Information Technology Act, 2000
सूचना प्रौद्योगिकी अधिनियम, 2000
India's core cyber law — governs electronic transactions and cyber offences
The Information Technology Act, 2000 gives legal recognition to electronic records and digital signatures, defines cyber offences, and regulates intermediaries such as social media platforms, cloud providers and ISPs. It is complemented by the IT Rules 2021 and the Digital Personal Data Protection Act, 2023.
Key provisions
Section 43 — Damage to computer, data or system
Civil compensation for unauthorised access, downloading data, introducing viruses, or denial of service. No upper limit.
Section 43A — Reasonable security practices
A body corporate handling sensitive personal data is liable to pay damages for negligent handling. Complemented by the DPDP Act, 2023.
Section 66 — Computer-related offences
Dishonest or fraudulent acts covered by Section 43 punishable with imprisonment up to 3 years or fine up to ₹5 lakh, or both.
Section 66C — Identity theft
Fraudulent use of another person's electronic signature, password or unique identifier: up to 3 years imprisonment and ₹1 lakh fine.
Section 66D — Cheating by personation using computer
Phishing, online impersonation and OTP frauds: up to 3 years and ₹1 lakh fine.
Section 67 / 67A / 67B — Obscenity offences
Publishing or transmitting obscene material, sexually explicit acts, or child sexual abuse material through electronic media.
Section 79 — Safe harbour for intermediaries
Platforms are exempt from liability for user content if they comply with due diligence and IT Rules 2021 (grievance officer, takedown timelines).
How to file a cyber crime complaint
Report online at cybercrime.gov.in — India's national cybercrime reporting portal. For financial fraud call 1930 within 24 hours to freeze the transaction. Also file an FIR at the nearest police station (any officer of the rank of Inspector can investigate cyber offences under Section 78 IT Act). Preserve evidence: screenshots, transaction IDs, URLs, headers.
Data protection and DPDP Act
The Digital Personal Data Protection Act, 2023 supplements the IT Act for personal data. Data fiduciaries must obtain consent, implement security safeguards, notify breaches to the Data Protection Board, and honour data principal rights (access, correction, erasure).
Scope and applicability
The Information Technology Act, 2000 recognises electronic records and signatures and creates offences and intermediary-related obligations, supplemented by rules, directions and other criminal and data-protection laws.
Key definitions
- Electronic record
- Data, record, image or sound stored, received or sent in electronic form as defined by the Act.
- Intermediary
- A person who receives, stores or transmits an electronic record on behalf of another, within the statutory definition.
Practical procedure
- 1For cyber fraud, immediately contact the bank or payment provider and report through 1930 or the national portal.
- 2Preserve transaction IDs, headers, logs, messages and device details without altering originals.
- 3Report cognizable offences to police; platform reporting does not replace an FIR where one is required.
Deadlines and timing
- Speed is critical for financial-fraud fund freezing, but the Act does not prescribe one universal victim-reporting period.
- Intermediary and incident-reporting deadlines depend on current rules and CERT-In directions.
Practical examples
- A phishing transfer should be reported immediately to the bank and 1930.
- Unauthorised access, identity misuse and cheating may engage multiple statutes depending on facts.
Related judgments
Shreya Singhal v. Union of India (2015)
The Supreme Court struck down Section 66A. The deleted provision must not be presented as a valid offence.
Open official judgment portalRelated guides
Who typically needs this
- Victims of online fraud, phishing, or identity theft
- Businesses running websites, apps, or SaaS platforms
- Companies handling personal data of Indian users
- Startups drafting privacy policies and terms of service
Frequently asked questions
How do I report a cyber crime in India?
Report online at cybercrime.gov.in. For financial fraud, call the helpline 1930 within 24 hours so that the bank can freeze the transaction. Also file an FIR at the nearest police station — cyber offences can be investigated by any officer above the rank of Inspector.
What was Section 66A and is it still in force?
Section 66A punished sending 'offensive' messages online. It was struck down by the Supreme Court in Shreya Singhal v. Union of India (2015) as unconstitutional and violative of Article 19(1)(a). It is no longer in force.
Are social media platforms liable for user content?
Under Section 79 IT Act read with the IT Rules, 2021, intermediaries enjoy safe harbour if they perform due diligence — appointing a grievance officer, removing unlawful content within 36 hours of a court/government order, and complying with traceability requirements for significant social media intermediaries.
Related laws
Have a specific question about IT Act?
Kanoon-AI gives free, plain-English legal information grounded in Indian statutes and case law. Not a substitute for a lawyer.
Ask the AI assistant