Cyber law notes: definition, importance and types of cyber law in India

Definition of cyber law

Cyber law is the body of rules that apply to conduct carried out through computers, networks and electronic records. These cyber law notes use the term in the sense it has in Indian practice. It is not a single code with that name. It is the collection of provisions, chiefly in the Information Technology Act 2000, that give electronic records and signatures legal effect, define offences committed through computers, and set out who is responsible for material that passes through a network.

Students often ask whether cyber law is a separate branch of law. The more accurate view is that it is a field that cuts across several branches. A contract made by e-mail is a question of contract law. A stolen password is a question of criminal law. A web host’s duty to remove a post is a question of liability. What the Information Technology Act 2000 adds is a set of definitions and special rules that make the older branches work when the facts are electronic. A fuller account of the field is on the page that explains what cyber law is.

Key terms in cyber law notes, as the Act defines them

Many examination answers and many practical disputes turn on one definition. The table gives the six definitions that come up most often, in the words of section 2 of the Act, so that they can be learned in the form the statute uses.

Two points follow from these definitions. The definition of a computer is wide: it covers any electronic, magnetic, optical or other high-speed data processing device or system, and it is not tied to a desktop machine, so a smartphone or a server falls inside it. And the definition of an intermediary is a list of named kinds of business as well as a general description, which is why the question of whether a particular platform is an intermediary is usually answered by reading the list.

The need of cyber law

The need of cyber law arose from a gap. Before 2000, most Indian statutes assumed that a document was a paper document, that a signature was a handwritten mark and that a crime had a place. None of these assumptions carries over to a network. An e-mail has no original in the old sense; a digital contract has no pen and ink; a fraud committed from one State can reach a victim in another within seconds. Without rules, a court asked to enforce an electronic contract or to punish an online fraud would have had no clear provision to apply.

The Information Technology Act 2000 closed the gap in specific ways. Section 4 provides that where any law requires information to be in writing or in typewritten or printed form, the requirement is satisfied if the information is rendered or made available in an electronic form and is accessible so as to be usable for a subsequent reference. Section 5 does the same for signatures: where a law requires authentication by signature, authentication by an electronic signature affixed in the manner prescribed by the Central Government satisfies it. Section 3 describes how a subscriber authenticates an electronic record, using an asymmetric crypto system and a hash function. These are the provisions that make an electronic record and a paper record equal for legal purposes, and they explain a large part of the need of cyber law in commercial life.

The same need appears on the criminal side. A person who dishonestly uses another’s password, cheats by personating someone online, or publishes obscene material in electronic form was not described by any of the older offences in terms that fitted the facts. Chapter XI of the Act now names those offences and fixes the punishment for each. The list is set out in the guide to the IT Act 2000, and the pattern in which these offences are recorded and reported is covered under cyber crime in India.

The importance of cyber law

The importance of cyber law can be put in four practical points. First, it gives certainty to commerce. Section 10A provides that where, in forming a contract, the communication of proposals, the acceptance of proposals and the revocation of proposals and acceptances are expressed in electronic form or by means of an electronic record, the contract is not to be deemed unenforceable solely on the ground that electronic means were used. A business that sells online, and a customer who buys, can rely on that rule.

Second, it supports government services. The chapters on electronic governance provide for the retention of electronic records, the publication of rules in the Electronic Gazette and the use of electronic records and signatures in government and its agencies. Third, it protects people and systems: the compensation provisions allow a person whose computer or data has been damaged to claim compensation, and the offence provisions allow the State to punish the person responsible. Fourth, it allocates responsibility for what passes through a network. Section 79 gives an intermediary exemption from liability for third party information that it hosts or makes available, on conditions, so that a platform is not automatically answerable for everything a user posts.

A student writing notes on cyber law should note that the importance of cyber law is not the same thing as the importance of any single section. The subject matters because it supplies the rules by which electronic evidence, electronic contracts and electronic offences can be handled by the ordinary courts.

Types of cyber law

The subject is easiest to learn when it is divided by function. Four types cover most of what the Act and the rules under it do.

Rules on electronic records and signatures

The first type deals with the validity and attribution of electronic records and signatures. It includes the legal recognition of electronic records and signatures, the rules on attributing a record to its originator, on acknowledgement of receipt and on the time and place of despatch and receipt, the framework for secure electronic records, and the system of certifying authorities and electronic signature certificates. Its purpose is to let electronic transactions be trusted and proved.

Rules on cyber crime

The second type is the criminal law of the subject: unauthorised access and damage, identity theft, cheating by personation, violation of privacy, cyber terrorism, and publication of obscene or sexually explicit material. These are the offences collected in Chapter XI, with the procedure for investigation in section 78, which places it with a police officer not below the rank of Inspector.

Rules on data protection and privacy

The third type concerns personal data. Within the Act, section 43A makes a body corporate that handles sensitive personal data liable to pay damages by way of compensation if it is negligent in maintaining reasonable security practices and thereby causes wrongful loss or wrongful gain, and section 72A punishes a person who, under a lawful contract, gains access to personal information and misuses it. Newer legislation on personal data now sits alongside these provisions, and a student should check the current position instead of relying on older notes.

Rules on intermediaries

The fourth type governs platforms and service providers. Section 79 provides the exemption described above, and section 67C requires an intermediary to preserve and retain specified information for the period and in the manner the Central Government prescribes. The type matters because most online harm passes through an intermediary of some kind.

What the Act does not cover

No set of cyber law notes is complete without the limits of the Act. Section 1(4) provides that nothing in the Act applies to the documents or transactions specified in the First Schedule, and the Central Government may amend that Schedule by notification. As the Schedule stands, it lists five categories: a negotiable instrument other than a cheque, as defined in section 13 of the Negotiable Instruments Act 1881; a power of attorney as defined in section 1A of the Powers of Attorney Act 1882; a trust as defined in section 3 of the Indian Trusts Act 1882; a will as defined in the Indian Succession Act 1925, including any other testamentary disposition; and any contract for the sale or conveyance of immovable property or any interest in such property.

The practical result is that an electronic record or signature does not have the legal recognition of sections 4 and 5 for these documents. A will cannot be made valid by an electronic signature under the Act, and a contract to sell land is not saved by section 10A. A reader who learns the general rule that electronic contracts are valid should also learn this exception, because it is the point most often missed.

Distinctions that examinations and practice test

Cyber law notes that only list definitions leave out the comparisons on which questions are usually set. Four are worth learning in the words of the statute.

Digital signature and electronic signature

Section 3 describes authentication of an electronic record by a subscriber affixing a digital signature, using an asymmetric crypto system and a hash function. The 2008 amendment widened the idea: section 2(1)(ta) defines an electronic signature as authentication of an electronic record by a subscriber by means of the electronic technique specified in the Second Schedule, and says that it includes a digital signature. A digital signature is therefore one kind of electronic signature, and the Act now speaks of the wider term.

Compensation and punishment

The Act separates civil and criminal liability. Chapter IX concerns penalties, compensation and adjudication, and the adjudicating officer appointed under it hears claims in which the damage does not exceed Rs 5 crore. Chapter XI concerns offences, which the police investigate and the criminal courts try. The same act can lead to both, as the section on offences in the guide to the Act explains.

The offender and the intermediary

An intermediary is not an offender merely because third party information passed through its service. Section 79 states the conditions on which it keeps its exemption and the circumstances in which it loses it, for example when it fails to remove or disable access to material expeditiously after receiving actual knowledge or a notification from the appropriate Government or its agency. The Supreme Court has read that condition narrowly: in Shreya Singhal v. Union of India (2015) it held that actual knowledge means a court order, or a notification of the appropriate Government or its agency that relates to the subjects in Article 19(2) of the Constitution.

Cyber law notes and the law as it now stands

Cyber law notes written before 2015 treat section 66A as a living offence, and notes written before 2009 do not know the family of sections from 66A to 66F at all. These cyber law notes follow the amended text. A reader comparing them with an older book should check the year of the book first.

How to use these notes on cyber law

Notes on cyber law are most useful when they are tied to the text. A reliable method is to learn the definition first, then the section that gives it effect, then one example of its application. For the definition of an intermediary, the section is 79 and the practical question is whether a platform has done what the section requires to keep its exemption. For the definition of an electronic record, the section is 4 and the practical question is whether a document in electronic form is accessible so as to be usable for a subsequent reference.

Dates matter in this subject. The Act was passed in 2000 and amended with effect from 27 October 2009; the Appellate Tribunal for the Act has been the Telecom Disputes Settlement and Appellate Tribunal since 26 May 2017; and the Bharatiya Nyaya Sanhita and the Bharatiya Sakshya Adhiniyam replaced the Indian Penal Code and the Indian Evidence Act on 1 July 2024. A set of notes that does not state the date to which it is current can mislead on exactly these points. Decisions of the courts that apply the sections are gathered under case reports, and the technical side of handling electronic evidence is explained under computer forensics.

Frequently asked questions