Skip to content

Corporate and Economic Laws · Laws and Regulations related to Cyber Security and Data Privacy

Cyber Crimes and Penalties under the IT Act, 2000

Updated 11 October 2026 · Fact-checked

The IT Act, 2000 deals with cyber wrongs in two layers. Section 43 gives civil compensation for unauthorised acts on a computer. Section 66 makes the same acts a crime if done dishonestly or fraudulently (up to 3 years, or fine up to ₹5 lakh, or both). Sections 66C and 66D punish identity theft and personation. To solve questions, match facts to the section.

Understand Cyber Crimes and Penalties under the IT Act

Start with the idea of permission. Section 43 lists acts done without the permission of the owner or person in charge of a computer, computer system or computer network. These include accessing it, copying data, introducing a virus, damaging it, disrupting it, denying access, and tampering to charge services to another person's account. The person who does these acts is liable to pay damages by way of compensation to the person affected.

Section 43 is a civil remedy. There is no need to prove bad intent. Unauthorised access plus the act is enough. The remedy is compensation, not jail.

Section 66 turns the same acts into a criminal offence. The extra ingredient is mental state: the person must act dishonestly or fraudulently. The punishment is imprisonment up to three years, or fine up to five lakh rupees, or both. So the quick rule is: section 43 act + dishonest or fraudulent intent = section 66.

Some acts have their own sections. Section 66C punishes fraudulent or dishonest use of another person's electronic signature, password or other unique identification feature (identity theft). Section 66D punishes cheating by personation using a communication device or computer resource. Both carry imprisonment up to three years and fine up to one lakh rupees. Section 66F (cyber terrorism) is the most serious: it can lead to imprisonment for life.

Privacy and data are covered by section 43A. A body corporate that handles sensitive personal data in a computer resource it owns, controls or operates must keep reasonable security practices. If it is negligent and this causes wrongful loss or wrongful gain to anyone, it must pay compensation. Section 77 adds that compensation or penalty under the IT Act does not stop punishment or compensation under any other law.

Key rules to remember

Section 43 (civil liability)
Act without permission of owner or person in charge → liable to pay damages by way of compensation
Acts include access, copying or extracting data, virus, damage, disruption, denial of access, assisting unauthorised access, tampering to charge another's account, deleting or altering information, tampering with source code with intent to cause damage.
Section 66 (criminal liability)
Section 43 act + dishonestly or fraudulently → imprisonment up to 3 years or fine up to ₹5,00,000 or both
'Dishonestly' and 'fraudulently' take their meaning from sections 24 and 25 of the Indian Penal Code, as the Explanation to section 66 states.
Section 66C (identity theft)
Fraudulent or dishonest use of another's electronic signature, password or unique identification feature → imprisonment up to 3 years and fine up to ₹1,00,000
Imprisonment and fine both apply (the section says 'shall also be liable to fine').
Section 66D (cheating by personation)
Cheating by personation using a communication device or computer resource → imprisonment up to 3 years and fine up to ₹1,00,000
Look for pretending to be someone else, such as a fake bank or official.
Section 66F (cyber terrorism)
Commits or conspires to commit cyber terrorism → imprisonment which may extend to life
Needs intent to threaten the unity, integrity, security or sovereignty of India or to strike terror, or unauthorised access to restricted information as described in the section.
Section 43A (failure to protect data)
Body corporate handling sensitive personal data + negligent security practices + wrongful loss or gain → compensation
Civil remedy. 'Body corporate' includes a company, firm, sole proprietorship or other association engaged in commercial or professional activities.
Section 77
IT Act compensation or penalty does not bar punishment or compensation under any other law
Same act can attract IT Act liability and other laws.

How to solve Cyber Crimes and Penalties under the IT Act questions

Use this method for any case-based question on cyber offences under the IT Act.

  1. 1Identify the act done: access, copying, virus, damage, impersonation, password misuse, data leak and so on.
  2. 2Check permission: was the owner or person in charge consulted? No permission points to section 43.
  3. 3Check intent: if the person acted dishonestly or fraudulently, add section 66. If no such intent is shown, stay with section 43 compensation.
  4. 4Look for a specific section: password or signature misuse is 66C, personation is 66D, terror intent is 66F.
  5. 5If a company lost or leaked sensitive personal data through weak security, apply section 43A.
  6. 6State the consequence: compensation for civil sections; imprisonment and fine limits for criminal sections, quoted accurately.
  7. 7Mention section 77 if the question hints at other laws applying too.
  8. 8Conclude with a clear one-line answer naming the section and remedy.

Quickest way: Three-question filter

When to use it: Use it for MCQs and short case scenarios when time is tight.

  1. Q1: Was it without permission? If yes, think section 43.
  2. Q2: Was it dishonest or fraudulent? If yes, think section 66 (or a specific section).
  3. Q3: Is there a special label? Password misuse = 66C; personation = 66D; terror intent = 66F; company's weak security = 43A.
  4. Recall the numbers: 66 = 3 years or ₹5 lakh or both; 66C and 66D = 3 years and ₹1 lakh; 66F = life.

Common mistakes in Cyber Crimes and Penalties under the IT Act

  • Saying section 43 gives imprisonment.

    Students mix sections 43 and 66 because both list the same acts.

    Fix: Section 43 is only compensation. Imprisonment and fine come under section 66 and later sections.

  • Applying section 66 without dishonest or fraudulent intent.

    Students focus on the act and forget the mental element.

    Fix: Always write the intent as the extra condition. No intent shown means section 43 only.

  • Writing 'imprisonment or fine' for section 66C and 66D.

    Section 66 uses 'or', so students copy the pattern.

    Fix: For 66C and 66D, imprisonment up to three years and also fine up to ₹1 lakh. Section 66 allows imprisonment or fine or both, with fine up to ₹5 lakh.

  • Treating section 43A as applicable to every person holding data.

    The word 'data' suggests a general rule.

    Fix: Section 43A applies to a body corporate handling sensitive personal data in a computer resource it owns, controls or operates, and needs negligence plus wrongful loss or gain.

  • Thinking compensation under the IT Act ends other legal action.

    Students assume one remedy excludes others.

    Fix: Section 77 says IT Act compensation or penalty does not prevent other punishment or compensation under any other law.

Worked examples

Example 1

Ravi, a former employee of Kaveri Traders Pvt Ltd, uses his old login to enter the company's server without permission and copies the customer database to sell to a rival. Which sections apply, and what are the consequences?

Show the solution
  1. Act: access and copying of data from a computer system without permission of the person in charge. This matches section 43(a) and 43(b).
  2. Intent: he copied the data to sell it to a rival, which shows dishonest or fraudulent intent. So section 66 applies.
  3. Civil consequence: under section 43, Ravi is liable to pay damages by way of compensation to Kaveri Traders.
  4. Criminal consequence: under section 66, imprisonment up to three years, or fine up to ₹5 lakh, or both.
  5. Section 77: these do not bar action under any other law.

Answer: Section 43 (compensation) and section 66 (imprisonment up to 3 years or fine up to ₹5 lakh or both) apply to Ravi, and other laws may also apply under section 77.

Example 2

Meena uses the UPI PIN and password of her colleague Anil, without his knowledge, to transfer money. In a separate incident, Sunil sends emails posing as an officer of a bank to get customers' details. Identify the sections and the maximum punishment in each case.

Show the solution
  1. Meena fraudulently or dishonestly uses another person's password or unique identification feature. This is identity theft under section 66C.
  2. Punishment under 66C: imprisonment of either description up to three years and also fine up to ₹1,00,000.
  3. Sunil cheats by personation using a computer resource (email). This is section 66D.
  4. Punishment under 66D: imprisonment of either description up to three years and also fine up to ₹1,00,000.

Answer: Meena: section 66C. Sunil: section 66D. In both, imprisonment up to 3 years and fine up to ₹1 lakh.

Exam tips

  • Learn the table of punishments: 66 (3 years or ₹5 lakh or both), 66C and 66D (3 years and ₹1 lakh), 66F (life).
  • In MCQs, 'compensation' points to sections 43 or 43A, while 'imprisonment' points to section 66 onwards.
  • In case scenarios, underline words like 'without permission', 'dishonestly', 'password', 'pretended' to choose the section.
  • In written answers, state the section, the ingredient that matches the facts, and the remedy. Do not just list sections.
  • Do not quote section numbers you are unsure of; describe the rule in plain words instead.

Practice questions from Laws and Regulations related to Cyber Security and Data Privacy

Cyber Crimes and Penalties under the IT Act in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Cyber Crimes and Penalties under the IT Act: frequently asked questions

What is the difference between section 43 and section 66 of the IT Act?

Section 43 covers unauthorised acts on computers and gives civil compensation. Section 66 covers the same acts when done dishonestly or fraudulently and makes them criminal. Punishment is up to three years, or fine up to ₹5 lakh, or both.

What is the punishment for identity theft under section 66C?

Imprisonment of either description up to three years and also a fine up to ₹1 lakh. The offence is fraudulent or dishonest use of another person's electronic signature, password or other unique identification feature.

Does section 43A apply to individuals?

It applies to a body corporate, which includes a company, firm, sole proprietorship or other association engaged in commercial or professional activities. It requires negligence in security practices for sensitive personal data and resulting wrongful loss or gain.

Can a person face both IT Act and other law action for the same act?

Yes. Section 77 says that compensation, penalty or confiscation under the IT Act does not prevent compensation or punishment under any other law in force.