IT Act 2000: Key Sections, Penalties and Duties for IT Companies in India

The IT Act 2000, formally the Information Technology Act, 2000, is the law most Indian IT compliance rests on. CERT-In's six-hour incident reporting, the intermediary guidelines for platforms, the 2011 rules on sensitive personal data and the government's blocking and interception powers all come from it. For an IT company, it also defines what the company and its people can be held liable for: unauthorised access, data theft, disclosure of client information in breach of contract, and failure to protect sensitive personal data.

This guide explains the structure of the Act, the sections that matter to IT and software companies, the 2008 amendments, the duties of intermediaries and service providers, penalties, and how the Act is changing as the Digital Personal Data Protection Act, 2023 comes into force. It is a practical overview for founders, delivery heads and security leads, not legal advice.

What is the Information Technology Act, 2000?

The Information Technology Act, 2000 (Act No. 21 of 2000) is a central law of India that provides legal recognition for transactions carried out by electronic data interchange and other electronic communication (electronic commerce), facilitates electronic filing with government, and deals with cyber contraventions and offences. It has 13 chapters and several schedules, and it is the parent Act for many rules issued by MeitY and directions issued by CERT-In.

The main parts relevant to IT companies are:

• Chapters II to V: digital and electronic signatures, electronic governance, attribution and acknowledgement of electronic records, and secure records and signatures.
• Chapter VI: regulation of certifying authorities that issue digital signature certificates, under the Controller of Certifying Authorities.
• Chapter IX: penalties, compensation and adjudication, including sections 43 and 43A.
• Chapter XI: offences, including sections 65 to 72A.
• Chapter XII: intermediaries not to be liable in certain cases (section 79).
• Chapter XIIA: examiner of electronic evidence.
• Chapter XIII: miscellaneous, including offences by companies (section 85) and rule-making powers (section 87).

History and why the Act was introduced

The Act was passed in 2000, came into force on 17 October 2000, and was based on the UNCITRAL Model Law on Electronic Commerce adopted by the United Nations in 1996. India needed laws that would let contracts, records and signatures exist electronically, so that e-commerce and e-governance could grow, and it needed offences for computer crime.

The Information Technology (Amendment) Act, 2008, in force from 27 October 2009, made major changes after the growth of the IT and outsourcing industry and high-profile incidents. It introduced technology-neutral "electronic signatures", added section 43A on compensation for failure to protect sensitive personal data, section 72A on disclosure of information in breach of a lawful contract, new offences such as identity theft (66C), cheating by personation (66D), violation of privacy (66E) and cyber terrorism (66F), the blocking power in section 69A, the role of CERT-In in section 70B, and revised the intermediary safe harbour in section 79.

In 2015, the Supreme Court in Shreya Singhal v. Union of India struck down section 66A, which had criminalised sending "offensive" messages, as unconstitutional, and read down section 79 so that intermediaries need act only on court orders or government notifications. The Digital Personal Data Protection Act, 2023 will omit section 43A once its section 44(2) takes effect. The government has also discussed a broader replacement for the Act, sometimes referred to as a Digital India Act; at our last review no such law had been enacted.

Who must comply?

The IT Act applies to the whole of India and, under section 75, to offences and contraventions committed outside India by any person if the act involves a computer, computer system or network located in India. In practice:

• Every company and person using computers in India is subject to its offences and contraventions.
• Body corporates (any company, firm, sole proprietorship or association engaged in commercial or professional activities) handling sensitive personal data have the section 43A duty and the SPDI Rules.
• Intermediaries (anyone who receives, stores or transmits electronic records on behalf of another, or provides a service about them, including telecom and internet providers, hosting, search engines, online marketplaces, payment sites and social media) must observe due diligence to keep their safe harbour under section 79.
• Service providers, data centres and body corporates must follow CERT-In Directions issued under section 70B(6).

An Indian IT services company serving only foreign clients is still subject to the Act for its systems in India, its staff and the data it handles there.

Key provisions for IT companies

Electronic records, signatures and contracts

Section 4 gives legal recognition to electronic records where law requires information in writing. Sections 3 and 3A deal with digital signatures and electronic signatures, and section 5 recognises them where law requires a signature. Section 10A confirms that contracts formed through electronic means are not unenforceable for that reason alone. The First Schedule excludes certain documents, such as negotiable instruments other than cheques, powers of attorney, trusts, wills and contracts for the sale or conveyance of immovable property. For software companies, this is what makes click-wrap terms, e-signature workflows and electronic invoices legally effective, within those limits.

Section 43: unauthorised access and damage

Section 43 makes a person who, without permission of the owner or person in charge, accesses a computer system, downloads or extracts data, introduces a virus, damages data, disrupts systems, denies access to authorised persons, or steals, conceals or alters source code with intent to cause damage, liable to pay damages by way of compensation to the person affected. It is a civil provision, decided by an adjudicating officer (section 46) for claims up to five crore rupees and by civil courts above that. When done dishonestly or fraudulently, the same acts are an offence under section 66.

Section 43A: protecting sensitive personal data

Where a body corporate possessing, dealing with or handling sensitive personal data or information in a computer resource it owns, controls or operates is negligent in implementing and maintaining reasonable security practices and procedures, and thereby causes wrongful loss or wrongful gain to any person, it is liable to pay damages by way of compensation. The SPDI Rules, 2011 define sensitive personal data (passwords, financial information, health data, sexual orientation, medical records, biometric information and related data) and treat a documented security programme, such as one based on IS/ISO/IEC 27001 and audited annually, as reasonable security practices. Section 43A will be omitted when section 44(2) of the DPDP Act takes effect, at which point the DPDP Act's security safeguard duties and penalties take over.

Section 72A: disclosure in breach of a lawful contract

Any person, including an intermediary, who while providing services under a lawful contract has secured access to material containing personal information about another person, and with intent to cause or knowing that he is likely to cause wrongful loss or gain, discloses it without consent or in breach of the contract, is punishable with imprisonment up to three years, or a fine up to five lakh rupees, or both. This is the provision most directly relevant to IT outsourcing: an employee or vendor who leaks client personal data can face criminal liability.

Section 72: breach of confidentiality by persons with powers under the Act

Applies to persons who secured access to records under powers conferred by the Act and disclose them without consent; it is mainly relevant to officials.

Offences in sections 65 to 67B

Section	Offence	Maximum punishment (summary)
65	Tampering with computer source documents required to be kept by law	3 years, or fine up to 2 lakh rupees, or both
66	Dishonestly or fraudulently doing any act in section 43 (hacking, data theft, virus introduction)	3 years, or fine up to 5 lakh rupees, or both
66B	Dishonestly receiving stolen computer resources	3 years, or fine up to 1 lakh rupees, or both
66C	Identity theft: fraudulent use of electronic signatures, passwords or other unique identification features	3 years and fine up to 1 lakh rupees
66D	Cheating by personation using a computer resource	3 years and fine up to 1 lakh rupees
66E	Violation of privacy by capturing or publishing images of private areas without consent	3 years, or fine up to 2 lakh rupees, or both
66F	Cyber terrorism	Imprisonment which may extend to life
67, 67A, 67B	Publishing or transmitting obscene, sexually explicit or child sexual abuse material	Escalating terms; 67B is the most severe

Section 85 provides that where a company commits an offence, every person in charge of and responsible for the conduct of its business at the time is also deemed guilty, unless they prove the offence was committed without their knowledge or that they exercised all due diligence. That is why directors and delivery heads care about documented controls.

Intermediaries and section 79

An intermediary is not liable for third-party information, data or links it hosts if it does not initiate the transmission, select the receiver or modify the information, observes due diligence and the government's guidelines, and acts expeditiously to remove content on receiving actual knowledge through a court order or government notification. The due diligence requirements are set out in the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, including grievance officers and response timelines. SaaS platforms that host user content, marketplaces and community products should check whether they are intermediaries.

Government powers: sections 69, 69A, 69B, 70 and 70B

• Section 69: interception, monitoring or decryption of information on specified grounds, with a duty on intermediaries and computer resource operators to assist.
• Section 69A: blocking of public access to information, under procedures and safeguards in rules.
• Section 69B: monitoring and collection of traffic data for cyber security.
• Section 70: declaration of protected systems, and section 70A, the National Critical Information Infrastructure Protection Centre.
• Section 70B: CERT-In as the national agency for incident response. Under section 70B(6) CERT-In can call for information and give directions to service providers, intermediaries, data centres, body corporates and others, which it did in its Directions of 28 April 2022. Failure to comply is punishable under section 70B(7) with imprisonment up to one year, or a fine up to one lakh rupees, or both.

How to comply: a step-by-step plan for IT companies

1. Know which roles you have: body corporate handling sensitive personal data, intermediary, service provider or data centre.
2. Implement reasonable security practices: a documented information security programme with managerial, technical, operational and physical controls, ideally aligned to ISO/IEC 27001, with the annual audit the SPDI Rules expect.
3. Meet the SPDI Rules for sensitive personal data: privacy policy, consent for collection, purpose limitation, disclosure controls and a grievance officer, while preparing for the DPDP Act.
4. Comply with CERT-In Directions: six-hour incident reporting, 180-day log retention within Indian jurisdiction, time synchronisation with designated NTP servers, a point of contact, and the other duties in the Directions.
5. Control access and confidentiality: least-privilege access to client systems and data, NDAs and contract clauses, monitoring of privileged activity, and offboarding that removes access immediately. These directly reduce exposure under sections 43, 66 and 72A.
6. Protect source code and records you are required to keep, given section 65.
7. If you are an intermediary, implement the due diligence in the 2021 Rules: terms of use, grievance officer, response timelines and takedown procedures.
8. Prepare to assist lawful requests under sections 69, 69A and 69B through a documented, legally reviewed process.
9. Train staff on what counts as an offence, especially unauthorised access and disclosure of client data.

Documentation and policies required

• Information security policy and procedures, with audit reports (SPDI Rules, rule 8).
• Privacy policy for sensitive personal data, published on the website (SPDI Rules, rule 4).
• Records of consent for collecting sensitive personal data.
• Grievance officer details and grievance logs.
• Incident response procedure aligned with CERT-In timelines, and incident reports.
• Log retention configuration and records showing 180 days of logs kept within Indian jurisdiction.
• Client contracts and NDAs with confidentiality and data handling clauses.
• For intermediaries: terms of use, privacy policy, grievance mechanism and records of takedown requests and responses.

Audits and assessments

The Act itself does not create a certification. The SPDI Rules expect reasonable security practices to be audited at least once a year, or when there is a significant upgrade of process or computer resource, by an independent auditor approved by the central government. CERT-In empanels information security auditing organisations, which many companies use for these audits and for client-required assessments. Sector regulators such as the RBI, SEBI and IRDAI add their own audit requirements for regulated entities and their vendors.

Timeline and cost considerations

The Act is already in force, so its duties apply now. The time and cost of compliance depend mostly on the security programme you need anyway: policies, access control, logging, incident response and audits. Expect additional cost for log storage for 180 days within Indian jurisdiction, CERT-In empanelled audits, legal review of contracts and policies, and grievance handling for intermediaries. With the DPDP Act phasing in through 2027, plan security and privacy work so that it meets both laws rather than doing it twice.

Benefits and consequences of non-compliance

Following the Act's requirements protects the company and its management from civil and criminal liability, keeps intermediaries within their safe harbour, and supports the security assurances clients and regulators expect.

Consequences include compensation claims under sections 43 and 43A (decided by adjudicating officers or civil courts), criminal prosecution of the company and responsible officers for offences such as those in sections 66, 72A and 70B(7), loss of intermediary safe harbour leading to liability for user content, and blocking orders. Breaches involving personal data will additionally carry DPDP Act penalties once its substantive provisions are in force.

Common mistakes and challenges for IT companies

• Assuming client data is the client's problem. Section 72A applies to the service provider and its people.
• No documented security programme. Without one, it is hard to show reasonable security practices under section 43A.
• Logs not kept for 180 days, or kept outside India, contrary to the CERT-In Directions.
• Missing the six-hour reporting window because no one owns CERT-In reporting.
• Not recognising intermediary status for platforms hosting user content, and so missing due diligence obligations.
• Shared admin accounts that make it impossible to attribute actions, which matters for both security and legal evidence.
• Ignoring the DPDP transition and building a programme only for the SPDI Rules.

Best practices, tools and technologies

• Run an ISO/IEC 27001 aligned ISMS and have it audited annually.
• Use SSO, MFA and privileged access management for all systems, including client environments.
• Centralise logs with 180-day retention within Indian jurisdiction (and one year where the DPDP Rules apply), synchronised to CERT-In designated time sources.
• Use data loss prevention and endpoint controls to reduce the risk of data leaks by staff.
• Keep an incident response runbook with CERT-In, DPDP Board, client and regulator notifications in one place.
• For intermediary platforms, build reporting, takedown and grievance workflows into the product.

We build audit logging, access control and reporting workflows into web applications and marketplaces, and maintain them under our support plans.

How the IT Act relates to other laws and frameworks

Law or framework	Relationship
CERT-In Directions	Issued under section 70B(6); binding duties on incident reporting and logs.
SPDI Rules, 2011	Made under section 43A; define sensitive personal data and reasonable security practices.
IT Rules, 2021	Made under sections 79 and 87; due diligence for intermediaries and digital media.
DPDP Act, 2023	New personal data law; omits section 43A through section 44(2).
RBI, SEBI and IRDAI rules	Sector requirements that sit on top of the IT Act for regulated entities and their vendors.
ISO/IEC 27001	Named in the SPDI Rules as one way to show reasonable security practices.

Real-world implementation examples

Shreya Singhal v. Union of India (2015) remains the leading judgment on the Act: the Supreme Court struck down section 66A and clarified that intermediaries lose their section 79 protection only if they fail to act on a court order or government notification. Adjudicating officers and courts have heard many section 43 and 43A compensation claims, often involving bank account fraud and data leaks, and their orders show that documented security practices matter when a company's negligence is examined.

An illustrative case for an IT services company: a departing developer copies a client's customer database. The company faces a client claim, potential section 43 compensation, and the developer faces prosecution under sections 66 and 72A. The company's position is far stronger if it can show least-privilege access, monitoring, a signed NDA, immediate offboarding and a timely CERT-In report, which are exactly the practices the Act and its rules expect.

Next steps

1. Map your roles under the Act and its rules.
2. Check CERT-In readiness: point of contact, six-hour reporting, 180-day logs.
3. Document and audit your security practices.
4. Review client contracts and staff NDAs for confidentiality and data handling.
5. Plan the move from SPDI Rules to DPDP Act duties by May 2027.

Frequently asked questions

Is the IT Act 2000 still in force?

Yes. It remains India's main IT law, as amended in 2008 and by later changes. Section 43A will be omitted when section 44(2) of the DPDP Act takes effect.

What is section 43A of the IT Act?

It makes a body corporate that is negligent in implementing reasonable security practices for sensitive personal data, causing wrongful loss or gain, liable to pay compensation. The SPDI Rules made under it define the data and the practices.

What is the punishment under section 72A?

Disclosing personal information obtained under a lawful contract, without consent or in breach of the contract, with intent to cause or knowing it is likely to cause wrongful loss or gain, is punishable with up to three years' imprisonment, a fine up to five lakh rupees, or both.

What is the difference between section 43 and section 66?

Section 43 is civil: it makes a person who does the listed acts without permission liable to pay compensation. Section 66 makes the same acts a criminal offence when done dishonestly or fraudulently.

Does the IT Act apply to companies outside India?

Under section 75, it applies to offences and contraventions committed outside India if they involve a computer system or network located in India.

Who is an intermediary under the IT Act?

Any person who receives, stores or transmits electronic records on behalf of another, or provides a service about them, including internet and hosting providers, search engines, payment sites, marketplaces and social media platforms.

Was section 66A struck down?

Yes. The Supreme Court declared section 66A unconstitutional in Shreya Singhal v. Union of India in 2015.

Are directors liable for IT Act offences by a company?

Under section 85, every person in charge of and responsible for the company's business at the time is deemed guilty, unless they prove lack of knowledge or that they exercised all due diligence.

Are electronic contracts valid under the IT Act?

Yes. Section 10A recognises contracts formed electronically, except for documents excluded by the First Schedule, such as wills and contracts for the sale of immovable property.

Does the IT Act require ISO 27001?

No. The SPDI Rules name IS/ISO/IEC 27001 as one standard that satisfies reasonable security practices if audited, but other documented programmes approved under the rules are also acceptable.

What happens if we ignore CERT-In Directions?

Failure to provide information or comply with directions under section 70B(6) is punishable under section 70B(7) with imprisonment up to one year, a fine up to one lakh rupees, or both.

Will the IT Act be replaced?

The government has discussed a new law to replace it. At our last review none had been enacted, and the Act remains in force alongside the DPDP Act.