India's Information Technology Act, 2000 is the main law on electronic records, cyber offences and intermediary liability. It sets liability for damage to computer systems, penalties for offences such as identity theft, and the powers of CERT-In. This list covers the sections that matter most to security and data protection programmes.
Free account needed to download. You come straight back to the file.
Who it is for. Every body corporate and intermediary operating in India, and anyone who accesses computer resources there. Sensitive personal data practices under section 43A are the part most compliance programmes cite.
What this list covers. IT Act, 2000 as amended in 2008, selected sections: 16 sections. Each has a reference, a heading and a sentence in plain English.
| Ref | Control | What it covers |
|---|---|---|
| s. 43 | Damage to computer systems | Unauthorised access, copying, introducing malware, disruption or denial of access to a computer resource makes the person liable to pay compensation. |
| s. 43A | Failure to protect sensitive data | A body corporate that handles sensitive personal data and is negligent in keeping reasonable security practices is liable to pay compensation. The 2011 Rules set the practices. |
| s. 72A | Disclosure in breach of a lawful contract | Disclosing personal information obtained while providing services under a lawful contract, without consent and to cause loss, is punishable. |
| s. 79 | Intermediary liability | Intermediaries are protected from liability for third-party content if they meet conditions such as due diligence and prompt takedown on notice. |
| Ref | Control | What it covers |
|---|---|---|
| s. 65 | Tampering with source documents | Concealing, destroying or altering computer source code that must be kept by law is an offence. |
| s. 66 | Computer-related offences | Doing any act in s. 43 dishonestly or fraudulently is an offence, with imprisonment and fine. |
| s. 66B | Receiving stolen computer resources | Dishonestly receiving a stolen computer resource or communication device is an offence. |
| s. 66C | Identity theft | Fraudulent or dishonest use of someone's electronic signature, password or unique identification is an offence. |
| s. 66D | Cheating by personation | Cheating by impersonating another person using a computer resource is an offence. |
| s. 66E | Violation of privacy | Capturing, publishing or transmitting an image of a private area of a person without consent is an offence. |
| s. 66F | Cyber terrorism | Attacks on computer resources with intent to threaten the unity, integrity, security or sovereignty of India are punishable, up to life imprisonment. |
| s. 72 | Breach of confidentiality and privacy | A person with powers under the Act who discloses information obtained through those powers without consent is punishable. |
| Ref | Control | What it covers |
|---|---|---|
| s. 69 | Interception, monitoring and decryption | The Government may direct interception, monitoring or decryption of information in listed public-interest cases, and intermediaries must assist. |
| s. 70 | Protected systems | The Government may declare a computer resource a protected system, and unauthorised access to it is punishable. |
| s. 70A | National nodal agency for critical information infrastructure | The Government designates an agency for research and protection of critical information infrastructure. |
| s. 70B | CERT-In | The Indian Computer Emergency Response Team is the national agency for incident response, with power to call for information and issue directions. |
Bodies corporate that handle sensitive personal data must keep reasonable security practices, or pay compensation for wrongful loss. The 2011 Rules name ISO/IEC 27001 as one acceptable standard.
The Digital Personal Data Protection Act omits section 43A when that provision commences. The rest of the IT Act, including the offences and CERT-In, continues.
No. It selects the sections that matter most to security teams. Read the Act as amended, and the rules made under it, for the full text.
Section 2 defines it broadly, to include internet providers, hosting and cloud providers, search engines, marketplaces and social platforms that handle third-party content or data.