a separate body.

Intermediaries and the safe harbour

Section 79 gives an intermediary exemption from liability for third party information, data or communication links that it makes available or hosts. The exemption holds where the intermediary’s function is limited to providing access to a communication system, or where it does not initiate the transmission, select the receiver or select or modify the information; and in either case where it observes due diligence and any guidelines the Central Government prescribes. It does not apply if the intermediary conspired in or abetted the unlawful act, or if on receiving actual knowledge, or on being notified by the appropriate Government or its agency, it fails to remove or disable access to the material expeditiously without vitiating the evidence.

The Supreme Court read the last condition down in Shreya Singhal v. Union of India (2015). It held that section 79 is valid, but that section 79(3)(b) means that an intermediary loses its exemption only if it fails to remove or disable access to material after receiving actual knowledge that a court order has been passed asking it to do so, and that the court order or the notification of the appropriate Government or its agency must relate to the subject matters in Article 19(2) of the Constitution. A platform therefore does not have to judge for itself which complaints are legitimate.

State powers: interception, blocking and protected systems

A group of sections outside the offence provisions gives the State powers that shape how the Act works in practice. Section 69 allows the Central Government, a State Government, or an officer specially authorised by either, to issue directions for the interception, monitoring or decryption of information through a computer resource. The text sets the grounds: where the authority is satisfied that it is necessary or expedient in the interest of the sovereignty or integrity of India, the defence of India, the security of the State, friendly relations with foreign States or public order, or to prevent incitement to a cognizable offence relating to those matters, or for the investigation of any offence. The power is exercised subject to the procedure and safeguards the Act makes the rules prescribe.

Section 69A is the blocking power. It lets the Central Government, or an officer it specially authorises, direct that information be blocked for access by the public through any computer resource, on the same grounds as section 69 except the investigation of an offence. Section 69B separates a third function: the Central Government may, to enhance cyber security and to identify, analyse and prevent intrusion or the spread of a computer contaminant, authorise a government agency by notification to monitor and collect traffic data or information through a computer resource.

Section 70 deals with protected systems. The appropriate Government may declare by notification any computer resource that directly or indirectly affects the facility of Critical Information Infrastructure to be a protected system; the Act defines Critical Information Infrastructure as a computer resource whose incapacitation or destruction would have a debilitating impact on national security, the economy and public health. Section 70B creates the Indian Computer Emergency Response Team as the national agency for incident response, appointed by the Central Government by notification. Alongside them, section 67C requires an intermediary to preserve and retain specified information for the duration, in the manner and in the format that the Central Government prescribes, and an intermediary that intentionally or knowingly contravenes the requirement is punishable with imprisonment up to three years and is also liable to a fine.

Data protection and confidentiality in the Act

The Act has long carried a small set of provisions on personal data. Section 43A, inserted by Act 10 of 2009 with effect from 27 October 2009, makes a body corporate that possesses, deals with or handles sensitive personal data or information in a computer resource that it owns, controls or operates liable to pay damages by way of compensation to the person affected, where it was negligent in implementing and maintaining reasonable security practices and procedures and thereby caused wrongful loss or wrongful gain to any person. It is a civil remedy, and it sits in Chapter IX with the other compensation provisions.

Section 72A is the counterpart for abuse of access. It applies to a person, including an intermediary, who while providing services under the terms of a lawful contract has secured access to material containing personal information about another person, and who acts with the intent to cause, or knowing that he is likely to cause, wrongful loss or wrongful gain. Since 30 November 2023 the consequence under section 72A is a penalty that may extend to Rs 25 lakh, which replaced imprisonment up to three years, or fine up to Rs 5 lakh, or both, and the heading of the section now reads “Penalty”. Read together, the two sections show the structure of the Act on this subject: one route to compensation for the person who suffers the loss, and a penalty on the person who abused access.

Section 72A is one of several provisions that the Jan Vishwas (Amendment of Provisions) Act, 2023 changed in the Information Technology Act, in force for this Act from 30 November 2023 by notification S.O. 4745(E) of 31 October 2023. It replaced imprisonment with a penalty in sections 33(2), 67C(2), 68(2), 72 and 72A, raised the monetary limits in sections 44, 45 and 70B(7), reduced the term in section 69B(4) to one year, or a fine up to Rs 1 crore, or both, and omitted section 66A, which the Supreme Court had struck down in 2015. A source that was written before November 2023 may therefore state an older penalty for these sections.

How to read a section citation

A reference such as section 66C of the IT Act points to a single numbered section of the Act, and the letter after the number marks a section that was inserted later between two existing numbers. The wording of the section heading tells a reader which part of the Act is involved. A heading that speaks of penalty or compensation, as in section 43 and section 43A, belongs to the civil chapter and leads to an adjudicating officer. A heading that speaks of punishment, as in sections 66 to 67B, belongs to the criminal chapter and leads to the police and the courts. The same set of facts can fall under both, which is why a single online fraud is often described with two or three section numbers at once.

A second habit helps with older material. Because sections 66A to 66F, 67A, 67B and 67C and the whole of Chapter XIIA were added when the Act was amended, a book or a web page that was written before 2009 will not mention them, and a page written between 2009 and 2015 will treat section 66A as law. Checking the date of the source against the dates in this guide takes a minute and avoids most errors.

Other laws that work alongside the Act

The Indian Penal Code and the Indian Evidence Act 1872 were replaced by the Bharatiya Nyaya Sanhita and the Bharatiya Sakshya Adhiniyam, which came into force on 1 July 2024. References in the IT Act and in older books to the Penal Code and the Evidence Act must therefore be read with that change in mind: the electronic record provisions that the IT Act wove into the Evidence Act now sit within the Bharatiya Sakshya Adhiniyam, and cases that were already pending on the commencement date continue under the old law. Practical guidance on reporting an offence, and on the recorded case reports that interpret these sections, is kept on separate pages, as is the wider subject of cyber crime in India. For a short definition of the field, see what cyber law is.

Frequently asked questions