What a grey hat hacker is
A grey hat hacker is a person with security skills who sits between the white hat, who works with permission, and the black hat, who attacks for harm or gain. A grey hat finds weaknesses in systems without being asked, and then may tell the owner, publish the finding, or do nothing. The label is a description by the person who uses it, not a legal category, and no statute treats a grey hat differently from anyone else who accesses a system.
The term covers a range. At one end is a researcher who tests a public website without permission and reports a flaw to its owner. At the other is a person who enters a system to look around, take a copy of data or leave a mark. The law looks at what was done and with what intent, not at the label.
What the IT Act says
Section 43 of the Information Technology Act 2000 makes a person liable to pay damages by way of compensation to the person affected if, without the permission of the owner or the person in charge of a computer, computer system or computer network, he accesses or secures access to it, copies data from it, introduces a contaminant, damages or disrupts it, or denies access to authorised users. The section does not mention motive. Good intentions are therefore not an answer to the question the section asks, which is whether there was permission.
Section 66 adds a criminal offence where the act is done dishonestly or fraudulently, with imprisonment up to three years, or a fine up to Rs 5 lakh, or both. Whether a particular access was dishonest or fraudulent depends on the facts and is decided by the court, and a person who acted openly and reported the weakness is in a different position from one who copied data for use. The difference matters at the stage of prosecution, but it does not make the access authorised.
Why the position is risky for researchers
The risk for a well-meaning researcher is that the owner may treat the access as an attack. Even a short test can disrupt a service, expose personal data or trigger an alert, and the owner can complain to the police. The statute gives no general protection for research done without permission. A researcher who wants to act safely should ask for permission first, and where that is not possible should limit the test to what is needed to show that the weakness exists.
There are two practical rules. Do not copy, keep or share data seen during a test, because the more that was taken, the harder it is to describe the act as harmless. And report promptly to the owner or to the national agency for incident response, keeping a record of what was found and when.
Related pages
The same distinctions run through the guide to the IT Act 2000. The way offences of this kind are recorded in the official figures is in the page on cyber crime in India, and the way a complaint is made is in the guide on how to file a cyber crime complaint online.