Law relating to Information Technology: formula sheet

Key formulas

Computer resource

Computer resource = computer + computer system + computer network + data + computer database + software

Section 2(1)(k). It is a list, so any one item qualifies as a computer resource.

Intermediary

Intermediary = any person who, on behalf of another, receives, stores or transmits a record or provides any service with respect to it

Section 2(1)(w). It includes telecom, network, internet and web-hosting providers, search engines, online payment sites, auction sites, marketplaces and cyber cafes.

Electronic record

Electronic record = data, record or generated data, image or sound stored, received or sent in an electronic form or micro film or computer generated micro fiche

Section 2(1)(t). Electronic form covers magnetic, optical, computer memory and similar media.

Subscriber

Subscriber = person in whose name the electronic signature certificate is issued

Section 2(1)(zg). Being the signer is not enough; the certificate must be in your name.

Originator and addressee

Originator and addressee both exclude an intermediary

Section 2(1)(za) and (b). A courier-like service handling a message is not the originator or addressee.

Electronic signature

Electronic signature = authentication of an electronic record by a subscriber using the technique specified in the Second Schedule, and includes digital signature

Section 2(1)(ta). Digital signature is a narrower part of electronic signature.

Authentication of electronic records (Section 3)

Subscriber + digital signature → authenticated electronic record

Done through an asymmetric crypto system and a hash function. Anyone can verify it with the subscriber's public key.

Hash function (Section 3(2) Explanation)

Same record → same hash result, every time

It must be infeasible to derive the record from the hash result, and infeasible for two records to give the same hash result.

Key pair (Section 3(4))

Private key + public key = functioning key pair, unique to the subscriber

The private key signs. The public key verifies.

Application for certificate (Section 35)

Application in prescribed form + fee not exceeding ₹25,000 + certification practice statement

Different fees may be prescribed for different classes of applicants. Rejection needs written reasons and a reasonable opportunity to show cause.

Duties of a CA (Section 30)

Secure systems; reliable services; secrecy and privacy of signatures; repository of certificates; publish practices and certificate status; other standards by regulations

Clauses (a) to (c), (ca), (cb) and (d).

Representations by CA (Section 36)

CA certifies clauses (a) to (f)

Includes compliance with the Act, publication, subscriber holds the private key, a functioning key pair, accurate information, and no knowledge of a material adverse fact.

Suspension (Section 37)

Suspension on request or in public interest; not beyond 15 days without a hearing

The CA must communicate the suspension to the subscriber.

Revocation (Section 38)

Revoke on request, death, dissolution or winding up; or on grounds in 38(2); only after hearing

The CA must communicate the revocation to the subscriber.

Penalty (Section 73)

Imprisonment up to 2 years, or fine up to ₹1 lakh, or both

For publishing a certificate knowing it was not issued by the CA, not accepted by the subscriber, or is revoked or suspended.

Section 4 - Electronic records

Writing/typed/printed requirement is met if information is (a) in electronic form AND (b) accessible for subsequent reference

Both conditions must be met. It applies notwithstanding anything in the other law.

Section 5 - Electronic signatures

Signature requirement is met if authenticated by electronic signature affixed in the manner prescribed by the Central Government

The Explanation says 'signed' means a handwritten signature or any mark.

Section 6(1) - Government use

Filing, issue/grant of licence, permit, sanction or approval, and receipt/payment of money are valid if done in the electronic form prescribed by the appropriate Government

Section 6(2) lets the appropriate Government prescribe manner, format and fee payment method by rules.

Section 7(1) - Retention conditions

(a) accessible for later reference; (b) original format or accurately representing format; (c) origin, destination, date and time details available

The proviso excludes information generated solely to enable despatch or receipt of the record. Section 7(2) excludes laws that expressly provide for retention in electronic form.

Section 9 - No right to insist

Sections 6, 7 and 8 do not give a person the right to insist that government accept, issue, create, retain or preserve documents electronically or take electronic payments

Applies to Central or State Government ministries, departments and bodies established by law or controlled or funded by government.

Section 67C - Intermediaries

Intermediary must preserve and retain specified information for the duration, manner and format prescribed by the Central Government; intentional or knowing contravention attracts penalty up to ₹25,00,000

Penalty wording as amended by Act 18 of 2023, effective 30-11-2023.

Section 84A - Encryption

Central Government may prescribe modes or methods for encryption

Purpose: secure use of the electronic medium and promotion of e-governance and e-commerce.

Appointment of Controller (Section 17)

Central Government + notification in Official Gazette → Controller, Deputy Controllers, Assistant Controllers, other officers

The Controller acts subject to the general control and directions of the Central Government. Qualifications and service terms are as prescribed by the Central Government.

Licence to issue certificates (Section 21)

Application to Controller + prescribed requirements met → licence

Requirements cover qualification, expertise, manpower, financial resources and infrastructure. The licence is not transferable or heritable and is valid for a prescribed period.

Revocation of licence (Section 25(1))

Inquiry + one of four grounds + reasonable opportunity of showing cause → revoke

Grounds: false or incorrect material statement in the application for issue or renewal; failure to comply with licence terms; failure to maintain the procedures and standards of Section 30; contravention of the Act, rules, regulations or orders.

Suspension of licence (Section 25(2) and (3))

Reasonable cause to believe a ground for revocation exists → suspend pending enquiry; no show-cause needed up to 10 days

A suspension beyond ten days needs a reasonable opportunity of showing cause. During suspension the CA cannot issue any certificate.

Duties of a CA (Section 30)

Secure hardware, software and procedures + reasonable reliability + security of secrecy and privacy of signatures + repository of certificates + publish practices and certificate status + other standards in regulations

Use this as a checklist when a question asks what a CA must do.

Issue of certificate (Section 35)

Application in prescribed form + fee not exceeding ₹25,000 + certification practice statement → grant, or reject with written reasons after show-cause

Different fees may be prescribed for different classes of applicants. Rejection needs reasons recorded in writing and a reasonable opportunity to show cause.

Recognition of foreign CA (Section 19)

Controller + previous approval of Central Government + Gazette notification → recognition

A certificate issued by a recognised foreign CA is valid for the purposes of the Act. The Controller may revoke recognition for breach of conditions, giving reasons in writing, by notification.

Section 43 - compensation

Act listed in s.43 + without permission of owner/person in charge = damages by way of compensation

Civil liability. No dishonest or fraudulent intent needed.

Section 66 - computer related offence

Section 43 act + dishonestly or fraudulently = imprisonment up to 3 years or fine up to ₹5 lakh or both

"Dishonestly" and "fraudulently" take the meaning given in the Explanation to the section.

Section 43A - failure to protect data

Body corporate + sensitive personal data in its computer resource + negligent security + wrongful loss or gain = compensation

Negligence is enough. Applies to bodies corporate only.

Section 66C - identity theft

Fraudulent or dishonest use of another's electronic signature, password or unique identification feature = imprisonment up to 3 years and fine up to ₹1 lakh

Imprisonment and fine both: the text says "shall also be liable to fine".

Section 66F - cyber terrorism

Intent to threaten unity, integrity, security or sovereignty of India or strike terror + listed means + specified consequences = imprisonment up to life

Also covers unauthorised access to restricted information (clause B). Conspiracy is punished equally.

Section 72A - disclosure in breach of lawful contract

Access under lawful contract + personal information + intent or knowledge of wrongful loss or gain + disclosure without consent or in breach of contract = penalty up to ₹25 lakh

Applies to any person, including an intermediary. Penalty since the 2023 amendment (earlier "punishment").

Sections 77 and 84B

s.77: no bar to other law's punishment. s.84B: abettor gets punishment of the offence if committed in consequence of abetment

Section 84B applies only where the Act makes no express provision for abetment.

Safe harbour (section 79(1))

Intermediary not liable for third party information, data or communication link hosted by it, subject to s. 79(2) and (3)

This is a conditional protection, not an absolute one.

Conditions for safe harbour (section 79(2))

(a) function limited to providing access to a communication system; OR (b) does not initiate transmission, select receiver, or select or modify information; AND (c) observes due diligence and Central Government guidelines

The text joins (a) and (b) with 'or' and then lists (c). Always mention due diligence in (c).

Loss of safe harbour (section 79(3))

(a) conspired, abetted, aided or induced the unlawful act; (b) on actual knowledge or notification by the appropriate Government or its agency, fails to expeditiously remove or disable access without vitiating evidence

Removal must not destroy evidence.

Blocking (section 69A)

Central Government or specially authorised officer + satisfied it is necessary or expedient + stated grounds + reasons recorded in writing + order to Government agency or intermediary

Grounds: sovereignty and integrity of India, defence of India, security of the State, friendly relations with foreign States, public order, or preventing incitement to a cognizable offence relating to these.

Penalty for non-compliance with blocking (section 69A(3))

Imprisonment up to 7 years + liable to fine

Applies to an intermediary that fails to comply with the direction.

Interception, monitoring, decryption (section 69)

Central or State Government (or authorised officer) + necessary or expedient + stated grounds + reasons in writing + direction to agency of the appropriate Government

Grounds are those of s. 69A plus investigation of any offence. Failure to assist: imprisonment up to 7 years and fine (s. 69(4)).

Traffic data monitoring (section 69B)

Central Government notifies an agency in the Official Gazette to monitor and collect traffic data for cyber security

Intermediary contravening intentionally or knowingly: imprisonment up to 1 year or fine up to ₹1 crore, or both (s. 69B(4)).

Preservation of information (section 67C)

Intermediary preserves and retains specified information for the duration, manner and format prescribed by the Central Government

Intentional or knowing contravention: penalty up to ₹25 lakh (s. 67C(2)).

Adjudicating officer (Section 46)

Appointed by Central Government; rank not below Director to Govt of India (or equivalent State officer)

Must have prescribed IT experience and legal or judicial experience. Several officers may be appointed; the Central Government specifies their matters and places.

Pecuniary limit (Section 46(1A))

Claim for damage ≤ ₹5 crore → adjudicating officer; > ₹5 crore → competent court

A claim of exactly ₹5 crore is within the officer's power.

Appeal to Tribunal (Section 57)

Within 45 days from receipt of copy of order

Delay may be condoned for sufficient cause. No appeal lies against an order made with the consent of the parties.

Disposal target (Section 57(6))

Endeavour to dispose of appeal within 6 months from receipt

It is an endeavour, not a strict bar.

Appeal to High Court (Section 62)

Within 60 days from communication of Tribunal order; extendable by up to a further 60 days for sufficient cause

Lies on any question of fact or law arising out of the order.

Bar on civil courts (Section 61)

No civil court jurisdiction over matters the adjudicating officer or Tribunal can decide; no injunction

Section 60 applies the Limitation Act, 1963 to appeals to the Tribunal, as far as may be.

Compounding (Section 63)

Sum compounded ≤ maximum penalty; not available for same or similar contravention within 3 years of earlier compounding

Done by the Controller, an authorised officer or the adjudicating officer, before or after adjudication starts. Compounding bars further proceedings for that contravention.

Quick revision

• The Act's definitions are in section 2; always quote the clause when defining a term.
• Electronic record means data, record or data generated, image or sound stored, received or sent in an electronic form or micro film or computer generated micro fiche.
• Electronic signature means authentication of an electronic record by a subscriber by the technique in the Second Schedule, and it includes digital signature.
• A key pair has a private key to create a digital signature and a public key to verify it.
• A subscriber is the person in whose name the electronic signature certificate is issued.
• A Certifying Authority is a person licensed to issue electronic signature certificates under section 24.
• The Controller is appointed under section 17(1) and supervises Certifying Authorities; section 18 lists the functions.
• Originator and addressee both exclude an intermediary.
• An intermediary receives, stores or transmits a record for another person, or provides a service for it; the list includes internet service providers, search engines and cyber cafes.
• Section 77: penalties or compensation under the Act do not prevent punishment under any other law.
• The Appellate Tribunal follows natural justice, not the Code of Civil Procedure, and can summon witnesses, call for documents and review its decisions (section 58).
• Use current law only: write Bharatiya Nyaya Sanhita and not IPC when naming criminal law, unless you are contrasting them.

Common mistakes

• Treating a social media or e-commerce platform as the originator of every post on it. Fix: Ask whose record it is. A platform that stores or transmits a user's content on the user's behalf is an intermediary for that record, and the user is the originator.
• Saying computer resource means only a computer. Fix: Remember it covers computer, computer system, computer network, data, computer database and software.
• Saying the Controller issues Digital Signature Certificates. Fix: The CA issues certificates (Section 35). The Controller supervises CAs, certifies their public keys and lays down standards (Section 18).
• Saying the private key is used to verify a signature. Fix: The private key creates the signature. Any person verifies with the subscriber's public key (Section 3(3)).
• Saying electronic records are valid everywhere with no conditions. Fix: Always add the conditions: accessibility for later reference under section 4, and the three conditions of section 7(1).
• Claiming section 9 lets government refuse electronic records entirely, or that a citizen can force government to accept them. Fix: Say sections 6, 7 and 8 confer no right to insist. Government is not barred from accepting electronic records; the person simply cannot demand it.
• Saying the Controller is appointed by the President or by Parliament. Fix: Remember Section 17: the Central Government appoints the Controller by notification in the Official Gazette.
• Saying a licence can be suspended for any period without a hearing. Fix: Under Section 25(2), suspension pending enquiry beyond ten days needs a reasonable opportunity of showing cause. Revocation always needs it.
• Saying section 43 prescribes imprisonment. Fix: Remember: 43 is compensation (civil). 66 adds dishonest or fraudulent intent and brings imprisonment or fine.
• Applying section 43A to any person who leaks data. Fix: Section 43A applies only to a body corporate handling sensitive personal data, and the trigger is negligent security practices causing wrongful loss or gain.

Exam tips

• Reproduce definitions in the statutory words, then add a one-line explanation. Examiners reward precision.
• In fact-based questions, always name the section clause, such as Section 2(1)(w), and state the conclusion clearly.
• Learn the exclusions in originator and addressee, as they are a favourite short-note point.
• Remember that Sections 69 and 69B use these terms: for example, an intermediary can be called on to give technical assistance. Link definitions to those powers where the question allows.
• Keep the objectives of the Act in a few plain sentences: legal recognition of electronic records and signatures, e-governance, and curbing cyber crime.
• Learn the verbs in each section. Issue (35), suspend (37) and revoke (38) have different conditions, and examiners test the differences.
• Write the numbers exactly: fee up to ₹25,000, 15 days, imprisonment up to 2 years, fine up to ₹1 lakh.
• For a 'role of Certifying Authority' question, group the duties: Section 30 duties, Section 36 representations, and Sections 35, 37 and 38 powers.