Laws and Regulations related to Cyber Security and Data Privacy: formula sheet

Key formulas

Computer resource

Computer resource = computer + computer system + computer network + data + computer data base + software

Section 2(1)(k). Any one of these items is a computer resource. It is wider than 'computer'.

Computer network

Computer network = inter-connection of one or more computers, computer systems or communication devices

Section 2(1)(j). Connection by satellite, microwave, terrestrial line, wire, wireless or other media. It does not matter whether the inter-connection is continuous.

Data

Data = representation of information, knowledge, facts, concepts or instructions, in formalised manner, meant to be or being or already processed in a computer system or network

Section 2(1)(o). It may be in any form, including printouts, storage media or internal memory.

Electronic record

Electronic record = data, record or generated data, image or sound stored, received or sent in electronic form or micro film or computer generated micro fiche

Section 2(1)(t). Electronic form is defined separately in section 2(1)(r).

Intermediary

Intermediary = any person who, on behalf of another, receives, stores or transmits a particular electronic record or provides any service with respect to it

Section 2(1)(w). It is record-specific. Includes ISPs, search engines, online marketplaces, payment sites and cyber cafes.

Originator and addressee

Originator and addressee both exclude an intermediary

Section 2(1)(za) and (b). The originator sends or generates the message; the addressee is intended to receive it.

Cyber security

Cyber security = protecting information, equipment, devices, computer, computer resource, communication device and stored information from unauthorised access, use, disclosure, disruption, modification or destruction

Section 2(1)(nb). Inserted by Act 7 of 2017.

Section 4: electronic records

Electronic form + accessible for subsequent reference = writing/typed/printed requirement satisfied

Both conditions are needed. Applies where a law requires writing, typewritten or printed form.

Section 5: electronic signatures

Electronic signature affixed in the manner prescribed by the Central Government = signature requirement satisfied

"Signed" means a handwritten signature or any mark on a document.

Section 3: digital signature

Authentication = asymmetric crypto system + hash function; verification by the subscriber's public key

Private and public keys are unique to the subscriber and form a functioning key pair.

Section 35: application for certificate

Application in prescribed form + fee not exceeding ₹25,000 + certification practice statement (or other statement)

The CA may grant, or reject for reasons recorded in writing. No rejection without a reasonable opportunity to show cause. Fees may differ for different classes of applicants.

Section 36: CA's representations

CA certifies compliance, publication and acceptance, key holding, functioning key pair, accurate information, no adverse material fact

Covers clauses (a) to (f), including that the subscriber holds a private key capable of creating a digital signature.

Section 37: suspension

Suspension on request of subscriber or authorised person, or in public interest; not beyond 15 days without a hearing

The CA must communicate the suspension to the subscriber.

Section 38: revocation

Revocation on request, death, dissolution/winding up, or on grounds in sub-section (2); hearing required

Revocation needs an opportunity of being heard. The CA must communicate it to the subscriber.

Section 41: acceptance

Publishing or authorising publication, or showing approval = deemed acceptance

The subscriber then certifies that the key is held, and that representations and information within their knowledge are true.

Section 73: false certificate

Imprisonment up to 2 years, or fine up to ₹1,00,000, or both

Applies to publishing a certificate knowing it was not issued by the CA, not accepted by the subscriber, or is revoked or suspended. Exception: publication to verify a signature created before suspension or revocation.

Section 43 (civil liability)

Act without permission of owner or person in charge → liable to pay damages by way of compensation

Acts include access, copying or extracting data, virus, damage, disruption, denial of access, assisting unauthorised access, tampering to charge another's account, deleting or altering information, tampering with source code with intent to cause damage.

Section 66 (criminal liability)

Section 43 act + dishonestly or fraudulently → imprisonment up to 3 years or fine up to ₹5,00,000 or both

'Dishonestly' and 'fraudulently' take their meaning from sections 24 and 25 of the Indian Penal Code, as the Explanation to section 66 states.

Section 66C (identity theft)

Fraudulent or dishonest use of another's electronic signature, password or unique identification feature → imprisonment up to 3 years and fine up to ₹1,00,000

Imprisonment and fine both apply (the section says 'shall also be liable to fine').

Section 66D (cheating by personation)

Cheating by personation using a communication device or computer resource → imprisonment up to 3 years and fine up to ₹1,00,000

Look for pretending to be someone else, such as a fake bank or official.

Section 66F (cyber terrorism)

Commits or conspires to commit cyber terrorism → imprisonment which may extend to life

Needs intent to threaten the unity, integrity, security or sovereignty of India or to strike terror, or unauthorised access to restricted information as described in the section.

Section 43A (failure to protect data)

Body corporate handling sensitive personal data + negligent security practices + wrongful loss or gain → compensation

Civil remedy. 'Body corporate' includes a company, firm, sole proprietorship or other association engaged in commercial or professional activities.

Section 77

IT Act compensation or penalty does not bar punishment or compensation under any other law

Same act can attract IT Act liability and other laws.

Limb (A) of Section 66F

Intent (threaten unity, integrity, security or sovereignty of India, or strike terror) + Means (denial of access / unauthorised access / computer contaminant) + Consequence (death, injury, damage, disruption of essential supplies or services, or harm to critical information infrastructure)

All three elements must be present. The consequence may be actual or likely.

Limb (B) of Section 66F

Knowing or intentional unauthorised access (or exceeding authorised access) + obtaining restricted information, data or database

Restricted for security of the State or foreign relations, or other restricted information with reason to believe it may be used to the harm listed in the section.

Punishment, Section 66F(2)

Commits or conspires to commit cyber terrorism: imprisonment which may extend to imprisonment for life

Maximum is life imprisonment. The text does not mention fine.

Critical information infrastructure

Adverse effect on critical information infrastructure specified under section 70

This is one of the consequences under limb (A).

Who may authorise (s 69B(1))

Central Government + notification in Official Gazette → authorises any agency of the Government

A State Government is not named in 69B. Authorisation is by Gazette notification, not by an individual order.

Purpose (s 69B(1))

Cyber security: identification, analysis and prevention of intrusion or spread of computer contaminant

Computer contaminant is defined in section 43. The purpose is cyber security, not general crime investigation.

Duty of intermediary (s 69B(2))

On being called upon by the authorised agency: give technical assistance + extend all facilities

Covers any intermediary or person in charge of the computer resource.

Procedure and safeguards (s 69B(3))

Procedure and safeguards = as may be prescribed

Prescribed by rules under section 87(2)(za).

Penalty (s 69B(4))

Intentional or knowing contravention of sub-section (2) by an intermediary → imprisonment up to 1 year, or fine up to ₹1 crore, or both

Substituted by Act 18 of 2023 w.e.f. 30-11-2023. Earlier it was three years and also fine.

Traffic data (Explanation (ii))

Data identifying or purporting to identify any person, computer system, network or location to or from which communication is or may be transmitted, including origin, destination, route, time, date, size, duration or type of underlying service, and any other information

It covers the details about the communication.

Safe harbour (Section 79(1))

Intermediary not liable for third party information, data or communication link made available or hosted by it

Operates notwithstanding any other law, but only subject to sub-sections (2) and (3).

Conditions for safe harbour (Section 79(2))

(a) Limited function (access, transmission, temporary storage or hosting) OR (b) no initiating, no selecting receiver, no selecting or modifying information; plus (c) due diligence and prescribed guidelines

Section 79(2) lists (a), (b) and (c). Items (a) and (b) are joined by 'or'; (c) is a separate due diligence condition. Always mention due diligence in answers.

Loss of safe harbour (Section 79(3))

Conspiracy, abetment, aid or inducement; OR failure to expeditiously remove or disable access after actual knowledge or Government notification

Removal must be done without vitiating the evidence.

Adjudicating officer (Section 46)

Rank not below Director to Government of India (or equivalent State officer); claims for damage up to ₹5 crore under Section 46(1A)

Claims above ₹5 crore go to the competent court (Section 46(1A)). The officer has civil court powers under Section 46(5), being the powers conferred on the Appellate Tribunal by Section 58(2).

Appeal to Appellate Tribunal (Section 57)

Within 45 days of receiving the copy of the order; disposal endeavoured within 6 months

Delay can be condoned for sufficient cause. No appeal lies against an order made with the consent of the parties.

Appeal to High Court (Section 62)

Within 60 days of communication of Tribunal order; further period up to 60 days for sufficient cause

On any question of fact or law arising out of the order.

Section 43A liability test (IT Act)

Body corporate + sensitive personal data or information in a computer resource it owns, controls or operates + negligence in reasonable security practices + wrongful loss or wrongful gain to a person ⇒ damages by way of compensation

All elements must be present. Without negligence or without wrongful loss or gain, section 43A is not attracted.

Body corporate (section 43A Explanation)

Any company, including a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities

The meaning is wider than a company under the Companies Act.

Reasonable security practices (section 43A Explanation)

Practices to protect against unauthorised access, damage, use, modification, disclosure or impairment, as set by (1) agreement, or (2) any law in force, or (3) if neither, the Central Government's prescription

Agreement or law comes first. The Central Government prescribes only in their absence.

Sensitive personal data or information

Such personal information as may be prescribed by the Central Government in consultation with professional bodies or associations

The Act does not list the items. The list was left to rules.

Present status of section 43A

DPDP Act, 2023, section 44(2)(a): section 43A shall be omitted; section 44(2)(c): section 87(2) clause (ob) omitted

Section 44(2)(c) removes the rule-making power linked to section 43A.

CERT-In directions (section 70B(6) and (7))

Failure to give information called for or comply with a direction ⇒ imprisonment up to 1 year or fine up to ₹1 crore or both

The fine limit was raised from one lakh by Act 18 of 2023, w.e.f. 30-11-2023.

Protected system (section 70)

Unauthorised access or attempt to a protected system ⇒ imprisonment up to 10 years and fine

The appropriate Government declares the system by notification.

Quick revision

• Section 2(1) defines computer resource as computer, computer system, computer network, data, computer data base or software.
• An intermediary receives, stores or transmits an electronic record on behalf of another person, or provides a service for that record. It includes telecom, network, internet and web-hosting providers, search engines, online payment sites, online-auction sites, online marketplaces and cyber cafes.
• An originator sends, generates, stores or transmits an electronic message, and does not include an intermediary.
• Cyber security means protecting information, equipment, devices, computer, computer resource and communication device from unauthorised access, use, disclosure, disruption, modification or destruction.
• Section 66F limb (A) needs intent to threaten India's unity, integrity, security or sovereignty, or to strike terror, plus a listed means and a harmful result.
• The three means in Section 66F(1)(A) are denial of access, unauthorised access or exceeding authorised access, and introducing a computer contaminant.
• Section 66F limb (B) covers knowing or intentional unauthorised access to information restricted for State security or foreign relations reasons, or other restricted information, with reason to believe it may cause injury.
• Punishment for committing or conspiring to commit cyber terrorism may extend to imprisonment for life.
• Under Section 69B, the Central Government authorises a Government agency by notification to monitor and collect traffic data for cyber security.
• Traffic data identifies or purports to identify a person, system, network or location, and includes origin, destination, route, time, date, size, duration and type of service.
• An intermediary who intentionally or knowingly fails to give technical assistance under Section 69B(2) faces imprisonment up to one year, or a fine up to one crore rupees, or both.
• Adjudicating officers are appointed under Section 46(1), and the Indian Computer Emergency Response Team is established under Section 70B(1).

Common mistakes

• Treating 'computer' and 'computer resource' as the same thing. Fix: Remember that computer resource also covers computer system, network, data, data base and software. Software or data alone is a computer resource.
• Saying a person is an intermediary in general, without reference to a record. Fix: The definition says 'with respect to any particular electronic records'. The same person can be an intermediary for one record and an originator for another.
• Treating digital signature and electronic signature as identical. Fix: Remember the 2009 amendment made Section 5 technology-neutral (electronic signature), while Section 3 describes the digital signature using asymmetric crypto and hash function.
• Stating Section 4 with only the electronic form condition. Fix: Always add the second condition: accessible so as to be usable for a subsequent reference.
• Saying section 43 gives imprisonment. Fix: Section 43 is only compensation. Imprisonment and fine come under section 66 and later sections.
• Applying section 66 without dishonest or fraudulent intent. Fix: Always write the intent as the extra condition. No intent shown means section 43 only.
• Treating every hacking or virus case as cyber terrorism. Fix: Under limb (A), check for intent to threaten India's unity, integrity, security or sovereignty, or to strike terror. A financial motive alone does not satisfy it.
• Saying the maximum punishment is a fixed term such as seven years. Fix: Section 66F(2) provides imprisonment which may extend to imprisonment for life.
• Saying section 69B allows interception or decryption of message content. Fix: Link 69B to traffic data and cyber security. Link 69 to interception, monitoring or decryption of information.
• Stating the old penalty of three years' imprisonment and fine. Fix: Use the current text: imprisonment up to one year, or fine up to ₹1 crore, or both (Act 18 of 2023, w.e.f. 30-11-2023).

Exam tips

• Learn the section 2(1) definitions almost word for word. MCQs often change one phrase, such as 'continuously maintained' or 'excluding intermediary'.
• In case-based questions, name the party first (originator, addressee or intermediary) and then give the rule it triggers.
• For long answers, structure the reply as definition, elements, application, conclusion. This earns marks for application, not recall.
• Link the IT Act to the DPDP Act, 2023. Section 37(3) of the DPDP Act adopts the IT Act's meanings of computer resource, information and intermediary.
• Quote a section number only when you are certain. Plain-word rules are safer than a wrong number.
• Learn the section-to-topic map: 3 authentication, 4 records, 5 signatures, 35 issue, 36 CA representations, 37 suspension, 38 revocation, 41 acceptance, 73 penalty.
• Numbers are favourite MCQ options: 15 days, ₹25,000 fee cap, 2 years, ₹1,00,000. Memorise their sections.
• In a case scenario, look for who is acting: subscriber, CA or Controller. Many wrong options swap them.