Cyber Law explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
The Information Technology Act 2000 (IT Act) is India's primary legislation governing cyber crime, electronic commerce, digital signatures, and data protection. It was significantly amended by the Information Technology (Amendment) Act 2008 to address emerging cyber threats and technologies.
Key Objectives of IT Act 2000
- Legal recognition of electronic documents and digital signatures
- Prevention and punishment of cyber crimes
- Regulation of Certifying Authorities for digital signatures
- Establishment of adjudicatory mechanism for cyber law violations
- Data protection obligations on intermediaries
Key Provisions
| Section | Offence | Punishment |
|---|---|---|
| Section 43 | Unauthorized access to computer; damage/download without permission | Civil liability — compensation up to Rs.1 crore |
| Section 66 | Computer related offences (hacking, data theft) | Imprisonment up to 3 years + fine up to Rs.5 lakh |
| Section 66B | Dishonestly receiving stolen computer resource | Imprisonment up to 3 years and/or fine up to Rs.1 lakh |
| Section 66C | Identity theft (fraudulent use of electronic signature/password) | Imprisonment up to 3 years + fine up to Rs.1 lakh |
| Section 66D | Cheating by personation using computer | Imprisonment up to 3 years + fine up to Rs.1 lakh |
| Section 66E | Violation of privacy (publishing private images) | Imprisonment up to 3 years + fine up to Rs.2 lakh |
| Section 66F | Cyber terrorism | Imprisonment for life |
| Section 67 | Publishing obscene material in electronic form | First offence: 3 years + Rs.5 lakh; Second: 5 years + Rs.10 lakh |
| Section 67A | Publishing sexually explicit material electronically | First: 5 years + Rs.10 lakh; Second: 7 years + Rs.10 lakh |
| Section 67B | Child pornography online | First: 5 years + Rs.10 lakh; Second: 7 years + Rs.10 lakh |
| Section 72 | Breach of confidentiality and privacy by service providers | Imprisonment up to 2 years + fine up to Rs.1 lakh |
Section 66A: Struck Down
Section 66A (punishment for sending offensive messages through communication services) was struck down as unconstitutional by the Supreme Court in Shreya Singhal v. Union of India (2015) for violating freedom of speech under Article 19(1)(a). It was found vague and overbroad.
Adjudication Under IT Act
For civil violations under Section 43:
- Complaint to Adjudicating Officer (AO) appointed by Central/State Government
- AO can award compensation up to Rs.5 crore (revised by Amendment Act)
- Appeal from AO order lies to Cyber Appellate Tribunal (CAT)
- Appeal from CAT lies to High Court
CERT-In (Computer Emergency Response Team)
CERT-In is India's national cybersecurity agency under the Ministry of Electronics and IT. Responsibilities:
- Coordinate response to cyber security incidents
- Issue guidelines and vulnerability notes
- Mandating cyber incident reporting (organizations must report incidents within 6 hours)
- Share threat intelligence
CERT-In's 2022 Directions mandate extensive logging, maintaining VPN logs, and mandatory 6-hour reporting of cybersecurity incidents by specified organizations.
Intermediary Liability (Section 79)
Online platforms (social media, e-commerce, cloud providers) have safe harbor protection from liability for third-party content if they:
- Do not initiate the transmission or select the recipient
- Do not modify the information
- Observe due diligence as prescribed in IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021
- Remove/disable access to content on actual knowledge or government/court order
Key Facts About Cyber Law
- Applies in: All states across India, under the relevant central law.
- Mode: Mostly online via the official government portal.
- Typical timeline: Ranges from a few days to a few weeks depending on the case.
- Non-compliance: May attract penalties, interest or late fees.
- Expert help: TaxClue completes the entire process end to end for you.
What are the key cyber crimes under Section 66 of the IT Act?
Section 66 covers computer-related offences including: hacking (unauthorized access to computer), dishonest data theft, destruction or modification of data without permission, and any act causing wrongful loss or gain through computers. Punishment is imprisonment up to 3 years and/or fine up to Rs.5 lakh.
Is Section 66A of the IT Act still valid?
No. Section 66A was struck down by the Supreme Court in Shreya Singhal v. Union of India (2015) as unconstitutional for violating freedom of speech. The Court held it was vague and excessively broad, potentially criminalizing legitimate speech. The section is no longer enforceable.
Over 90% of compliance penalties in India arise from missed due dates — timely handling can save businesses thousands of rupees each year.
Cyber Law: a key compliance topic in Indian tax and corporate law that businesses and individuals must understand to remain compliant.