The Information Technology Act, 2000

What the Information Technology Act is

The Information Technology Act, 2000 is Act 21 of 2000, in force since 17 October 2000. It began as a law giving legal recognition to electronic records and digital signatures, and to the certifying authorities that issue them. Its cyber crime provisions came largely later: the Information Technology (Amendment) Act, 2008 — Act 10 of 2009, in force from 27 October 2009 — added most of the offences now in sections 66A to 66F and 67A to 67B, and the data-protection compensation rule in section 43A.

It was not part of the 2024 criminal law reforms and was not renumbered. Some conduct it punishes is also an offence under the Bharatiya Nyaya Sanhita: impersonating someone online to cheat them, for instance, can engage both section 66D of this Act and the cheating provisions of the Sanhita. Where the Act still refers to the Code of Criminal Procedure or the Indian Penal Code, section 8 of the General Clauses Act, 1897 reads those references as references to the provisions that replaced them, unless a different intention appears.

Section 43 and section 66: the same act, civil or criminal

Section 43 lists acts done to a computer, system or network "without permission of the owner or any other person who is in charge" — accessing it, downloading or copying data, introducing a virus, damaging data, disrupting it, denying access to authorised users, tampering to charge services to someone else’s account, and destroying or altering source code, among others. The consequence is civil: the person is "liable to pay damages by way of compensation to the person so affected".

Section 66 turns exactly the same acts into a crime when they are done "dishonestly or fraudulently", carrying imprisonment up to three years, or a fine up to ₹5 lakh, or both. So the question that separates a claim for compensation from a criminal case is not what was done to the computer, but the state of mind in which it was done.

A compensation claim under section 43 goes to an adjudicating officer, whose jurisdiction covers claims for damage up to ₹5 crore; above that, the competent court (s. 46).

The cyber offences in the IT Act, and their punishments

The offences people search are in Chapter XI. Each line below is read from the section as amended.

What changed in 2023: section 66A, section 72A and section 43A

Section 66A punished sending "grossly offensive" or "menacing" messages, and messages sent to cause "annoyance or inconvenience". The Supreme Court struck it down on 24 March 2015. It nonetheless stayed printed in the Act until the Jan Vishwas (Amendment of Provisions) Act, 2023 formally omitted it, with effect from 30 November 2023. There is no section 66A to be charged under.

The same Act changed section 72A — disclosure, in breach of a lawful contract, of personal information obtained while providing services — from an offence into a civil penalty. Its heading was changed from "Punishment" to "Penalty", and the consequence is now liability to "penalty which may extend to twenty-five lakh rupees". Most pages still give it as imprisonment up to three years or a fine up to ₹5 lakh, which has not been the law since 30 November 2023.

Section 43A, which makes a company that negligently fails to protect sensitive personal data liable to pay compensation, is still in the Act as India Code carries it. But section 44(2)(a) of the Digital Personal Data Protection Act, 2023 provides that it "shall be omitted", and that Act comes into force provision by provision on dates the Central Government notifies. Before relying on section 43A, check whether that part of the Data Protection Act has been brought into force.

Whether an IT Act offence is cognizable or bailable

The IT Act sets its own rule for the offences it treats most commonly. Under section 77B, an offence punishable with imprisonment of three years and above is cognizable, and an offence punishable with three years is bailable. That covers sections 66, 66B, 66C, 66D and 66E: each is cognizable and bailable.

For the offences with longer maximums, section 77B says nothing about bail, and the general classification in Part II of the First Schedule to the Bharatiya Nagarik Suraksha Sanhita applies. Offences punishable with more than three and up to seven years are cognizable, non-bailable and triable by a Magistrate of the first class; offences punishable with more than seven years or with life — cyber terrorism under section 66F — are cognizable, non-bailable and triable by a Court of Session.

Any offence under the Act must be investigated by a police officer not below the rank of Inspector (s. 78). Offences other than those carrying life or more than three years may be compounded by the court, but not where the offence was committed against a child under eighteen or a woman, or affects the country’s socio-economic conditions (s. 77A).

If you have been defrauded or harassed online

This page explains the statute. If money has been taken from you online, the most important step is speed, not the section number: call 1930, the national cyber crime helpline, or report at cybercrime.gov.in straight away, and tell your bank the same day. Money can be traced and held only while it is still moving.

Our cyber fraud tracker sets out what happens to those reports and why so little money comes back, and our guide to loan app harassment covers threats, morphed images and abusive recovery calls, where sections 66C, 66D and 66E of this Act are most often relevant.