What a cyber lawyer does
Cyber law is less a distinct field than an intersection of several, including contract, criminal law, evidence, intellectual property and data protection. A lawyer who works in the area applies those fields to facts that are electronic. The work falls into four broad parts: advice, drafting, representation and compliance.
Advice covers questions such as whether an electronic contract is enforceable, what a company must do about customer data, and what to do after a data breach or an online fraud. Drafting covers terms of use, privacy notices and consent notices, which under the Digital Personal Data Protection Act 2023 must be clear and must explain the specific purpose of the processing. Representation covers criminal cases under the Information Technology Act and the general criminal law, and proceedings for compensation. Compliance covers the duties of a Data Fiduciary, the conditions of the intermediary exemption in section 79, and the preservation of information.
The forums in which the work is done
Criminal matters go to the criminal courts, and the police investigate: under section 78 of the Information Technology Act, a police officer not below the rank of Inspector investigates an offence under the Act. Claims for compensation for damage to a computer or data go first to an adjudicating officer, who must be not below the rank of Director to the Government of India or an equivalent State officer and who hears claims where the injury or damage does not exceed Rs 5 crore. An appeal from the adjudicating officer lies to the Telecom Disputes Settlement and Appellate Tribunal, which is also the Appellate Tribunal under the Digital Personal Data Protection Act 2023.
Under that Act, the Data Protection Board of India inquires into breaches and may impose penalties after giving the person a hearing. A lawyer who practises in the area therefore needs to know the procedures of the criminal courts, the adjudication process and the Board.
Cyber jurisdiction: offences in cyberspace that begin outside India
Cyberspace has no border, so a cyber lawyer meets the question of jurisdiction early. The Information Technology Act answers it in two places. Section 1(2) says that the Act extends to the whole of India and, save as otherwise provided, applies also to any offence or contravention under it committed outside India by any person. Section 75 adds that the Act applies to such an offence or contravention irrespective of the person’s nationality, if the act or conduct constituting it involves a computer, computer system or computer network located in India. Whether a particular court can try a given case is a question of procedure that depends on the facts, and it is for the advocate and the court.
What the work requires
The law is only half of it. A cyber lawyer needs to understand how the technology works, enough to follow an expert report on digital evidence, to ask the right questions of a technical witness and to explain the facts to a court. The page on computer forensics describes the evidence that these cases depend on. The lawyer also has to keep track of change, because the law has moved quickly: the criminal and evidence statutes were replaced in 2024 and the data protection framework was completed in 2025.
Anyone who needs legal help with an online incident or a data protection question should consult a qualified advocate. The pages of this site describe the law and are not a substitute for advice. For readers interested in the profession itself, the page on how to become a cyber lawyer sets out the route.