Information Technology Act, 2000 Guide
Explore the IT Act and legal concepts relating to electronic records and online activity. Check the current text and related legal framework.
सूचना प्रौद्योगिकी अधिनियम, 2000
India's core cyber law — governs electronic transactions and cyber offences
Overview: Information Technology Act, 2000
The Information Technology Act, 2000 gives legal recognition to electronic records and digital signatures, defines cyber offences, and regulates intermediaries such as social media platforms, cloud providers and ISPs. It is complemented by the IT Rules 2021 and the Digital Personal Data Protection Act, 2023.
This is a plain-English guide, not the statutory text. Check provisions against official legal sources, read our editorial policy, or research related judgments.
Focused section guides in English, Hindi and Gujarati
Prepare your records and choose the next resource
Useful records to organise for Information Technology Act, 2000. These prompts are not a mandatory filing checklist.
- Transaction references, original messages, URLs and the reporting chronology.
- Copies of bank, police or portal acknowledgements, where relevant.
- Redacted working copies; never include passwords, OTPs or access tokens in an AI question.
Frequently asked questions
What is the difference between IT Act Sections 43 and 66?
Section 43 addresses specified acts done without permission, including unauthorised access, copying data and introducing a computer contaminant, through compensation liability. Section 66 concerns acts referred to in Section 43 when done dishonestly or fraudulently. An unauthorised-access allegation does not by itself establish every ingredient of the criminal offence.
What is the difference between Section 66C and Section 66D?
Section 66C concerns dishonest or fraudulent use of another person's electronic signature, password or other unique identification feature. Section 66D concerns cheating by personation using a communication device or computer resource. A phishing incident may require examining both provisions, depending on the facts; the labels are not interchangeable.
How do I report a cyber crime in India?
Report at cybercrime.gov.in. For financial fraud, call 1930 immediately, notify your bank using its official contact channel and complete the portal report promptly. Quick reporting can help authorities and intermediaries act, but cannot guarantee that funds will be frozen or recovered. Preserve records and seek police assistance where appropriate.
What was Section 66A and is it still in force?
Section 66A punished sending 'offensive' messages online. It was struck down by the Supreme Court in Shreya Singhal v. Union of India (2015) as unconstitutional and violative of Article 19(1)(a). It is no longer in force.
Are social media platforms liable for user content?
Section 79 protection is conditional, not automatic immunity. Under Rule 3(1)(d), the 2026 amendment changed the takedown period to three hours from receipt of actual knowledge through a competent court order or the specified written government intimation, effective 20 February 2026. This is not a universal deadline for every user complaint. Rule 4(2) first-originator identification applies to significant social media intermediaries primarily providing messaging services, subject to its specified orders and safeguards. Check the linked rules and obtain case-specific legal advice.
Short explanations in हिन्दी and ગુજરાતી
These are selected short explanations, not complete translations of this page or the statute. AI-assisted; individual advocate and qualified legal-translator review is pending.
हिन्दी में तीन छोटे उत्तर
AI-सहायता से तैयार संक्षिप्त व्याख्या; यह आधिकारिक या प्रमाणित अनुवाद नहीं है। व्यक्तिगत वकील और कानूनी अनुवादक की समीक्षा लंबित है।
IT Act की धारा 66C और 66D में क्या अंतर है?
धारा 66C पहचान की चोरी से संबंधित है, जैसे बेईमानी या कपट से किसी दूसरे के पासवर्ड या विशिष्ट पहचान का उपयोग। धारा 66D कंप्यूटर संसाधन या संचार उपकरण से किसी और का रूप धरकर छल करने से संबंधित है। कौन-सी धारा लागू होगी, यह वास्तविक तथ्यों और कानूनी तत्वों पर निर्भर है।
धारा 43 और 66 क्या एक ही बात हैं?
नहीं। धारा 43 कंप्यूटर या नेटवर्क से जुड़ी निर्दिष्ट अनधिकृत गतिविधियों और प्रतिकर से संबंधित है। धारा 66 में धारा 43 वाला कृत्य बेईमानी या कपट से करना महत्वपूर्ण है। हर तकनीकी घटना को एक जैसा अपराध न मानें; वास्तविक कार्रवाई और आशय जाँचें।
साइबर धोखाधड़ी के रिकॉर्ड कैसे तैयार रखें?
लेनदेन संदर्भ, मूल संदेश, वेबसाइट पते, बैंक से संपर्क और आधिकारिक शिकायत की प्राप्ति सुरक्षित रखें। वित्तीय धोखाधड़ी में बैंक तथा आधिकारिक रिपोर्टिंग माध्यम से संपर्क करने में AI उत्तर के लिए देरी न करें। किसी चैट में OTP, पासवर्ड या एक्सेस टोकन न डालें।
ગુજરાતીમાં ત્રણ ટૂંકા જવાબ
AIની મદદથી તૈયાર કરેલી ટૂંકી સમજ; આ સત્તાવાર કે પ્રમાણિત અનુવાદ નથી. વ્યક્તિગત વકીલ અને કાનૂની અનુવાદકની સમીક્ષા બાકી છે.
IT Actની કલમ 66C અને 66Dમાં શું તફાવત છે?
કલમ 66C ઓળખની ચોરી અંગે છે, જેમ કે બેઈમાની કે કપટથી બીજાના પાસવર્ડ અથવા વિશિષ્ટ ઓળખનો ઉપયોગ. કલમ 66D કમ્પ્યુટર સંસાધન કે સંચાર ઉપકરણથી બીજાનું રૂપ ધારણ કરીને છેતરપિંડી કરવા અંગે છે. લાગુ કલમ વાસ્તવિક હકીકતો અને કાનૂની તત્ત્વો પર આધારિત છે.
શું કલમ 43 અને 66 એક જ બાબત છે?
ના. કલમ 43 કમ્પ્યુટર કે નેટવર્ક સંબંધિત ચોક્કસ અનધિકૃત પ્રવૃત્તિઓ અને વળતર અંગે છે. કલમ 66માં કલમ 43નું કૃત્ય બેઈમાની કે કપટથી કરવું મહત્વનું છે. દરેક તકનીકી ઘટનાને સમાન ગુનો ન ગણો; વાસ્તવિક કૃત્ય અને આશય તપાસો.
સાયબર છેતરપિંડીના રેકોર્ડ કેવી રીતે સાચવવા?
વ્યવહારના સંદર્ભ, મૂળ સંદેશા, વેબ સરનામાં, બેંક સાથેનો સંપર્ક અને સત્તાવાર ફરિયાદની પહોંચ સાચવો. નાણાકીય છેતરપિંડીમાં બેંક અને સત્તાવાર રિપોર્ટિંગ માટે AI જવાબની રાહ ન જુઓ. ચેટમાં OTP, પાસવર્ડ કે એક્સેસ ટોકન ન આપો.
Key provisions of Information Technology Act, 2000
Section 43 — Damage to computer, data or system
Civil compensation for unauthorised access, downloading data, introducing viruses, or denial of service. No upper limit.
Section 43A — Reasonable security practices
The DPDP Act, 2023 provides for omission of Section 43A. Its operative status depends on commencement notifications; this guide does not independently verify the latest Gazette position. Check current official notifications before relying on this legacy provision.
Section 66 — Computer-related offences
Dishonest or fraudulent acts covered by Section 43 punishable with imprisonment up to 3 years or fine up to ₹5 lakh, or both.
Section 66C — Identity theft
Fraudulent use of another person's electronic signature, password or unique identifier: up to 3 years imprisonment and ₹1 lakh fine.
Section 66D — Cheating by personation using computer
Phishing, online impersonation and OTP frauds: up to 3 years and ₹1 lakh fine.
Section 67 / 67A / 67B — Obscenity offences
Publishing or transmitting obscene material, sexually explicit acts, or child sexual abuse material through electronic media.
Section 79 — Safe harbour for intermediaries
Section 79 provides conditional protection for third-party information, not blanket immunity. The intermediary must meet the statutory conditions and applicable due-diligence rules; the nature of its role and conduct matters.
How to file a cyber crime complaint
Report at cybercrime.gov.in. For financial fraud, call the national helpline 1930 immediately, notify your bank through its official channel, and complete the portal report promptly. Reporting can help route a transaction for action but does not guarantee that funds will be frozen or recovered. Preserve screenshots, transaction IDs, URLs and original messages; ask the police for an acknowledgement or FIR where appropriate. Section 78 of the IT Act sets the minimum rank for an officer exercising investigation powers under that Act.
Data protection and DPDP Act
The Digital Personal Data Protection Act, 2023 creates a framework for processing digital personal data, including obligations for data fiduciaries and rights for data principals. Its provisions have commencement dates set by notification; this guide does not independently verify the latest Gazette commencement position. Do not assume every duty or remedy is operational. Verify current notifications, Rules and official guidance on India Code and MeitY before relying on a specific obligation, deadline or complaint route.
Scope and applicability
The Information Technology Act, 2000 recognises electronic records and signatures and creates offences and intermediary-related obligations, supplemented by rules, directions and other criminal and data-protection laws.
Key definitions
- Electronic record
- Data, record, image or sound stored, received or sent in electronic form as defined by the Act.
- Intermediary
- A person who receives, stores or transmits an electronic record on behalf of another, within the statutory definition.
Practical procedure
- 1For cyber fraud, immediately contact the bank or payment provider and report through 1930 or the national portal.
- 2Preserve transaction IDs, headers, logs, messages and device details without altering originals.
- 3Report cognizable offences to police; platform reporting does not replace an FIR where one is required.
Deadlines and timing
- Speed is critical for financial-fraud fund freezing, but the Act does not prescribe one universal victim-reporting period.
- Intermediary and incident-reporting deadlines depend on current rules and CERT-In directions.
Practical examples
- A phishing transfer should be reported immediately to the bank and 1930.
- Unauthorised access, identity misuse and cheating may engage multiple statutes depending on facts.
Related judgments
Shreya Singhal v. Union of India (2015)
The Supreme Court struck down Section 66A. The deleted provision must not be presented as a valid offence.
Open official judgment portalRelated guides
Who typically needs this
- Victims of online fraud, phishing, or identity theft
- Businesses running websites, apps, or SaaS platforms
- Companies handling personal data of Indian users
- Startups drafting privacy policies and terms of service
Related laws
Have a specific question about IT Act?
Kanoon-AI gives free, plain-English legal information grounded in Indian statutes and case law. Not a substitute for a lawyer.
Ask the AI assistant