When a website disappears from Indian networks overnight, when a messaging platform is told to identify the first sender of a message, and when a company is ordered to compensate customers whose card data leaked from its servers, three different legal instruments are usually doing the work, and all three sit inside one statute. That statute is the Information Technology Act 2000, and its long title announces a far narrower purpose: legal recognition for transactions carried out by electronic data interchange and other means of electronic communication, commonly called electronic commerce. The distance between that long title and the uses the Act is put to is the subject of this article. A reader who works through it will be able to identify which provisions of a commerce statute ended up governing speech, surveillance and platform liability, which of those provisions were in the Act when it was enacted and which arrived eight years later, and where the operative detail lives, because on this statute the detail very often lives in rules and in a judgment rather than in the sections themselves. The wider field within which the Act sits, and the statutes that surround it, are mapped in the complete guide to technology law in India, which this pillar supports and does not repeat.

The claim that organises everything that follows is simple enough to state in one sentence. The Information Technology Act 2000 was written to make digital documents legally valid, and it has become the statute under which content is blocked, communications are intercepted and platforms are held liable, with every one of those governing functions resting on provisions inserted by an amendment in 2008 and elaborated by rules made under the Act since. That is why the Act rewards being read as two statutes wearing one cover. The first statute, enacted in 2000, is a recognition statute: it tells courts, registries, banks and contracting parties that an electronic record is not legally inferior to paper. The second statute, layered over the first in 2008, is a control statute: it defines offences of content and intrusion, arms the executive with interception and blocking powers, and conditions the immunity of the platforms through which nearly all online speech travels. Most public argument about the Act confuses the two, praising or blaming the whole for what only one layer does. Separating them is the fastest route to understanding either.

The problem the Act was drafted to solve

At the end of the twentieth century, Indian law ran on paper in ways that were not merely customary but statutory. Contracts could be formed orally or in writing, yet the machinery of proof, stamping, filing and registration presumed documents that could be produced, attested and archived in physical form. The Indian Evidence Act, 1872 organised admissibility around documents and oral testimony about them. The Bankers’ Books Evidence Act, 1891 allowed certified copies of bankers’ books to be received in evidence, a concession drafted for ledgers. Commercial practice, meanwhile, had moved: banks were computerising their branches, businesses were exchanging purchase orders by electronic data interchange, and the first generation of Indian internet companies was contracting with customers it would never meet, through screens it did not control. Every one of those transactions rested on records that the law had never expressly recognised. A party who wished to escape an inconvenient bargain had an argument available that the record of it was not a document at all, or that a requirement of writing in some other statute had not been satisfied.

The international system reached the problem first. The United Nations Commission on International Trade Law adopted the Model Law on Electronic Commerce in 1996, and the General Assembly of the United Nations recommended it to member states by a resolution dated 30 January 1997. The model law’s technique was functional equivalence: instead of rewriting every statute that demanded writing, a signature, an original or retention of a record, the model law stated the function each paper requirement performed and declared the electronic equivalent legally effective when it performed the same function to the same standard. India’s drafting followed that template closely. The Department of Electronics prepared a draft in 1998, the Information Technology Bill was introduced in the Lok Sabha on 16 December 1999, and after examination by the Parliamentary Standing Committee the bill was passed by both Houses in May 2000. The resulting Act, the Information Technology Act, 2000 (Act 21 of 2000), received the assent of the President on 9 June 2000 and was brought into force on 17 October 2000.

The position the Act displaced deserves a paragraph, because it explains the urgency its sponsors felt. Before 2000, Indian law had no general answer to the simplest electronic questions. A contract concluded by an exchange of messages was vulnerable to the objection that the Indian Contract Act, 1872 had been written for a world of paper and speech and that its rules on communication of proposals and acceptances, applied to machines, produced results no court had settled. A computer printout tendered in evidence had to run the gauntlet of the Indian Evidence Act, 1872, whose scheme of primary and secondary evidence had been built around originals, and litigants were left arguing from provisions designed for quite other material, with the Bankers’ Books Evidence Act, 1891 offering a narrow harbour for banking records alone. A signature made by cryptographic means had no legal existence at all. The software and services industry, whose contracts were increasingly negotiated, performed and delivered across networks, was working inside a legal vacuum at home while its clients abroad operated under the UNCITRAL framework and the statutes it had inspired, and it was that asymmetry, the fear of being the market whose law did not recognise the medium its exports travelled on, that moved the statute from a law reform topic to a trade priority.

India was, on the usual count, the twelfth country in the world to enact a dedicated information technology statute, and the speed of the enactment by the standards of Indian legislation, from introduction in December 1999 to assent in June 2000, reflected a government that regarded the statute as trade infrastructure whose absence would cost the software and services industry contracts, rather than as a charter for the internet age. The drafting record explains several of the Act’s silences. The bill was a government measure in the fullest sense, prepared inside the new Ministry of Information Technology under its minister, Pramod Mahajan, worked over by an inter-ministerial process in which the commerce interest pressed for a statute that would satisfy India’s trading partners that electronic transactions here had legal standing, and then examined by the Parliamentary Standing Committee on Science and Technology, Environment and Forests before passage. The concerns that animated that process were the concerns of 1999: whether an electronic offer and acceptance could bind, whether a digital signature could be trusted across a courtroom, whether a government department could accept a form it never touched. The concerns that dominate the statute’s later life, the governance of mass speech and the surveillance of encrypted communication, were present only at the margins of the record, because the internet they concern had not yet been built in India. A statute’s drafting history is not an excuse for its later uses, but it is evidence of design, and the design here was a trade and administration measure. When readers ask why the speech and surveillance law of India lives inside a commerce statute with a long title about electronic data interchange, the honest answer is that nobody moved it: the functions accumulated in the statute that already dealt with computers, because that is where amendment bills on computers naturally go, and each addition was easier than building a new statutory home for it.

As enacted, the statute was compact by modern standards: ninety four sections arranged in thirteen chapters, with four schedules that amended other laws. Its centre of gravity was unmistakable. The great bulk of its length concerned the recognition of electronic records and signatures, the machinery for certifying signatures, and the conduct of government business by electronic means. It contained an offences chapter, because a recognition statute that ignored forgery and intrusion would have been incomplete, and a chapter of civil liability for damage to computers. Its state powers were confined to a single, little noticed provision: the original Section 69 empowered the Controller of Certifying Authorities, where satisfied on grounds of sovereignty, security, friendly relations or public order, to direct a government agency to intercept information transmitted through a computer resource, and obliged subscribers to extend facilities to decrypt it. It contained no power to block access to websites, and no machinery for collecting traffic data. It contained no developed law of platform liability, because in 2000 the platform, in the sense of a service hosting the speech of millions of strangers, was not yet the organising fact of the internet in India. The blocking of websites, when governments began to demand it within three years of commencement, had to be improvised outside the statute’s text: a notification issued by the Department of Information Technology in 2003 designated the Computer Emergency Response Team as the authority to direct blocking after verifying complaints, resting on the government’s general powers and on the obscenity offence, and its first exercise, against a discussion group hosted abroad, collaterally blocked an entire global groups service for Indian users. Remembering what the original Act did and did not contain is essential, because nearly every contested feature of the modern statute was either added in 2008 or transformed there from a narrow ancestor, and the debate about those features is a debate about the amendment of 2008 and the rules that followed it, not about the settlement of 2000.

How the Information Technology Act 2000 is built

The Act opens with its extent and its exclusions, and both repay attention. Section 1 extends the Act to the whole of India and, read with Section 75, gives it an extraterritorial reach that is unusual in its breadth, since the Act applies also to offences and contraventions committed outside India where the conduct involves a computer, a computer system or a computer network located in India. Section 1 also disapplies the Act to a small set of transactions listed in the First Schedule, a carve-out inserted because some paper instruments carry legal consequences that Parliament was not prepared to move into electronic form by a side wind. The excluded categories are negotiable instruments other than cheques, powers of attorney, trusts, wills, and contracts for the sale or conveyance of immovable property or of an interest in such property. A will cannot be made by electronic record under this Act, and neither can a power of attorney; the recognition chapters do not reach them.

The chapters then proceed in the order of the statute’s original logic. The early chapters perform the recognition work: electronic records, electronic signatures, electronic governance, attribution, acknowledgement and despatch of records, and the security procedures that make a record or a signature a secure one. The middle chapters build the trust infrastructure, establishing the Controller of Certifying Authorities, the licensing of certifying authorities, the issue of signature certificates and the duties of subscribers. A chapter on penalties and compensation then attaches civil liability to unauthorised interference with computers and data, a chapter on adjudication creates the officers who decide those claims, and a chapter on the appellate tribunal provides the appeal route. The offences chapter follows, and it is here that the 2008 amendment did its heaviest work, inserting most of the catalogue of named offences and the trio of state powers that the sections after them carry. The closing chapters contain the miscellaneous provisions, including the intermediary exemption, the overriding effect clause, the protection for examiners of electronic evidence, the rule-making powers and the schedules. The four schedules, as enacted, amended the Indian Penal Code, the Indian Evidence Act, 1872, the Bankers’ Books Evidence Act, 1891 and the Reserve Bank of India Act, 1934, so that the general law would not contradict the recognition the new statute granted. The most consequential of those amendments sits in the Evidence Act, and it is treated separately below.

The closing sections of the Act distribute the remaining power, and two of them explain how the statute is actually run. Section 87 confers the rule-making power on the Central Government across a long list of subjects, from the manner of affixing electronic signatures and the security procedures to be followed, through the licensing and audit of certifying authorities, to the qualifications of adjudicating officers, the form of appeals and, after the amendments, the due diligence and grievance conditions that dominate the intermediary debate. Nearly every controversy described later in this article about the executive legislating the internet’s ground rules is, in form, a controversy about the width of Section 87 and the width of the guideline power written into Section 79(2), and a reader who wants the legal source of a given obligation imposed on a platform should look first to those two provisions rather than to any section creating an offence. Section 88 obliges the government to constitute a committee to advise it on the making of rules, the Cyber Regulations Advisory Committee, a body drawn from commerce, industry, government and the professions, whose existence in the text is a reminder that the Act’s designers expected its subordinate legislation to be a continuing negotiation with the industry it regulated. Section 84 protects action taken in good faith under the Act, and Section 83 permits the directions of the Central Government under the Act to be issued to state governments and authorities in the manner the Act’s closing machinery provides. None of these provisions is ever the headline of a dispute, and all of them are the plumbing through which the headline provisions operate.

What does the overriding effect in Section 81 actually do?

Section 81 provides that the provisions of the Act shall have effect notwithstanding anything inconsistent contained in any other law for the time being in force, so where a provision of this Act and a provision of another statute cannot stand together, this Act prevails.

The clause is subject to a proviso protecting rights conferred by the Copyright Act, 1957 and the Patents Act, 1970, a carve-out later extended to the data protection statute.

An overriding clause of this kind is easy to overread. It does not say that the Information Technology Act is a complete code for everything that happens through a computer, and the courts have not treated it as one. What it does is resolve direct inconsistency in the Act’s favour: where an older law insists on paper and this Act recognises the electronic record, the recognition wins. Where no inconsistency exists, the two statutes operate side by side, which is why conduct through a computer is very often prosecuted under the general penal law and this Act in the same case, a point developed in the offences discussion below. The clause also has a second, quieter significance. Because the Act overrides other laws, the conditions and limits written into its own exemptions and powers matter more, not less: a platform that falls outside the exemption in Section 79 cannot fall back on a general principle of innocence drawn from some other statute, and a blocking direction that does not follow the procedure of Section 69A cannot borrow validity from elsewhere. Parliament signalled the same discipline when it amended the proviso to Section 81 to add the Digital Personal Data Protection Act, 2023 to the protected list, acknowledging that the newer statute, and not this one, is to govern personal data even where the two overlap.

What the Act does now: the function map

The table below is the article in miniature. Each row takes one function the Act performs in practice, marks whether that function stood in the Act as enacted in 2000 or was inserted or transformed by the amendment of 2008, identifies where the operative detail sits, and draws the conclusion the row supports. Read down the final column and the namable claim of this article assembles itself.

Function	In the Act as enacted in 2000	Inserted or transformed in 2008	Where the operative detail sits	What this shows
Electronic records and signatures	Yes, the core of the Act, in the recognition chapters	Terminology widened from digital signatures to electronic signatures	In the Act, sections 4 to 16, with certificate practice under rules	The original statute still does the work it was built for
Electronic contracts	Not stated expressly	Yes, section 10A inserted	In the Act, with general contract law supplying the rest	Even the commerce layer needed repair within a decade
Computer offences	A single hacking offence and source code tampering	Recast as a family of offences in sections 66 to 66F	In the Act, with penalties in each section	The crime chapter is an amendment-era construction
Content offences	Obscene publication in electronic form only	Sexually explicit material and child sexual abuse material added, sections 67A and 67B	In the Act, applied through prosecution practice	Speech offences entered through a commerce statute
Corporate data liability	Absent	Yes, section 43A inserted	In the Act’s single section and the security practices rules of 2011	India’s first data compensation duty was one inserted section
Intermediary liability	A narrow shield for network service providers	Rewritten as a conditional exemption for all intermediaries, section 79	In rules of 2011 and 2021, and in the reading down of 2015	The platform constitution is delegated and judicially trimmed
Blocking of online content	No statutory power; blocking improvised by a notification of 2003	Yes, section 69A inserted	In the blocking rules of 2009, with confidential orders	A speech power exercised through subordinate procedure
Interception and traffic monitoring	A narrow interception power in the original section 69, exercised through the Controller	Section 69 substituted and widened; section 69B added for traffic data	In the interception rules of 2009 and executive directions	The one state power with an ancestor in the original Act

Read as a whole, the map shows an imbalance that no single provision announces. The three rows that belong to the commerce statute of 2000, on records, signatures and contracts, rest on the Act’s text and have barely been touched since enactment, because recognition provisions age slowly: an equivalence, once granted, does not need to be re-granted for each new device. The five rows that belong to the security and platform statute of 2008 rest on a mixture of text and rules and have changed their meaning repeatedly without further amendment, because their substance lives in conditions, guidelines and directions that the executive can rewrite. A reader who understands only that distribution understands the essential fact about this Act, which is that its two halves obey different constitutional logics: the first half is legislation in the classic sense, settled and public, while the second half is a framework inside which the real law of the Indian internet is made at one remove from Parliament, and defended, when it is defended, at two.

The definitions that decide the Act’s reach

Statutes of this kind are won and lost in their definition clauses, and Section 2 of this Act is unusually consequential because its defined terms are the triggers for everything else. A computer is defined to include any electronic, magnetic, optical or other high speed data processing device or system which performs logical, arithmetic and memory functions by manipulations of electronic, magnetic or optical impulses, and includes all input, output, processing, storage, security and communication facilities connected to it. A computer system is a device or collection of devices including input and output support devices, excluding only calculators that are not programmable and incapable of being used with external files. A computer network is the interconnection of one or more computers or computer systems or communication devices through satellite, microwave, terrestrial line, wire, wireless or any other communication media, or through terminals forming part of an interconnected system. The combined effect is that the phone in a pocket, the server in a data centre, the automated teller machine on a street and the systems of a railway network are all computer resources for the purposes of the Act, and conduct involving any of them can fall within provisions drafted with mainframes in mind. Breadth of this order is deliberate in a technology statute, because a narrower definition dates; but it also means that the mens rea requirements and the permission element in the liability and offence provisions carry the whole weight of separating crime from ordinary use, since the conduct element alone will almost always be satisfied.

Three further definitions do specific work later in the Act. Data is defined as a representation of information, knowledge, facts, concepts or instructions prepared in a formalised manner and intended to be processed in a computer system, and information is defined to include data, message, text, images, sound, voice, codes, computer programmes, software and databases or micro film or computer generated micro fiche, which is why the Act’s provisions about information reach expression and not only records of fact. The amendment of 2008 added the communication device, defined to include cell phones, personal digital assistants and combinations of such devices and any other device used to communicate, send or transmit any text, video, audio or image, a definition inserted because the offence provisions of the amendment were drafted for the messaging era and needed a term wider than the computer. The same amendment supplied a statutory definition of the cyber cafe. A computer resource, the term the operative provisions use most, is defined to mean a computer, a computer system or a computer network, and data, a database or software, a definition that lets a single section speak indifferently of a device, a network and the information inside either. A secure system is a computer hardware or software system, or a procedure, that is reasonably secure from unauthorised access and misuse, provides a reasonable level of reliability and correct operation, is reasonably suited to performing its intended function and adheres to generally accepted security procedures, a definition that quietly imports an engineering standard into offences and duties framed around protected and secure infrastructure. Originator and addressee are defined by function rather than by identity, and the definition of originator expressly excludes an intermediary, a small drafting decision with large consequences, since it keeps the platform that carries a message outside the class of persons treated as sending it. A reader who masters these definitions can predict most of the Act’s applications; a reader who skips them will repeatedly be surprised by how much of ordinary digital life the sections capture.

Legal recognition: records, signatures and electronic governance

The recognition chapters are drafted as a series of equivalences, and each one answers a specific paper-based demand found elsewhere in Indian law. Section 4 deals with the demand for writing. Where any law requires information or any other matter to be in writing, or in typewritten or printed form, that requirement is deemed satisfied if the information is rendered or made available in an electronic form and is accessible so as to be usable for a subsequent reference. The two conditions matter. Accessibility and usability for later reference are what writing is for, so the section protects the function rather than the form. A record that cannot be retrieved, or that degrades into unreadability, does not earn the equivalence. Section 5 performs the same operation for signatures: where any law requires a signature, the requirement is satisfied by an electronic signature affixed in the manner prescribed by the Central Government. Section 7 protects retention, providing that a legal duty to retain documents, records or information is satisfied by electronic retention where the information remains accessible and usable, is retained in the format in which it was generated or in a format that accurately represents it, and the particulars that identify its origin, destination and transmission are retained as well. Section 8 extends the principle to official publication, so that a rule, regulation, order or notification published in an electronic gazette satisfies a requirement of gazette publication. Section 9 then fences the whole scheme with a necessary restraint: nothing in these provisions compels a person to accept an electronic record, since the right to insist on paper, where it exists, is a matter of choice and not of legal incapacity.

Between recognition and governance sits Section 6, which authorises government and its agencies to accept the filing of forms and applications, the issue of licences and approvals, and the receipt and payment of money by electronic means, provided the manner and format are prescribed. Section 6A, inserted by the amendment of 2008, goes one step further and empowers governments to authorise service providers to deliver public services electronically, which is the statutory footing on which outsourced service delivery centres and common service centres operate. These are enabling provisions rather than self-executing ones: each becomes practical law only when the relevant government prescribes the manner of use, which is why electronic filing under the Act advanced in step with departmental rule-making rather than all at once on commencement. The pattern repeats across the statute’s working life: company filings moved wholly into electronic form because the companies legislation and its rules made the electronic mode the only accepted mode for most returns; income tax returns followed as assessment practice digitised; tendering, trade documentation and court filing have each moved where a department prescribed the manner and built the system, and have remained dual-mode where one did neither. Section 6 is therefore best understood not as a switch the Act threw in 2000 but as a standing permission that each department exercises at its own pace, and the unevenness of Indian electronic governance, seamless in one ministry and paper-bound in the next, is a faithful map of that design.

The most commercially significant of the recognition provisions arrived by amendment, eight years after the rest. Section 10A, inserted by the amendment of 2008, provides that where in the formation of a contract, the communication of proposals, the acceptance of proposals, the revocation of proposals and acceptances, or any part of that process, is expressed in electronic form or by means of an electronic record, the contract shall not be deemed unenforceable solely on the ground that electronic form was used. The drafting is deliberately negative. It does not create a law of electronic contract; the Indian Contract Act, 1872 continues to supply the doctrines of offer, acceptance, consideration, capacity and free consent. What Section 10A removes is the threshold objection that the medium itself voids the bargain. Every click-wrap agreement, every acceptance recorded by a server log and every order placed through an application rests on that removal.

Two quieter recognition provisions complete the scheme and are easy to overlook. Section 7A, inserted by the amendment of 2008, provides that where any law requires an audit of documents, records or information for a particular period, that requirement is satisfied by an audit of the electronic form of those documents for that period, which is what allows the books of account of a company or the records of a bank to be audited as data rather than as bound volumes. Section 10 empowers the Central Government to make rules prescribing the type of electronic signature, the manner and format in which it is to be affixed, the manner of identity verification and the security procedures and standards controlling the process, so the recognition the sections grant is not left floating: the statute declares equivalence and the rules specify the techniques by which equivalence is earned. The interaction between the recognition chapters and the exclusions in Section 1(4) also repays attention. The exclusions do not make electronic wills or electronic conveyances invalid in themselves; they place those instruments outside this Act, so that the deeming provisions cannot be used to satisfy the formal requirements that other laws impose on them. A contract for the sale of land may be negotiated, and even concluded as a matter of the general law of contract, through electronic communication; what the Act will not do is let an electronic record perform the conveyance. The line Parliament drew in 2000 was between transactions, which it was prepared to move, and instruments of title and succession, which it was not, and that line has survived every amendment since, which suggests it answered a real anxiety about fraud and proof in the documents that transfer homes and estates.

How does the Act decide who sent an electronic record?

Sections 11 to 13 answer the three questions every electronic communication raises in litigation: whose record is it, when was it sent, and when was it received. Section 11 attributes a record to the originator where it was sent by the originator, by an authorised person, or by an information system programmed to operate automatically on the originator’s behalf.

The fuller attribution rule covers records sent by a person with authority to act for the originator in respect of that record and records sent by an information system the originator has set running. Section 12 governs acknowledgement of receipt, and Section 13 fixes the time and place of despatch and receipt, treating despatch as occurring when the record enters a computer resource outside the originator’s control and receipt, in the ordinary case, as occurring when the record enters the addressee’s designated computer resource. The rules repay comparison with the postal doctrine the common law built for letters: where a posted acceptance was traditionally complete on posting, an electronic acceptance under this Act is located by the entry of the record into a system outside the originator’s control on despatch and by its entry into the designated resource, or its retrieval where none is designated, on receipt, so the statute replaces the fiction of the post with the observable events of a network, and litigation over whether a communicated price or order was received in time is decided on server logs rather than on presumptions about envelopes. This is the recognition machinery doing exactly the work it was designed for, quietly and every day, in tax filings, in bank instructions and in commercial correspondence, and its very invisibility is the reason the controversies of the later chapters were able to attach themselves to the same Act without the public noticing the substitution of subject.

Attribution is where the recognition statute stops being ceremonial. An electronic record is easy to forge and easy to deny, and commerce cannot proceed if every record must be proved like a disputed signature on a cheque. The attribution rules give courts a starting allocation of responsibility, which the party denying the record must then displace with evidence. The automatic-system limb deserves notice, because it was drafted before automated contracting was common: a record generated by a system the originator set running is the originator’s record, even though no human being composed or approved that particular message. Pricing errors produced by a seller’s own software, confirmations issued by a bank’s systems and orders acknowledged by a platform’s servers all begin their legal life under this rule. The despatch and receipt rules in Section 13 carry the same practical weight in correspondence disputes, since the moment an acceptance or a notice takes effect frequently decides which of two parties bears a loss.

The trust infrastructure: signatures, the Controller and certifying authorities

Recognition answers the question whether an electronic signature can count. The trust chapters answer the harder question of whose signature it is. As enacted, the Act was built around the digital signature, a specific asymmetric cryptography technique in which a key pair links a signer to a record and detects later alteration. The amendment of 2008 made the framework technology neutral by substituting the wider expression electronic signature, inserting Section 3A to provide for electronic signature techniques notified in the Second Schedule, and leaving the digital signature regime in place as the first and most developed of those techniques. Sections 14 to 16 then define the secure electronic record and the secure electronic signature, attaching presumptions of integrity and authenticity to records and signatures that pass through a prescribed security procedure. The presumptions are the real prize. A secure electronic record is presumed not to have been altered since the secure status attached to it, and a secure electronic signature is presumed to have been affixed by the subscriber with the intention of signing or approving the record, unless the contrary is proved.

Section 18 enumerates the Controller’s functions, and the list defines the office: to exercise supervision over the activities of certifying authorities; to certify the public keys of certifying authorities; to lay down the standards to be maintained by them; to specify the qualifications and experience their employees shall possess; to specify the conditions subject to which they conduct their business; to specify the contents of written, printed or visual materials and advertisements that may be distributed or used in respect of an electronic signature certificate and the public key; to specify the form and manner in which certifying authorities maintain accounts; to specify the terms on which auditors are appointed and the remuneration they receive; to facilitate the establishment of any electronic system by a certifying authority, solely or in conjunction with others, and its regulation; to specify the manner in which the various types of subscribers shall deal with the electronic system; to specify the code of conduct to be observed by certifying authorities and the duties of subscribers; to resolve any conflict of interests between certifying authorities and subscribers; to lay down the duties of certifying authorities; and to maintain a database containing the disclosure record of every certifying authority, in the public domain. It is the charter of a market regulator for trust services, closer in spirit to a securities or banking supervisor than to a police authority, and its presence in the Act is a further marker of what the statute was built to be.

The institutional centre of the system is the Controller of Certifying Authorities, appointed by the Central Government under Section 17. The Controller licenses, regulates and supervises certifying authorities, lays down their standards and conditions, recognises foreign certifying authorities, and maintains the repository of certificates through which the public can verify what has been issued and what has been revoked. Certifying authorities are the licensed private and public bodies that issue electronic signature certificates under Section 35 and the sections that follow it. Before issuing a certificate, a certifying authority must satisfy itself of the applicant’s identity by the prescribed process; the certificate then binds a named subscriber to a particular public key, and the authority’s own digital signature on the certificate is what makes it trustworthy to a stranger. Certificates can be suspended and revoked on the grounds the Act sets out, including the subscriber’s request, the subscriber’s death or dissolution and compromise of the certifying authority’s private key, and the repository maintained under the Act is what allows a relying party to discover that revocation before acting on a certificate.

Subscribers carry duties in return. A subscriber who has accepted a certificate is taken to have certified to anyone who reasonably relies on it that the representations made to the certifying authority were true, must exercise reasonable care to retain control of the private key, and must communicate any compromise of that key to the certifying authority without delay. The penalty provisions at the end of the scheme protect the certificates themselves: Section 73 penalises publishing a certificate that is false in material particulars or that has not been issued or has been suspended or revoked, and Section 74 penalises publishing a certificate for a fraudulent or unlawful purpose. In practice this infrastructure underlies filings that Indian businesses make every day, from company registry submissions to income tax returns and tender documents, and the class-based certificates issued through licensed authorities such as the government and private providers dispensing them are a routine cost of doing business. Its significance for the rest of the Act is structural: the signature chapters show the original statute working exactly as designed, a quiet machinery of validity that almost never features in public controversy, and they are the clearest measure of how far the statute’s centre of attention has travelled since.

The architecture of trust has a root, and the Act places it in the same office that regulates the system. The Controller licenses certifying authorities only after examining their infrastructure, personnel and security practices against the standards prescribed, and the Controller’s own certifying function anchors the chain: the public keys of licensed authorities are certified at the root, so that a certificate presented by a stranger can be verified up a chain that terminates in a state-maintained trust point. Section 19 permits the Controller, with the previous approval of the Central Government and subject to prescribed conditions, to recognise foreign certifying authorities, so that a certificate issued abroad can carry legal effect in India on a reciprocal administrative basis rather than by treaty. On the discipline side, Section 25 empowers the Controller to suspend or revoke a licence where a certifying authority has made a false or misleading statement in or in relation to its application, has failed to comply with the terms of its licence or with the Act and its rules, or has failed to maintain the prescribed standards and procedures, after an inquiry and an opportunity of hearing; Section 26 protects the reliance of third parties by requiring notice of suspension or revocation to be published in the database maintained by the Controller. Certificates in the market are differentiated by the rigour of the identity verification behind them, and the regime’s everyday reality is administrative: audits of certifying authorities, standards for key generation and storage, and the unglamorous work of keeping a national repository accurate. That this machinery, built for a paperless economy that arrived more completely than its designers predicted, has required so little legislative attention since 2000 is the strongest evidence in the Act for the proposition that recognition law, unlike speech law, can be settled once and left alone.

The compensation chapter: Section 43 and the corporate data duty

Chapter IX of the Act is civil, not criminal, and the distinction drives many of the choices a victim of computer misuse must make. Section 43 provides that a person who, without the permission of the owner or of the person in charge of a computer, a computer system or a computer network, does any of a list of acts is liable to pay damages by way of compensation to the person affected. The listed acts run the full range of unauthorised interference: accessing or securing access to the computer or network; downloading, copying or extracting data or a database; introducing or causing the introduction of a computer contaminant or a computer virus; damaging the computer or its data; disrupting the computer or network; denying access to an authorised person; providing assistance that facilitates unauthorised access; charging services availed of by one person to the account of another by tampering or manipulation; destroying, deleting or altering information residing in a computer resource or diminishing its value or utility; and stealing, concealing, destroying or altering computer source code with the intention of causing damage. Two features of the section deserve emphasis. The liability is strict in structure, since the section turns on absence of permission rather than on dishonesty, which is reserved for the criminal counterpart in Section 66. And the compensation is uncapped: as enacted, Section 43 limited damages to an amount not exceeding one crore rupees, and the amendment of 2008 removed that ceiling, leaving the quantum to be assessed on the factors Section 47 directs the adjudicating officer to weigh, namely the gain of unfair advantage made by the default, the amount of loss caused, and the repetitive nature of the default.

Section 43A, inserted by the amendment of 2008, is the provision on which Indian data protection law rested for a decade and a half. It provides that where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures, and thereby causes wrongful loss or wrongful gain to any person, the body corporate is liable to pay damages by way of compensation to the person so affected. Every element was fought over in commentary and in claims. The duty attaches only to bodies corporate and only to sensitive personal data, a category narrower than personal data generally. The trigger is negligence in security practices, not the mere fact of a breach, so a company that maintained reasonable practices and was breached anyway has a defence that a careless company lacks. And the compensation route runs through adjudication under this Act, not through a regulator armed with a penalty schedule.

The operative content of reasonable security practices sits in subordinate legislation, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, made under Section 43A. The rules define the sensitive categories, require a published privacy policy, condition collection of sensitive data on consent for a lawful purpose, restrict disclosure to third parties, and treat a documented information security programme implementing a standard such as the international standard IS/ISO/IEC 27001 as satisfying the security requirement, with audits contemplated through certified auditors. India’s first working data protection regime was therefore a compensation clause in a computer misuse chapter, fleshed out by a rulebook of a few pages. The settlement changed when Parliament enacted a dedicated statute: the Digital Personal Data Protection Act, 2023 provides in Section 44(2) for the omission of Section 43A from this Act, and adds that Act to the proviso of Section 81, marking the formal transfer of the data protection function out of the commerce statute that had carried it as an afterthought. The transfer is phased rather than instantaneous: the omission of Section 43A takes effect as the corresponding provisions of the new statute are brought into force, and until that point Section 43A and the 2011 Rules continue to govern the compensation liability of a body corporate that mishandles sensitive personal data, so a claim arising in the interval is still pleaded under this Act and its rules, with the security practices they prescribe as the standard against which negligence is measured.

What counts as sensitive personal data under the 2011 Rules?

Rule 3 of the 2011 Rules lists: passwords; financial information such as bank account or credit card or debit card or other payment instrument details; physical, physiological and mental health condition; sexual orientation; medical records and history; and biometric information, together with such information received by a body corporate for processing or storage under a lawful contract or otherwise.

Information that is freely available in the public domain, or furnished under the Right to Information Act, 2005, falls outside the definition.

The list has a practical reach that businesses repeatedly underestimate. A payroll processor holding bank details, a hospital management system holding medical records, a lender holding biometric authentication data and a platform holding nothing more exotic than its users’ passwords all stand inside Section 43A, and the negligence inquiry will be conducted against the practices the rules describe rather than against industry habit. The converse limit matters equally: the ordinary personal data of a customer, a name, an address, a purchase history, attracts no liability under Section 43A at all unless it falls within a listed category, a gap in coverage that was among the principal arguments for a general data protection statute. The compensation machinery for both sections sits in the same place. Claims under Chapter IX are adjudged by adjudicating officers appointed under Section 46, who exercise the powers of a civil court for the purpose, whose jurisdiction after the amendment of 2008 extends to claims in which the injury or damage claimed does not exceed five crore rupees, and beyond which the claim vests in the competent court. Sections 44 and 45 complete the chapter with penalties for failures in returns, records and filings under the Act and a residual compensation for contraventions of rules for which no separate penalty is provided.

The working life of this chapter is in its procedure, and the procedure explains both its reach and its rarity. The manner of holding an inquiry is prescribed by rules made in 2003 governing the qualifications and experience of adjudicating officers and the conduct of proceedings before them, and the officer proceeds in a summary manner, recording evidence, hearing the parties and passing a reasoned order. Section 47 fixes the factors the officer must take into account in adjudging the quantum of penalty: the amount of gain of unfair advantage, wherever quantifiable, made as a result of the default; the amount of loss caused to any person as a result of the default; and the repetitive nature of the default. Those factors structure every contested order the system has produced. The unfair advantage limb matters where the wrongdoer profited, as an insider or intermediary who monetised access ordinarily does; the loss limb anchors the order to the victim’s proven damage, which is why the quality of the claimant’s documentation, statements, transaction records and correspondence, decides outcomes more often than the ingenuity of the legal argument; and the repetition limb is the statute’s device for separating the careless from the systematic, since a second default of the same character invites a materially heavier award than a first. In the bank phishing orders that remain the system’s best known body of work, the operative contest was between the account holder’s loss and the bank’s contention that the compromise occurred on the customer’s side of the wire, and the adjudicating officer’s reasoning in the better orders turned on the security arrangements the bank could demonstrate under its own regulatory obligations, a standard of analysis that connects the adjudicating officer’s room back to the security practices and procedures standard that Section 43A and the 2011 Rules prescribe for body corporates. Section 64 gives the orders teeth of a particular kind, providing that where a penalty imposed or compensation awarded is not paid, the amount is recoverable as an arrear of land revenue, and any licence or electronic signature certificate of the defaulter stands suspended until payment. The best documented use of the route came in banking fraud. In a series of orders, the adjudicating officer appointed for Maharashtra entertained claims by customers whose accounts had been drained through phishing and credential theft, and held banks liable to compensate their customers where the loss was attributable to failures on the bank’s side of the transaction rather than to the customer’s own disclosure, reasoning from Section 43 and Section 43A together. Those orders mattered beyond their amounts. They established that the compensation chapter could be used by an individual against a large institution without a civil suit, they forced a public argument about where the loss from online banking fraud should fall, and they demonstrated the structural weakness that recurs in assessments of the chapter: the outcome depended on the energy of a single state’s officer, and claimants in states whose adjudicating officers were inactive or unknown had a remedy on paper that they could not find in practice.

The offences chapter: what the Act makes criminal

Chapter XI was modest as enacted and is extensive as it stands, and the expansion has a pattern: the amendment of 2008 converted the chapter from a short list centred on hacking and obscenity into a general code of computer crime, much of it built by attaching criminal liability to the civil wrongs in Section 43. Section 65, which survived from the original Act, penalises tampering with computer source documents, punishing whoever knowingly or intentionally conceals, destroys or alters computer source code that the law requires to be kept or maintained, with imprisonment of up to three years or a fine that may extend to two lakh rupees or both. Section 66 is the hinge. As enacted it punished hacking, defined by intent to cause or knowledge of likely wrongful loss or damage coupled with destruction, deletion or alteration of information. The amendment substituted a new Section 66 under which a person who dishonestly or fraudulently does any act referred to in Section 43 commits a computer related offence, punishable with imprisonment for a term that may extend to three years or with a fine that may extend to five lakh rupees or with both. The dishonesty requirement is what separates the crime from the compensation claim, and the prosecution must prove it; the same intrusion can therefore ground a Section 43 claim before an adjudicating officer and a Section 66 prosecution before a magistrate, with different mental elements and different forums.

Around Section 66 the amendment arranged a family of specific offences. Section 66B punishes dishonestly receiving or retaining a stolen computer resource or communication device. Section 66C punishes identity theft, the fraudulent or dishonest use of another person’s electronic signature, password or other unique identification feature. Section 66D punishes cheating by personation by means of a computer resource or communication device, which carries the classic deception offence into phishing and impersonation. Section 66E punishes the violation of privacy constituted by capturing, publishing or transmitting the image of a private area of a person’s body without consent, in circumstances violating that person’s privacy. Section 66F defines cyber terrorism at a different scale altogether, covering acts done with intent to threaten the unity, integrity, security or sovereignty of India or to strike terror, including attacks on critical information infrastructure and denial of access to authorised users of protected systems, and it is punishable with imprisonment that may extend to imprisonment for life. The section’s own catalogue is worth reading closely, because it shows the amendment’s drafting method at its most expansive: it reaches the person who, with the requisite intent, denies or causes the denial of access to a computer resource to an authorised user; the person who attempts to penetrate or access a computer resource without authorisation or in excess of authorisation and by that act obtains access to information, data or a database restricted for reasons of the security of the State or foreign relations, where the information obtained is likely to be used to injure the interests of the State or its people or for the benefit of a foreign nation; and the person who introduces a contaminant or virus that causes or is likely to cause death, injury, damage to or destruction of property, or disruption of supplies or services essential to the life of the community, or that adversely affects critical information infrastructure. The penalty structure makes the section the summit of the chapter, and its breadth, extending to attempts and to information obtained rather than damage done, is the reason it is charged sparingly and read with care.

The content offences form the second family. Section 67, present from the original Act, punishes publishing or transmitting, or causing to be published or transmitted, obscene material in electronic form, with imprisonment of up to three years and a fine of up to five lakh rupees on a first conviction, rising on a second or subsequent conviction. Section 67A, inserted in 2008, punishes material containing a sexually explicit act or conduct, with imprisonment of up to five years on first conviction and a higher fine. Section 67B addresses material depicting children in sexually explicit acts, and reaches beyond publication to the creation, collection, browsing, downloading and exchange of such material, as well as the online enticement and abuse of children. The distinctions between the three sections are the working law of a great deal of prosecution practice: obscenity, explicitness and the involvement of a child are separate tests, the penalties ascend in that order, and charging the wrong section can fail a prosecution that the facts would have supported under the right one.

The obscenity limb carries its own jurisprudence, which the electronic form inherited from print. The Supreme Court’s approach to obscenity moved across the twentieth century from the Victorian test of a tendency to deprave and corrupt those whose minds are open to such influences towards a contemporary community standards test, and in Aveek Sarkar v. State of West Bengal, (2014) 4 SCC 257, the Court applied the community standards approach to a photograph published in a magazine, holding that a nude or semi-nude picture could not be called obscene unless it suggested lasciviousness or appealed to prurient interest in a manner tending to deprave and corrupt. Prosecutions under Section 67 are conducted in the shadow of that standard, which is why the section, though framed in the broadest terms, does not in practice criminalise every sexual reference in electronic form, and why the charging decision under Sections 67, 67A and 67B is an exercise in matching material to tests that the courts, and not the police, have defined. The first conviction recorded under the Act arose from this family of offences: the prosecution of Suhas Katti in Chennai, concluded in 2004 before the Additional Chief Metropolitan Magistrate at Egmore, in which the accused, who had posted obscene and defamatory material about a woman in a messaging group and made harassing calls after she complained, was convicted under Section 67 of this Act and the general penal law within months of the complaint, a speed the court attributed to the electronic evidence being preserved and produced in certifiable form. The case is remembered in the literature of the Act less for its facts than for what it demonstrated: that the new statute’s offences could be investigated, proved and punished with the evidence rules the same statute had created. Section 67C, also inserted in 2008, imposes on intermediaries and other persons in charge of computer resources a duty to preserve and retain specified information in the prescribed manner and duration, and punishes intentional or knowing failure with imprisonment of up to three years. The remaining offences police the statute’s own machinery and official space: Section 68 penalises failure to comply with the directions of the Controller, Section 70 penalises securing or attempting to secure access to a protected system in contravention of the section, Section 71 penalises misrepresentation to the Controller or a certifying authority, Section 72 penalises breach of confidentiality by a person who has secured access to records under powers conferred by the Act, and Section 72A, inserted in 2008, penalises disclosure of information in breach of a lawful contract by a service provider or intermediary who obtained access to material with intent to cause, or knowing he is likely to cause, wrongful loss or wrongful gain. Sections 73 and 74, noted earlier, protect signature certificates. Sections 84B and 84C punish abetment and attempt by reference to the punishment for the offence itself. Section 85 addresses offences by companies, attributing liability to persons in charge of the business subject to a due diligence defence, and Section 78 fixes investigation in the hands of a police officer not below the rank of Inspector, a threshold the amendment lowered from the rank of Deputy Superintendent of Police in the original scheme. Sections 77A and 77B govern compounding and bail: offences punishable with imprisonment of three years or less are in general compoundable with the permission of the court and bailable, subject to stated exclusions, of which cyber terrorism is the most prominent.

A cluster of offences protects the statute’s own machinery and the State’s systems, and it repays separate attention because its defendants are as often officials and licensees as intruders. Section 68 punishes a person who fails to comply with an order of the Controller requiring a certifying authority or its employee to take steps the Controller considers necessary to secure compliance with the Act. Section 70, described earlier in its institutional setting, punishes securing access to a protected system in contravention of the section with imprisonment that may extend to ten years, the second highest ceiling in the chapter after cyber terrorism, a grading that reflects the character of the systems notified, which are drawn from the infrastructure on which power, finance, transport and defence depend. Section 71 punishes whoever makes a misrepresentation to the Controller or to a certifying authority, or suppresses a material fact, in order to obtain a licence or a signature certificate. Section 72 punishes a person who, in pursuance of any of the powers conferred under the Act, has secured access to an electronic record, book, register, correspondence, information, document or other material, and discloses it to another person without the consent of the person to whom it belongs; it is the Act’s internal confidentiality offence, aimed at the official, the auditor and the service provider who meet private data inside a lawful process. Section 72A extends that protection into contract, punishing a person, including an intermediary, who while providing services under a lawful contract has access to material containing personal information about another person and discloses it with intent to cause, or knowing it is likely to cause, wrongful loss or wrongful gain, without that person’s consent or in breach of the contract. Read together, Sections 72 and 72A are the Act’s acknowledgement that the gravest privacy risks inside its own system come from the persons the system trusts.

Running alongside this catalogue is the general penal law, and no account of the offences chapter is honest without the overlap. Cheating, forgery, criminal breach of trust and defamation committed through a computer are routinely charged under the general code as well as, or instead of, this Act, and the choice between the two regimes is a live tactical question in Indian criminal practice, since the ingredients, the punishments and the bail consequences differ. The relationship between the two codes, and the further reordering worked by the replacement of the Indian Penal Code, are examined in the comparison of the IPC and the BNS, which owns that analysis. What the pillar needs to register is the structural fact: the Information Technology Act never became an exclusive code for computer crime, and its offences chapter functions as a specialist supplement to the general law, strongest where the general law has no concept for the conduct, as with interference with data itself, and weakest where it merely restates familiar wrongs in digital dress.

Investigation, encryption and the machinery of enforcement

The offences chapter presupposes an enforcement machinery that the Act sketches and other instruments have had to build. Section 78 fixes the floor of the investigating cadre: notwithstanding anything in the Code of Criminal Procedure, a police officer not below the rank of Inspector shall investigate any offence under the Act. The rank is a compromise between expertise and capacity. The original threshold of Deputy Superintendent of Police confined investigation to senior officers in a force that had few of them and fewer with technical training, and prosecutions languished for want of an authorised investigator; the Inspector threshold of 2008 multiplied the cadre at the cost of dispersing it across officers whose formation is general. In practice the work concentrates where the states have built it: in cyber police stations and cyber cells with forensic support, in the national cybercrime reporting arrangements through which victims register complaints that are routed to the state of the victim or of the transaction, and in the coordination centre the Ministry of Home Affairs established to connect those parts. Jurisdiction follows the statute’s own geography: because Section 75 fastens on the location of the computer resource involved, and because a single fraud typically touches a victim in one state, an account in a second, a platform in a third and an accused in a fourth, the early skirmishes of a prosecution are frequently about forum rather than guilt, and the preservation duties in Section 67C and the retention directions administered by CERT-In exist in large part to keep the evidence alive while those questions are settled.

Encryption occupies a peculiar position in the Act, at once protected, regulated and conscripted. The recognition chapters depend on it, since the signature regime is applied cryptography. Section 84A, inserted by the amendment of 2008, empowers the Central Government to prescribe, for secure use of the electronic medium and for the promotion of electronic governance and electronic commerce, the modes or methods for encryption, a power that has never been used to publish a general encryption code, leaving the field to sectoral directions and to the assistance duties that the interception provisions impose. Those duties are the third point of the triangle: a subscriber or intermediary called upon under Section 69 must extend all facilities and technical assistance to intercept, monitor or decrypt, and a platform that has designed its service so that it cannot decrypt is placed in a confrontation the statute frames but does not resolve, which is one reason the traceability litigation described in the intermediary section carries weight beyond its immediate parties. The Act, in short, treats encryption as infrastructure when it authenticates, as a subject of executive prescription when it secures, and as an obstacle that identified persons must help the State overcome when a lawful direction issues, and any reader who wants to understand the Indian debate on the subject should begin from that triple character rather than from any single provision.

The powers of the State: interception, blocking and traffic data

The three sections that stand between the offences and the protected systems provision are the constitutional heart of the modern Act. Two of them, Sections 69A and 69B, were inserted in 2008 without any ancestor in the statute as enacted. The third has the most instructive history in the Act. The original Section 69 of 2000 was titled as a direction of the Controller to a subscriber to extend facilities to decrypt information, and it empowered the Controller, where satisfied that it was necessary or expedient in the interest of the sovereignty or integrity of India, the security of the State, friendly relations with foreign states or public order, or for preventing incitement to the commission of a cognisable offence, for reasons to be recorded in writing, to direct any agency of the government to intercept any information transmitted through any computer resource, with a duty on the subscriber or the person in charge to extend all facilities and technical assistance to decrypt the information, and imprisonment of up to seven years for failure to assist. The amendment of 2008 substituted the section wholesale and widened it in every dimension: the power moved from the Controller, a technical regulator, to the Central Government, the state governments and their specially authorised officers; the verbs multiplied from intercept to intercept, monitor or decrypt; the object widened from information transmitted to information generated, transmitted, received or stored; the grounds acquired the defence of India and the investigation of any offence; and the duty of assistance was extended to intermediaries expressly. Section 69 as substituted empowers the Central Government, a state government, or an officer specially authorised in that behalf, where satisfied that it is necessary or expedient on those grounds, to direct any agency of the appropriate government to intercept, monitor or decrypt, or cause to be intercepted, monitored or decrypted, any information generated, transmitted, received or stored in any computer resource. Subscribers, intermediaries and persons in charge of computer resources must extend all facilities and technical assistance when called upon, and a failure to assist is itself punishable with imprisonment that may extend to seven years. Section 69 authorises the prescription of procedure and safeguards, and the Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009 route directions through designated senior officers, record the reasons for each direction, confine its currency, and submit interception orders to a review committee constituted on the pattern long used for telephone tapping under the Indian Telegraph Act framework.

In practice the directions run through a small set of authorised agencies: an order of the Ministry of Home Affairs in December 2018, made under the section and the 2009 Rules, authorised ten central agencies, including the Intelligence Bureau, the Narcotics Control Bureau, the Enforcement Directorate, the Central Bureau of Investigation and the National Investigation Agency, to intercept, monitor and decrypt information in computer resources, and its publication produced parliamentary questions and litigation that kept the architecture of the power in public view. At the centre, the review committee that examines interception orders is constituted on the telegraph pattern, chaired by the Cabinet Secretary with the secretaries for legal affairs and telecommunications, and state review committees are chaired by the Chief Secretary. The safeguards are real on paper, and so is the structural criticism of them, and this article adjudicates neither. The criticism, made consistently by civil liberties organisations including the Internet Freedom Foundation and the Software Freedom Law Center, is that the process is entirely executive: a direction issues from within the government, is reviewed by a committee composed of officials, and never passes before a judge at any point, before or after the event, so that the person intercepted ordinarily never learns of it and can never test its necessity. The answer made for the scheme, by the governments that operate it and in defence of the parallel telegraph regime, is that interception is an investigative and preventive instrument whose utility depends on secrecy and speed, that the grounds are confined to the classic heads of state security and public order, that the review committee mechanism replicates the safeguards the Supreme Court required for telephone tapping in its judgment on the People’s Union for Civil Liberties petition against the Union of India, and that a prior judicial warrant system has never been the Indian model for any form of interception. After the nine-judge bench in Justice K. S. Puttaswamy v. Union of India recognised privacy as a fundamental right, both arguments are conducted within a proportionality discipline, and the sections stand unrepealed within it. For anyone whose work involves material that attracts state attention, the practical consequence of an executive interception regime is a discipline of their own: the methods described in accounts of how journalists use VaultBook to protect sources reflect the care taken by reporters who assume that communications passing through intermediaries may be read under lawful direction, and who therefore keep source material in encrypted form under their own control.

Section 69A carries the blocking power. It empowers the Central Government or an officer specially authorised in that behalf, where satisfied that it is necessary or expedient on grounds that track the reasonable restrictions permitted by Article 19(2) of the Constitution, namely the sovereignty and integrity of India, the defence of India, the security of the State, friendly relations with foreign states, public order, or the prevention of incitement to a cognisable offence relating to those heads, to direct any agency of the government or any intermediary to block access by the public to any information generated, transmitted, received, stored or hosted in any computer resource. An intermediary that fails to comply with a direction is punishable with imprisonment for a term that may extend to seven years and a fine. The procedure and safeguards were prescribed in the Information Technology (Procedure and Safeguards for Blocking for Access of Information by Public) Rules, 2009, which interpose a designated officer, a committee examination of requests, an opportunity of hearing to the intermediary and, where identifiable, to the person who hosted the information, emergency blocking subject to prompt confirmation, and periodic review of blocking orders by the review committee. Rule 16 of those rules requires strict confidentiality to be maintained regarding requests, complaints and action taken.

The section’s most visible exercise came in June 2020 and the months that followed, when the government blocked access, in successive tranches, to several hundred mobile applications of Chinese origin, announcing the action by press release as a measure in the interest of the sovereignty and integrity of India, the defence of India and the security of the State, after the border clashes of that summer. The episode displayed every feature of the architecture at once: the orders themselves were not published, the public record was a press release and a list of application names, the affected companies received the decision as a fact rather than as a reasoned order they could test, and the intermediaries, principally the application stores, implemented blocks whose legal basis their users could not read. Whatever view is taken of the merits, the episode is the standing demonstration that Section 69A operates at the scale of the whole consumer internet, and that its procedure, designed for individual items of information, was being applied to the platforms and applications through which a large part of the country communicates. Two consequences of that architecture have defined the politics of the section. The first is that blocking in India is largely invisible: orders are confidential, the blocked page typically gives the visitor no reason and often no indication of legal authority, and public knowledge of what has been blocked, in what quantity and on whose complaint has had to be assembled from intermediary disclosures, parliamentary answers and litigation rather than from any official publication. Researchers at the Centre for Internet and Society and at the Software Freedom Law Center, which has maintained a public record of reported blocks, have treated that opacity as the central defect, arguing that a restriction on speech that cannot be seen cannot be challenged by the speaker or tested by the public. The official answer is that confidentiality protects the integrity of the process, prevents the evasion that publicity would invite, and mirrors the treatment of the grounds themselves, which concern security and public order. The second consequence is doctrinal. When the section was challenged, the Supreme Court upheld Section 69A and the 2009 Rules as constitutionally valid, resting heavily on the narrowness of the grounds and the procedural safeguards inside the rules, a holding that makes the rules part of the section’s constitutional foundation and not merely its machinery. Section 69B completes the trio at a lower intensity: it empowers the authorised agency to monitor and collect traffic data, defined as data identifying persons, systems or interfaces and the links and locations of transmission, for the purpose of enhancing cyber security and identifying, preventing and mitigating cyber threats and cyber incidents, with the procedure prescribed in rules made in 2009. Traffic data is the envelope rather than the letter, and the section’s inclusion in the same family is a reminder that the 2008 settlement graded state access from content interception down through blocking to metadata collection, each with its own stated purpose and its own procedural wrapper.

Intermediaries and the conditional shield

Section 2(1)(w) defines an intermediary, with respect to any particular electronic record, as any person who on behalf of another person receives, stores or transmits that record or provides any service with respect to that record, and it expressly includes telecom service providers, network service providers, internet service providers, web hosting service providers, search engines, online payment sites, online auction sites, online marketplaces and cyber cafes. The definition is functional and enormous. It captures the access provider carrying packets it cannot read, the host storing content it has never seen, the marketplace that displays a seller’s listing, the search engine that indexes the public web and the social platform whose ranking systems decide what millions read. Nearly every contested question in Indian internet law is, at bottom, a question about what may fairly be demanded of the persons inside this definition.

Section 79 is the provision that answers. As enacted in 2000, it protected a network service provider from liability under the Act and other laws for third party information made available by it, where the provider proved that the offence or contravention was committed without its knowledge or that it had exercised all due diligence to prevent it. That narrow shield was stress-tested early: the prosecution of Avnish Bajaj, the chief executive of the auction site Baazee.com, after a listing on the site offered a video clip recorded at a Delhi school, became the standing example of how exposed an intermediary’s officers were when third party content turned criminal, whatever the company’s own role. The amendment of 2008 replaced the provision entirely. As substituted, Section 79(1) exempts an intermediary from liability for any third party information, data or communication link made available or hosted by it, notwithstanding anything contained in any other law, and Section 79(2) states the conditions: the exemption applies where the intermediary’s function is limited to providing access to a communication system over which information made available by third parties is transmitted, temporarily stored or hosted, or where the intermediary does not initiate the transmission, does not select the receiver of the transmission and does not select or modify the information contained in the transmission, and where the intermediary observes due diligence while discharging its duties under the Act and observes such other guidelines as the Central Government may prescribe. Section 79(3) then removes the exemption where the intermediary has conspired or abetted or aided or induced the commission of the unlawful act, or where, upon receiving actual knowledge, or on being notified by the appropriate government or its agency, that any information, data or communication link residing in or connected to a computer resource controlled by the intermediary is being used to commit an unlawful act, the intermediary fails to expeditiously remove or disable access to that material.

The due diligence condition is where the statute hands its content to the executive. The Information Technology (Intermediaries Guidelines) Rules, 2011 first specified the diligence: publish rules and a privacy policy, take down notified content within a stated time, appoint a grievance officer, preserve records, and refrain from hosting information of listed prohibited kinds. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 replaced that scheme with a far more elaborate one. All intermediaries must operate a grievance mechanism with acknowledgement of complaints within twenty four hours and resolution within fifteen days. Significant social media intermediaries, a category fixed by a notified threshold of registered users, must additionally appoint a chief compliance officer, a nodal contact person and a resident grievance officer in India, publish monthly compliance reports, and, where the intermediary provides services in the nature of messaging, enable the identification of the first originator of information on its platform when lawfully required for specified serious offences. A further part of the 2021 Rules reaches beyond intermediaries to publishers of news media and of online curated content, imposing a code of ethics and a three-tier oversight structure ending in a ministry. An amendment in 2022 added grievance appellate committees to which users may appeal an intermediary’s grievance decisions. Almost every element of this scheme has been challenged in the High Courts, and the challenges share a common legal spine: whether obligations of this weight, including traceability and a state-supervised ethics code for digital media, can be imposed by rules made under a general rule-making power, or whether they required Parliament to amend the statute itself. Parts of the scheme have been stayed in the course of that litigation, and the vires question, rather than the popularity of any single obligation, is what the cases will decide.

Two episodes inside the rules regime show how the ground has moved. The takedown clock is the first. The 2011 guidelines, as drafted, expected an intermediary to act on information obtained through the notification route within thirty six hours, and the combination of that clock with Section 79(3) as originally worded produced the regime the Supreme Court dismantled in 2015: any complainant could start a short countdown at the end of which a platform risked its exemption for keeping material up, which in practice meant that doubtful material came down first and was argued about later, if at all. The reading down re-anchored the clock to court orders and government notifications, so the speed of the obligation survives only where a constituted authority has first judged the material. The traceability obligation is the second. Rule 4(2) of the 2021 Rules requires a significant social media intermediary providing messaging services to enable identification of the first originator of information on its platform, and WhatsApp, whose service is built on end-to-end encryption, challenged the rule in the Delhi High Court on the ground, among others, that identifying a first originator for a message requires breaking the encryption architecture for all messages and is therefore a disproportionate intrusion into the privacy of every user for the sake of some. The Union’s defence treats originator identification as a targeted investigative capability confined to grave offences and lawful orders. The case is the intermediary debate in its purest form, since it asks whether a condition can be attached to safe harbour that the technology of the service cannot satisfy without ceasing to be the service it is, and its resolution will do more to fix the meaning of due diligence in India than any amendment Parliament has under consideration.

Between the statute and the rules stands the judicial settlement of 2015, stated here because the pillar cannot be understood without it, and analysed in the depth it deserves in the account of Shreya Singhal and the free speech judgment. In Shreya Singhal v. Union of India, (2015) 5 SCC 1, the Supreme Court read down Section 79(3)(b) and the corresponding rule in the 2011 guidelines, holding that the actual knowledge which obliges an intermediary to remove material must come from a court order or from a notification by the appropriate government or its agency confined to the grounds in Article 19(2), and that an intermediary cannot be required to judge for itself, on a private complaint, whether content is unlawful. The same judgment upheld Section 69A and its rules, as noted above, and struck down a neighbouring speech offence that the amendment article in this cluster owns. The reading down is the single most misunderstood proposition in Indian internet law, and the misunderstanding runs in one direction: it is routinely said, by complainants and in commentary, that a platform must remove content once a user complains about it. The judgment holds nearly the opposite. A private complaint engages the intermediary’s grievance machinery under the rules; it does not by itself extinguish the statutory exemption.

The judgment also fixed the relationship between the Act’s two doors for state-ordered removal, and the distinction organises a great deal of practice. Behind the first door, Section 69A, a blocking direction issues after the committee procedure of the 2009 Rules, is confined to the Article 19(2) grounds, is confidential, and binds the intermediary to block access by the public, with criminal liability for refusal. Behind the second door, Section 79(3)(b) as read down, a notification by the appropriate government or its agency that specified material is being used to commit an unlawful act relatable to the same constitutional grounds obliges the intermediary, on pain of losing its exemption for that material, to remove or disable access expeditiously. The two doors differ in consequence and in visibility: the first is a direct command backed by imprisonment, the second is a condition on a shield, and a government that notifies under the second door avoids neither the constitutional grounds nor, after the judgment, the requirement that the notification be its own considered act rather than a relay of a private grievance. Intermediaries, for their part, must operate both doors at once, maintaining the committee-facing compliance the blocking rules assume and the grievance-facing machinery the intermediary rules prescribe, and the compliance reports published under the 2021 Rules are the visible residue of that double obligation. Where the state has sought to use the second door to achieve the first door’s effects without the first door’s procedure, the litigation that follows has treated the judgment’s allocation between the doors as the point of law to be defended, which is a further reason the pillar states the settlement with care.

The copyright front of the exemption shows the same structure in a different key, and it produced the most careful Indian judicial treatment of what an intermediary is. Music labels and film producers, whose works circulate on hosting platforms at a scale no licensing department can police by hand, pressed the argument that a platform which profits from traffic, organises content by category and sells advertising against it is not a passive host within Section 79(2) at all. In MySpace Inc. v. Super Cassettes Industries Ltd., a Division Bench of the Delhi High Court worked through the relationship between Section 79 and the infringement provisions of the Copyright Act, 1957, holding that the exemption in this Act and the copyright statute’s own provision on transient and incidental storage had to be read together, that an intermediary could not be fixed with liability for infringing material it had no actual knowledge of in the sense the law requires, and that notices from rights holders, to be effective, had to identify the specific works and their locations rather than demand a general policing of the platform. The reasoning matters beyond copyright. It treats the conditions in Section 79(2) as a functional description of an intermediary rather than a trap, it reads actual knowledge as a demanding standard precisely because the alternative converts every complaint into a removal, and it allocates the cost of identifying infringement to the party who owns the catalogue and can identify it cheapest. Rights holders have answered, in that litigation and since, that identification at platform scale is a burden the statute should share with the platform that built the scale, and the argument between those allocations, in copyright as in speech, is the argument about the internet’s basic economics conducted in legal vocabulary.

The balance struck by this arrangement deserves both of the arguments made about it, at full strength. The case for conditional immunity runs as follows. The volume of material posted through any significant platform exceeds by orders of magnitude what any staff could review in advance, so a rule that made platforms liable for user content unless they policed it would present a choice between closing open publication to the public and removing everything that anyone objected to, since removal is cheap and defence is expensive. Conditional immunity is the price of a public internet in which an unknown speaker can publish without an editor’s permission, and the condition, action on court orders and lawful government notification, directs the legality judgment to institutions constituted to make it. The case for stricter obligations answers that the passive conduit described by Section 79(2) is a fiction for the largest platforms, whose ranking, recommendation and amplification systems select and shape what is read with an editorial effect no newspaper would disclaim, while the profits of engagement accrue to the platform and the harms of the material fall on persons who cannot identify, let alone sue, an anonymous poster. On this view the exemption subsidises scale without responsibility, and obligations of diligence, transparency and remedy are not censorship but the ordinary law of an industry that has outgrown its access-provider origins. This article resolves the dispute only to this extent: whatever the correct balance is, in India it is struck predominantly by rules drafted by the executive and trimmed by a judgment, and not by the text Parliament enacted in Section 79, which states conditions at a level of generality that decides almost nothing by itself. That allocation of law-making labour, to ministry and court rather than to legislature, is itself one of the central facts about the modern Act.

The institutions the Act built

A statute that creates rights and offences must also create the offices that operate them, and the institutional map of this Act explains several of its practical peculiarities. The Controller of Certifying Authorities, described earlier, is the oldest of its institutions and the only one that belongs wholly to the recognition statute of 2000. The amendment of 2008 added the security institutions. Section 70B gave statutory form to the Indian Computer Emergency Response Team, CERT-In, designating it as the national agency for incident response and charging it with collecting and analysing information on cyber incidents, issuing forecasts, alerts and guidelines, coordinating response and prescribing formats for incident reporting. Directions issued under that section in 2022 compressed the reporting obligation dramatically, requiring specified entities to report prescribed categories of incident within six hours of noticing them, a timetable whose burden on smaller entities has been debated ever since between the agency, which treats rapid reporting as the condition of any coordinated national response, and industry bodies, which treat the window as unworkable for incidents still being understood. The same directions reached further into the architecture of services: they required synchronisation of system clocks to the network time protocol servers of the designated national agencies, retention of specified logs within Indian jurisdiction for a rolling period, and, for data centres, cloud service providers and virtual private network providers among others, the maintenance of validated records of subscribers and customers for five years. The virtual private network limb drew the sharpest response, since a service whose commercial promise is that it does not retain the identity of the user behind an address was directed to keep exactly that record, and several international providers withdrew their physical servers from India rather than operate under the condition, continuing to serve Indian users from elsewhere. The episode belongs in any honest account of the Act, because it shows the statute’s security institutions exercising, through directions under a single section, a regulatory power over the design of services that the text of the section, read in 2008, would not have led anyone to predict. Section 70A empowers the Central Government to designate a national nodal agency for the protection of critical information infrastructure, defined around computer resources whose incapacitation or destruction would debilitate national security, the economy, public health or safety; the National Critical Information Infrastructure Protection Centre was designated for that role, and the sectors treated as critical for its purposes run across power and energy, banking and financial services, telecommunications, transport and government and strategic public enterprises, so that together the centre and Section 70 cover the networks whose failure would be a national event rather than a private loss, and Section 70 backs the scheme by making unauthorised access to a notified protected system an offence punishable with imprisonment that may extend to ten years.

What is an examiner of electronic evidence, and why does Section 79A matter?

Section 79A empowers the Central Government to notify any department, body or agency of the central or a state government as an examiner of electronic evidence, for the purpose of providing expert opinion on electronic form evidence before any court or authority.

Notified examiners, which include forensic science laboratories with digital forensics capability, supply the accredited expertise on which the admissibility contest over electronic records is frequently fought.

The provision matters because electronic records are fragile exhibits. A printout of a message, a screenshot of a page or a copy of a file on a storage device is trivially alterable, and the evidence law therefore surrounds secondary electronic evidence with a certification discipline described in the next section. When authenticity is contested, the case often turns on forensic examination of the source device or the platform’s records, and Section 79A is the bridge between that forensic work and the courtroom: it gives governments a mechanism to designate the laboratories whose opinions courts can receive as expert evidence on the electronic form of the material. In the ecology of the Act, it is a small provision with an outsized practical footprint, since the volume of litigation in which the decisive document exists only as data has grown far beyond the cybercrime docket for which the Act was designed.

The adjudicative institutions complete the map, and their history carries a warning. Claims of compensation under Chapter IX go to adjudicating officers under Section 46, senior officers of the central or state governments holding an inquiry with the powers of a civil court, and questions of penalty under the signature chapters go in the first instance to the Controller. Appeals from both were designed to lie to a specialist tribunal established under Section 48, the Cyber Appellate Tribunal, with a further appeal to the High Court under Section 62 on the tribunal’s decision, and Section 61 bars civil courts from entertaining matters the adjudicating officer or the tribunal is empowered to determine. In operation the tribunal was for long stretches a tribunal without a presiding officer: the single tribunal established at New Delhi in 2006 functioned only intermittently, its docket remained modest in the years it sat, and appeals accumulated without a forum in the years it did not. The Ministry’s own answers in Parliament recorded one tribunal for the whole country, never replicated in any state, and a stream of appeals measured in tens rather than thousands, figures that describe an appellate tier that the statute created and the system largely routed around, since parties with resources preferred writ jurisdiction and parties without them rarely reached the tribunal at all. The tribunal was, in addition, vested with the powers of a civil court under Section 58 and freed by Section 59 from the technicalities of the Code of Civil Procedure in favour of natural justice, and appeals to it carried a forty five day limitation under Section 57, extendable where sufficient cause was shown, an architecture that was perfectly serviceable on paper and idle for want of a chairperson to work it. Parliament closed the experiment in the Finance Act, 2017, which substituted Section 48 to make the Telecom Disputes Settlement and Appellate Tribunal, established under the Telecom Regulatory Authority of India Act, 1997, the Appellate Tribunal for the purposes of this Act with effect from 26 May 2017. The appeal route a claimant actually travels therefore runs from an adjudicating officer or the Controller to the TDSAT and then to the High Court, a route that many bare summaries of the Act, still describing the Cyber Appellate Tribunal as though it sat, get wrong. Limitation, the recovery of penalties as arrears of land revenue, and the remaining procedural detail sit in Sections 60 to 64 and in the adjudication rules, and the general statement of this article comes with the caution that belongs to any live claim: the summary given here is legal information about the structure of the law, not advice on an individual case, and limitation periods in this field are short enough to punish delay.

Electronic evidence: the certificate that decides cases

The amendment of the Indian Evidence Act, 1872 by this Act’s Second Schedule has generated a body of litigation larger than most of the Act itself. The schedule inserted electronic records into the definition provisions of the evidence law, made the opinion of the examiner of electronic evidence a relevant fact when the court has to form an opinion on an electronic record, and introduced Sections 65A and 65B, a special procedure under which the contents of electronic records may be proved. Section 65B admits a computer output, a printout or a copy on an optical or magnetic medium, as a document without proof of the original, where the conditions about the regularity of the computer’s operation and the integrity of the information are satisfied and where the output is accompanied by a certificate identifying the electronic record, describing the manner of its production and the particulars of the device involved, signed by a person occupying a responsible official position in relation to the operation of the device or the management of the activity.

The conditions the certificate polices are set out in Section 65B(2), and they describe the four anxieties a court has about a machine’s testimony: that the computer output was produced by a computer used regularly to store or process information for the purposes of activities regularly carried on by the person having lawful control over it; that information of the kind contained in the record was regularly fed into the computer in the ordinary course of those activities; that throughout the material part of the period the computer was operating properly, or that any respect in which it was not operating properly did not affect the record or the accuracy of its contents; and that the information in the record reproduces or is derived from information supplied to the computer in the ordinary course of those activities. Where the conditions are met and the certificate speaks to them, the output is admissible as evidence of the contents of the original without further proof. The same round of amendments equipped the evidence law with presumptions fitted to the new material: Section 85A presumes that an electronic record purporting to be an agreement containing the electronic signatures of the parties was concluded by affixing those signatures; Section 85B attaches presumptions of integrity and authenticity to secure electronic records and secure electronic signatures; Section 85C presumes the correctness of the information listed in an electronic signature certificate unless the contrary is proved; and Section 88A permits the court to presume that an electronic message forwarded through a server to the addressee corresponds with the message fed into its originator’s computer, while expressly forbidding any presumption as to who sent it. Attribution, the question Section 88A refuses to answer by presumption, is left to proof, which is one reason the attribution rules of this Act, described earlier, carry so much practical weight.

The certificate became the battleground. In Anvar P. V. v. P. K. Basheer, (2014) 10 SCC 473, a three-judge bench of the Supreme Court held that Section 65B is a complete code for the admissibility of electronic evidence in secondary form and that the certificate is a mandatory condition of admissibility, displacing the recourse to the general provisions on secondary evidence that an earlier decision had permitted. A later two-judge decision softened the requirement where the party was not in possession of the device, and the conflict was resolved by a three-judge bench in Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, (2020) 7 SCC 1, which reaffirmed Anvar, held the certificate to be mandatory, and clarified that a court may summon and permit its production at a later stage where the party was genuinely unable to obtain it earlier. A worked illustration shows why the certificate discipline bites so often. A bank’s customer disputes a transaction and the bank produces a printout of its server log in an adjudication or a prosecution. The log is not the electronic record itself but a computer output, secondary evidence of what the server recorded. Under Section 65B the printout is admissible only if the four conditions are satisfied and a certificate from an official responsible for the relevant system identifies the record, describes how it was produced and gives the particulars of the device, and the opposing party is entitled to test both. Where the bank’s certificate is defective, or none is filed, the log that everyone in the room believes to be genuine may be excluded, and with it the transaction trail on which the case depends. Multiply the illustration across call detail records in a kidnapping trial, footage in a hit and run prosecution and message exports in a matrimonial dispute, and the certificate emerges as one of the most consequential documents in Indian litigation, a status it owes entirely to a schedule of the statute this article describes. The practical stakes of this line of authority are difficult to exaggerate. Call records, closed circuit television footage, messaging exports and server logs are the decisive exhibits in a large share of modern trials, civil and criminal alike, and their admission or exclusion on a question of certification has decided bail applications, elections disputes and murder trials. A statute pillar is not the owner of that doctrine, which belongs to the evidence law’s own literature, but no reader of the Information Technology Act should miss that its most frequently applied provision may be one it inserted into another statute in 2000, before the offences and powers that dominate its reputation existed.

The amendment arc in brief

The transformation described throughout this article has one principal author. Its lineage runs through an expert committee on amendments to the Act constituted in 2005, whose recommendations fed an amendment bill introduced in the Lok Sabha in December 2006 and examined by the parliamentary standing committee, so the overhaul was a considered project years in preparation before it became, in its final passage, an urgent one. The Information Technology (Amendment) Act, 2008, passed in December 2008, assented to on 5 February 2009 as Act 10 of 2009 and brought into force on 27 October 2009, rewrote the statute’s centre of gravity in a single operation. It made the signature framework technology neutral; it inserted Section 10A on electronic contracts and Section 6A on electronic service delivery; it inserted Section 43A on corporate data negligence; it rebuilt Section 66 and added the offence family of Sections 66A to 66F and 67A to 67C; it substituted Section 69 in a far wider form and inserted the blocking and traffic data powers in Sections 69A and 69B, the blocking section being a late arrival even within the amendment project, absent from the amendment bill as introduced in 2006 and from the standing committee’s deliberations on it; it gave CERT-In its statutory basis; and it replaced Section 79 with the conditional intermediary exemption. The circumstances of its passage belong to the record: the amendment bill had been under examination since 2006, and the Act was passed by both Houses in the closing days of December 2008, in the first session after the terrorist attacks on Mumbai of 26 November 2008, with the Lok Sabha passing it without a debate, a haste that critics of the resulting text have cited ever since and that the subsequent decade of litigation over its speech and surveillance provisions has kept alive. One of its insertions, Section 66A, which punished the sending of offensive messages through communication devices, was struck down in its entirety in 2015 as an unconstitutional restriction on free speech. The full anatomy of that amendment, its passage and its most controversial section are the subject of the account of the IT Amendment Act 2008 and Section 66A, which owns the amendment trail for this cluster; the pillar records only that the distance between the Act of 2000 and the Act in force is, in substance, the distance that single amendment travelled. Later changes have been of a different order. The Finance Act, 2017 substituted the appellate forum, as described above. The data protection statute of 2023 scheduled the removal of Section 43A and adjusted Section 81, withdrawing a subject from this Act rather than adding one. The pattern across two decades is consistent: the Act grows by absorbing the internet’s new problems as they become politically urgent, and sheds a subject only when a dedicated statute is built to receive it.

The honest assessment

What works in this statute has worked quietly for two decades. The recognition chapters have never needed rescue. Electronic records and signatures are admitted, filed, verified and relied upon across Indian commerce and administration with so little friction that the legal machinery enabling them has become invisible, which is the fate of successful infrastructure. The certificate ecosystem under the Controller functions, the attribution rules quietly allocate responsibility in disputes, and the equivalents in Sections 4 to 10 have aged well precisely because they were drafted as functions rather than technologies. The compensation chapter is more mixed. Section 43 gives victims of intrusion a civil remedy with an uncapped measure of damages, yet claims before adjudicating officers remain rare relative to the volume of computer misuse, and the route is better known to specialists than to the businesses and individuals it was designed for. Section 43A filled a genuine void in 2008, but a negligence-based compensation duty, dependent on rules with limited enforcement visibility, was always a provisional data protection regime, and its replacement by a dedicated statute is better understood as the completion of the design than as its failure.

What strains is the load the control statute carries. A blocking power exercised through confidential orders, an interception power without prior judicial authorisation, and a platform liability regime whose operative terms are set by rules that the courts are asked, repeatedly, to test against the rule-making power, all rest on a statute whose Statement of Objects and Reasons speaks of electronic commerce and the United Nations model law. None of that makes the powers unlawful; Section 69A survived challenge, Section 79 survived as read down, and Section 69 stands. It does mean that the legitimacy debates around Indian internet governance are conducted at one remove from the legislature, in committee rooms, rule notifications and constitutional litigation, because the text that authorises the whole structure was drafted for a different internet and amended in bulk in a single December. The recurring official response, the announcement of a successor statute for the digital field, described over years in policy statements as the next framework for the sector, concedes the architectural point even while the existing Act continues in force. Successive expert and industry commentary has made the same argument from the other side, that a statute written when the internet meant email and static pages should not govern an era of platforms, encrypted messaging and machine-generated content without being rethought as a whole. The questions a successor statute would have to decide are visible in the consultation themes the government itself has aired for a replacement framework: whether intermediaries should be classified by function and risk rather than swept into a single definition; whether safe harbour should remain a statutory exemption trimmed by judgment or be rebuilt as a graded set of obligations; whether online safety, including the protection of children and the handling of harmful content that is not unlawful, should be a statutory subject at all; and whether the offences chapter should be pruned back to conduct that only a computer makes possible, leaving general wrongs to the general penal law. That none of these questions can be answered inside the present text, and that all of them are questions about speech, safety and market structure rather than about electronic commerce, is the measure of the distance travelled since 2000. Until a successor is enacted, the Act remains the operative law, and its provisions continue to be the ones cited in blocking orders, in takedown correspondence and in charge sheets, which is why the accurate statement of what it contains, attempted in this article, is not a historical exercise.

The monetary penalties tell the same story of maintenance by halves. The compensating ceilings of the 2008 settlement were at least revisited, when the five crore jurisdictional figure replaced the original one crore ceiling in Section 46(1A); the fines of the offences chapter, by contrast, were set when the amendment was drafted and have never been revised since, and a fine expressed in the rupees of that period prices deterrence for an internet a fraction of the present one’s size. Practice has compensated in the only ways open to it, by leaning on the imprisonment terms, on compensation claims where a civil route exists, and on regulatory consequences under other instruments, but a statute whose powers are continuously updated by rule while its penalties stand still is being maintained selectively, and the selectivity is itself evidence of where the system’s attention lies: it renews the instruments of control with care and lets the instruments of redress drift.

The routes a dispute actually travels

For the reader who arrives at this statute with a problem rather than an interest, the provisions assemble into a small number of distinct routes, and choosing the wrong one is the most common practical error. A person whose money has been taken through unauthorised transactions, whose data has been copied or whose system has been damaged has a civil claim under Section 43, and a company or institution in the frame may face Section 43A; that claim is filed before the adjudicating officer of the state where the computer resource or the cause of action sits where the claim does not exceed five crore rupees, and before the competent civil court above that figure, and it is a claim for compensation in which dishonesty need not be proved. The same facts will usually also disclose an offence, and the criminal route runs through a complaint to the police, in practice to the cyber cell or cyber police station of the district, where the investigating officer must hold the rank of Inspector or above under Section 78 and where the prosecution will select among Section 66 and its companions in this Act and the corresponding offences of the general penal law. A grievance about a certificate, a licence or the conduct of a certifying authority goes to the Controller of Certifying Authorities, who is both regulator and, for several purposes, the first forum. A grievance against a platform travels a newer staircase: first to the intermediary’s own grievance officer under the 2021 Rules, whose acknowledgement and resolution clocks run in hours and days, then to a grievance appellate committee constituted by the Central Government, and only thereafter, or in parallel on a question of right, to the courts. Two of the Act’s powers have no individual route at all. A person whose content is blocked under Section 69A receives, by the design of the rules, no notice and no statutory appeal, and the remedy lies in a writ petition to a High Court once the block is discovered; and a person subjected to interception under Section 69 has no forum in which to test the direction, which is the substance of the criticism recorded earlier in this article. Appeals within the Act’s own machinery run from adjudicating officers and the Controller to the Telecom Disputes Settlement and Appellate Tribunal and then to the High Court, as the institutions section described. The map as a whole teaches the lesson the pillar has pressed throughout: this statute distributes its work among forums and instruments that no single chapter describes, and the text of any one provision, read alone, will mislead a reader about how a real dispute under the Act proceeds.

A counter-reading, and why it only half succeeds

The argument of this article, that an e-commerce statute is doing constitutional work it was not designed for, has a respectable answer that deserves to be stated before the verdict. The answer runs that omnibus technology statutes are a normal legislative form: the telegraph statute governed the telephone for a century, broadcasting and cable were layered into older communications law in many countries, and the Indian Act’s own model, the UNCITRAL framework, was written for a world in which the same networks would carry commerce, crime and speech indistinguishably. On this view the 2008 amendment was not a hijacking but a consolidation, bringing the internet’s legal problems into the one statute that already defined its terms, its institutions and its evidence rules, and the alternative of separate statutes for crime, speech, data and platforms would have multiplied the definitional conflicts that already complicate the field. There is force in the defence, and the durability of the recognition chapters shows the value of a single definitional home. It only half succeeds because consolidation explains the location of the powers but not their procedure. A blocking regime whose orders are confidential, an interception regime without a judicial stage and a platform regime written in ministry rules are choices, not necessities of consolidation, and each was made inside the shelter of a statute whose title and objects never announced them to the legislators who voted. The criticism of the Act is therefore best directed not at the fact that one statute does this work, but at the level of law, text against rules, and of visibility, published against confidential, at which the work is done.

Verdict

The Information Technology Act 2000 is two statutes in one binding, and it should be read, cited and argued about as two. The recognition statute of 2000 solved a real problem with an elegant technique and has been vindicated by twenty years of unobtrusive use; if it had remained the whole Act, this article would be a tenth of its length and the statute a footnote in commercial law. The control statute of 2008 is where the constitutional action is: the offences, the data duty, the interception and blocking powers and the conditional shield for intermediaries, elaborated since by rules and disciplined at critical points by the Supreme Court. The series of which this article forms part has found statute after statute performing work its drafters did not contemplate, and this is the clearest modern instance of the pattern, an Act whose long title promises electronic commerce and whose sections govern the speech of a republic. Readers who need the machinery of the amendment itself should go next to the amendment article in this cluster, and those who need the judgment that redrew the intermediary settlement and struck down the speech offence should go to the free speech article; this pillar’s task has been the prior one of showing what the whole structure is, which parts of it were original, and where its working detail actually resides. A statute that still authenticates the country’s filings, still supplies the offences in its charge sheets, still houses the powers by which content is blocked and traffic is watched, and still waits for the successor that would let it retire to the recognition work it was built for, has earned the close reading this article has attempted to give it.

Frequently Asked Questions

Q: What was the Information Technology Act 2000 enacted to do?

The Act was enacted to give legal recognition to transactions carried out by electronic data interchange and other means of electronic communication, commonly called electronic commerce, and to facilitate the electronic filing of documents with government agencies. Modelled on the United Nations model law on electronic commerce of 1996, it made electronic records and signatures legally effective in place of paper and signatures in ink, amended the penal code, the evidence law, the bankers’ books law and the Reserve Bank law to fit that recognition, and added offences and civil liability for computer misuse. Its stated world was commerce and governance conducted without paper.

Q: Are electronic records and signatures legally valid?

Yes, on the conditions the Act prescribes. Section 4 treats a legal requirement of writing as satisfied by an electronic record that is accessible and usable for subsequent reference, Section 5 treats a requirement of signature as satisfied by an electronic signature affixed in the prescribed manner, and Section 7 validates electronic retention where the record remains accessible, accurately representative and accompanied by identifying particulars. Validity is therefore functional rather than automatic: an inaccessible or unverifiable record does not earn the equivalence, and a small set of documents, including wills, trusts and powers of attorney, is excluded from the scheme altogether.

Q: What computer offences does the IT Act create?

The offences chapter, mostly built by the amendment of 2008, covers tampering with computer source documents under Section 65; computer related offences under Section 66, which criminalises the unauthorised acts listed in Section 43 when done dishonestly or fraudulently; dishonestly receiving a stolen computer resource under Section 66B; identity theft under Section 66C; cheating by personation under Section 66D; violation of privacy by capturing or transmitting images of a private area without consent under Section 66E; cyber terrorism under Section 66F; and the content offences of obscenity, sexually explicit material and child sexual abuse material under Sections 67, 67A and 67B, alongside offences protecting protected systems, certificates and official information.

Q: When does an intermediary lose safe harbour?

An intermediary holds the exemption in Section 79 only while its function stays within the statutory conditions: it must not initiate the transmission, select the receiver, or select or modify the information, and it must observe due diligence and the prescribed guidelines. It loses the exemption where it has conspired, abetted, aided or induced the unlawful act, and where, upon receiving actual knowledge or being notified by the appropriate government or its agency, it fails to expeditiously remove or disable access to material being used to commit an unlawful act. Since the Supreme Court read the provision down in 2015, actual knowledge means knowledge conveyed by a court order or a government notification confined to the constitutional grounds for restricting speech, not a private complaint.

Q: What power does the government have to block online content?

Section 69A empowers the Central Government, or an officer specially authorised by it, where satisfied that it is necessary or expedient on grounds tracking Article 19(2) of the Constitution, including the sovereignty and integrity of India, the security of the State, friendly relations with foreign states and public order, to direct any government agency or any intermediary to block public access to information generated, transmitted, received, stored or hosted in any computer resource. The blocking rules of 2009 supply the procedure, with a designated officer, committee examination, review of orders and strict confidentiality, and an intermediary that refuses to comply faces imprisonment of up to seven years and a fine. The Supreme Court upheld the section and the rules as constitutionally valid.

Q: What interception and monitoring powers does the IT Act give?

Section 69 empowers the central and state governments, through an authorised officer and on grounds including the sovereignty and integrity of India, defence, security of the State, friendly relations with foreign states, public order and preventing incitement to related cognisable offences, to direct an agency to intercept, monitor or decrypt any information generated, transmitted, received or stored in any computer resource, and intermediaries and subscribers must extend all facilities and technical assistance on pain of imprisonment of up to seven years. Section 69B adds the lesser power to authorise an agency to monitor and collect traffic data for cyber security purposes, and the interception rules of 2009 prescribe the procedure, designated officers and a review committee for directions under Section 69. The power itself is older than its present form: the Act as enacted carried a narrower interception provision, the original Section 69, under which the Controller of Certifying Authorities could direct a government agency to intercept information transmitted through a computer resource and subscribers had to extend facilities to decrypt it; the amendment of 2008 substituted that section with the wider power described here.

Q: What is the corporate liability for failing to protect personal data?

Section 43A, inserted in 2008, makes a body corporate that possesses, deals in or handles sensitive personal data or information in a computer resource it owns, controls or operates liable to pay damages by way of compensation to the person affected, where it is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain. The sensitive categories and the practices are defined by the security practices rules of 2011, which cover passwords, financial information, health information, sexual orientation, medical records and biometric information, and which treat a documented security programme built on a recognised standard as satisfying the duty. The dedicated data protection statute of 2023 provides for Section 43A to be omitted as that regime takes over the field.

Q: Which body hears an appeal under the IT Act?

An appeal from an order of the Controller of Certifying Authorities or of an adjudicating officer lies to the Appellate Tribunal under Section 57, and a further appeal lies to the High Court under Section 62. The tribunal named in that route changed in 2017: the Act as enacted created a Cyber Appellate Tribunal under Section 48, but the Finance Act, 2017 substituted the section so that the Telecom Disputes Settlement and Appellate Tribunal, the TDSAT, is the Appellate Tribunal for the purposes of the Act with effect from 26 May 2017. Summaries that still direct appeals to the Cyber Appellate Tribunal describe a forum that no longer holds the jurisdiction.

Q: What is the difference between a digital signature and an electronic signature?

A digital signature is a specific technique, built on asymmetric cryptography, in which a key pair links the signer to the record and reveals any later alteration. An electronic signature is the wider statutory category: after the amendment of 2008 made the Act technology neutral, Section 3A recognises electronic signature techniques notified in the Second Schedule, of which the digital signature is the first and most developed instance. The practical difference is that the law no longer ties legal validity to one cryptographic method, so other reliable authentication techniques can be notified and used, while certificates issued by licensed certifying authorities continue to be built on the digital signature model.

Q: Are contracts formed through electronic means legally enforceable under the IT Act?

Yes, where the ordinary requirements of contract are met. Section 10A, inserted by the amendment of 2008, provides that a contract is not unenforceable solely on the ground that the communication of proposals, the acceptance of proposals, or the revocation of either, took electronic form or was expressed by means of an electronic record. The section removes the objection to the medium; it does not displace the Indian Contract Act, 1872, which still governs offer, acceptance, consideration, capacity and consent, and a bargain that fails those tests fails however it was recorded. Its everyday importance is that click-wrap terms, application-based orders and acceptances recorded in server logs begin from enforceability rather than from doubt.

Q: What compensation can a person claim under Section 43 of the IT Act?

Section 43 entitles a person affected by unauthorised interference with a computer, system or network to damages by way of compensation from the person responsible, across a list of acts that includes unauthorised access, downloading or copying data, introducing a virus or contaminant, damaging or disrupting the system, denying access to an authorised user, facilitating unauthorised access, and destroying, deleting or altering information or source code. Unlike a prosecution under Section 66, the claim does not require dishonesty or fraud; absence of permission is the core of the wrong. The amendment of 2008 removed the original ceiling of one crore rupees, and the adjudicating officer assesses the amount on the gain of unfair advantage, the loss caused and the repetitive character of the default.

Q: What is the monetary limit on claims an adjudicating officer can decide under the IT Act?

Section 46(1A), inserted by the amendment of 2008, confines the adjudicating officer’s jurisdiction to matters in which the claim for injury or damage does not exceed five crore rupees, and provides that jurisdiction over a claim exceeding five crore rupees vests in the competent court. The limit is a feature practitioners miss when accounts of the Act describe adjudication without it: a large compensation claim under Section 43 or Section 43A is not filed before the state’s adjudicating officer at all, but before the court, while claims at or below the threshold follow the summary inquiry route the chapter prescribes, with the officer exercising the powers of a civil court for summoning evidence and enforcing attendance.

Q: Does the IT Act apply to offences committed outside India?

Yes, on a broad condition. Section 1(2) extends the Act to the whole of India and applies it also to offences and contraventions committed outside India by any person, and Section 75 provides that the Act applies to an offence or contravention committed outside India where the act or conduct constituting it involves a computer, a computer system or a computer network located in India. The connecting factor is therefore the location of the machine, not the nationality of the actor or the residence of the victim: an intrusion routed into, or data taken from, a system in India falls within the Act even where every human participant acted abroad, subject always to the practical and treaty questions that enforcement against a person abroad presents.

Q: What is a protected system under Section 70 of the IT Act?

A protected system is a computer resource that the appropriate government notifies in the Official Gazette as protected, within the scheme for critical information infrastructure under which Section 70A provides for a national nodal agency for the protection of resources whose incapacitation or destruction would debilitate national security, the economy, public health or safety. Section 70 authorises notification, empowers the government to authorise persons to access the system, and makes it an offence, punishable with imprisonment that may extend to ten years and a fine, for any person to secure access or attempt to secure access to the protected system in contravention of the section. The category is therefore small, notified and heavily defended, unlike the general run of computers the rest of the Act addresses.

Q: What is CERT-In and what are its functions under the IT Act?

The Indian Computer Emergency Response Team, CERT-In, is designated by Section 70B, inserted by the amendment of 2008, as the national agency for performing functions in the area of cyber security: collecting, analysing and disseminating information on cyber incidents; issuing forecasts and alerts; taking emergency measures for handling incidents; coordinating incident response activities; and issuing guidelines, advisories, vulnerability notes and white papers. It is also the authority empowered to call for information and give directions to service providers, intermediaries, data centres and bodies corporate for those purposes, with failure to comply punishable as the section prescribes. Its directions of 2022, including the requirement that specified incidents be reported within six hours, made it one of the most operationally significant offices created under the Act.

Q: What information must an intermediary preserve under Section 67C?

Section 67C requires an intermediary, or a person in charge of a computer resource, to preserve and retain such information as may be specified, for such duration and in such manner and format as the Central Government may prescribe, and it punishes an intentional or knowing failure to preserve and retain the information with imprisonment for a term that may extend to three years and a fine. The prescriptions under it, made through the rules governing intermediaries and cyber cafes and related instruments, fix retention periods for registration records, logs and transaction data. The provision is the Act’s memory: offences and civil claims under the rest of the statute frequently depend on records that only the intermediary holds, and Section 67C is what obliges it to keep them.

Q: Can a company be prosecuted for an offence under the IT Act?

Yes. Section 85 provides that where a person committing a contravention of the Act or of rules, orders or directions under it is a company, every person who, at the time the contravention was committed, was in charge of and responsible to the company for the conduct of its business, is deemed guilty along with the company and liable to be proceeded against and punished accordingly. The attribution is not automatic in outcome: a person is not liable if he proves that the contravention took place without his knowledge or that he exercised all due diligence to prevent it, and directors, managers and officers are separately liable where the contravention occurred with their consent, connivance or neglect. The section is the reason the Baazee.com prosecution, brought against the company’s chief executive personally, remains a standard caution in Indian platform practice.

Q: Which documents and transactions does the IT Act not apply to?

Section 1(4), read with the First Schedule, excludes a defined set: a negotiable instrument as defined in the Negotiable Instruments Act, 1881, other than a cheque; a power of attorney; a trust as defined in the Indian Trusts Act, 1882; a will as defined in the Indian Succession Act, 1925, including any codicil or testamentary disposition; and any contract for the sale or conveyance of immovable property or of any interest in such property. The recognition chapters therefore cannot be used to make an electronic will, an electronic power of attorney or an electronic conveyance of land, however reliable the signature technology, because Parliament reserved those instruments to paper. Governments have power to amend the Schedule by notification, which is the route by which any future extension would arrive.

Q: Which police officers are empowered to investigate offences under the IT Act?

Section 78 provides that, notwithstanding anything contained in the Code of Criminal Procedure, a police officer not below the rank of Inspector shall investigate any offence under the Act. The threshold is itself a piece of the amendment history: the Act as enacted reserved investigation to an officer not below the rank of Deputy Superintendent of Police, and the amendment of 2008 lowered the rank to Inspector, widening the investigating cadre in recognition of the volume and geographic spread of computer offences. In practice investigation is concentrated in the cyber cells and cyber police stations that states have established, but the statutory authority to investigate any offence under the Act attaches to the rank the section names, wherever the officer serves.

Q: Can an offence under the IT Act be compounded, and who must agree?

In general, yes, within limits set by Section 77A. An offence under the Act, other than an offence for which the punishment is imprisonment for life or imprisonment for a term exceeding three years, may be compounded by the court having jurisdiction, before or after the institution of proceedings, on the application of the person accused. The court must be satisfied that the compounding will not affect the sovereignty and integrity of India or the security of the State, and compounding is barred where the accused is, by reason of an earlier conviction, liable to enhanced punishment or a different kind of punishment, or where the offence is one committed against a woman or a child under eighteen. Section 77B complements the scheme by making offences punishable with imprisonment for three years or less bailable, and those above that term cognisable, with the grave offences, cyber terrorism above all, standing outside the lenient side of both provisions.