Jurisprudence, Interpretation and General Laws · Law relating to Information Technology

Cyber Offences, Penalties and Compensation under the IT Act, 2000

Updated 11 October 2026 · Fact-checked

The IT Act, 2000 treats unauthorised acts on computers in two ways. Section 43 makes the wrongdoer pay compensation. Section 66 punishes the same acts with imprisonment or fine if done dishonestly or fraudulently. Sections 66C, 66F and 72A cover identity theft, cyber terrorism and breach of data confidentiality. Identify the section, the intent and the consequence.

Understand Cyber Offences, Penalties and Compensation

The IT Act, 2000 deals with misuse of computers in layers. The first layer is civil. Section 43 lists acts done without permission of the owner or person in charge of a computer, computer system or network. Examples are accessing it, copying data, introducing a virus, damaging or disrupting it, denying access, or tampering with records. The wrongdoer is liable to pay damages by way of compensation to the person affected.

The second layer is criminal. Section 66 says that if a person dishonestly or fraudulently does any act referred to in section 43, the act becomes an offence. Punishment is imprisonment up to three years, or fine up to ₹5 lakh, or both. So the act is the same. What changes is the mental state. Without dishonest or fraudulent intent you face section 43 only. With it, section 66 applies as well.

Section 43A protects data held by companies. A body corporate that handles sensitive personal data in a computer resource it owns, controls or operates must follow reasonable security practices. If it is negligent and this causes wrongful loss or wrongful gain to any person, it must pay compensation. Note that the trigger is negligence, not intent. "Body corporate" includes a firm, sole proprietorship or other association engaged in commercial or professional activities.

Special offences follow. Section 66C punishes identity theft: fraudulent or dishonest use of another person's electronic signature, password or unique identification feature, with up to three years imprisonment and fine up to ₹1 lakh. Section 66F punishes cyber terrorism with imprisonment which may extend to life. Section 72A deals with a person, including an intermediary, who gets access to personal information while providing services under a lawful contract and discloses it without consent or in breach of the contract, intending or knowing that wrongful loss or gain is likely. Liability is a penalty up to ₹25 lakh.

Three supporting sections matter. Section 77 says compensation or penalty under this Act does not stop punishment under any other law. Section 84B punishes abetment with the punishment for the main offence, if the offence is committed because of the abetment. Section 44 imposes penalties for failure to furnish returns, documents or keep books, and section 69B punishes an intermediary who intentionally or knowingly refuses technical assistance for traffic data monitoring.

Key rules to remember

Section 43 - compensation: Act listed in s.43 + without permission of owner/person in charge = damages by way of compensation; Civil liability. No dishonest or fraudulent intent needed.
Section 66 - computer related offence: Section 43 act + dishonestly or fraudulently = imprisonment up to 3 years or fine up to ₹5 lakh or both; "Dishonestly" and "fraudulently" take the meaning given in the Explanation to the section.
Section 43A - failure to protect data: Body corporate + sensitive personal data in its computer resource + negligent security + wrongful loss or gain = compensation; Negligence is enough. Applies to bodies corporate only.
Section 66C - identity theft: Fraudulent or dishonest use of another's electronic signature, password or unique identification feature = imprisonment up to 3 years and fine up to ₹1 lakh; Imprisonment and fine both: the text says "shall also be liable to fine".
Section 66F - cyber terrorism: Intent to threaten unity, integrity, security or sovereignty of India or strike terror + listed means + specified consequences = imprisonment up to life; Also covers unauthorised access to restricted information (clause B). Conspiracy is punished equally.
Section 72A - disclosure in breach of lawful contract: Access under lawful contract + personal information + intent or knowledge of wrongful loss or gain + disclosure without consent or in breach of contract = penalty up to ₹25 lakh; Applies to any person, including an intermediary. Penalty since the 2023 amendment (earlier "punishment").
Sections 77 and 84B: s.77: no bar to other law's punishment. s.84B: abettor gets punishment of the offence if committed in consequence of abetment; Section 84B applies only where the Act makes no express provision for abetment.

How to solve Cyber Offences, Penalties and Compensation questions

Use this method for any fact-based question on cyber offences and penalties.

1Read the facts and list what the person did: access, copy, virus, disclosure, password use, and so on.
2Ask whether it was without permission of the owner or person in charge. If yes, section 43 applies and compensation follows.
3Check the intent. If dishonest or fraudulent, add section 66. Use the exact punishment: up to three years, or fine up to ₹5 lakh, or both.
4Look for special facts: another's password or e-signature (66C), terror intent or critical infrastructure (66F), a company's negligent data security (43A), or a contractor disclosing personal data (72A).
5Check the status of the person: body corporate for 43A, intermediary or any service provider for 72A, intermediary for 69B(4).
6Note any extra consequence: other laws may also apply under section 77, and an abettor is covered by section 84B.
7Write the answer in ICSI style: provision, application to facts, conclusion.

Quickest way: Act, intent, person, consequence

When to use it: Use this for short-note or case-based questions when time is tight.

Act: what exactly was done?
Intent: none or negligence (43, 43A), dishonest or fraudulent (66, 66C), terror (66F), wrongful loss or gain (72A).
Person: any person, body corporate, or intermediary.
Consequence: compensation, penalty, or imprisonment and fine.
Write the section number with the limit, then one line of conclusion.

Common mistakes in Cyber Offences, Penalties and Compensation

Saying section 43 prescribes imprisonment.
Students mix it with section 66, which uses the same list of acts.
Fix: Remember: 43 is compensation (civil). 66 adds dishonest or fraudulent intent and brings imprisonment or fine.
Applying section 43A to any person who leaks data.
The word "data protection" suggests a general rule.
Fix: Section 43A applies only to a body corporate handling sensitive personal data, and the trigger is negligent security practices causing wrongful loss or gain.
Writing that section 72A gives imprisonment.
Older notes call it "punishment" and mention imprisonment.
Fix: In the text supplied, section 72A makes the person liable to a penalty up to ₹25 lakh. State it that way.
Forgetting the intent element in 72A.
Students focus on the disclosure alone.
Fix: Mention intent to cause, or knowledge that disclosure is likely to cause, wrongful loss or wrongful gain, and the absence of consent or breach of lawful contract.
Mixing up the limits of sections 66 and 66C.
Both carry three years but different fines.
Fix: Section 66: fine up to ₹5 lakh, imprisonment or fine or both. Section 66C: imprisonment up to three years and also fine up to ₹1 lakh.
Assuming a penalty under the IT Act ends all liability.
Students overlook section 77.
Fix: Compensation, penalty or confiscation under the Act does not prevent punishment under any other law.

Worked examples

Example 1

Ravi, an employee of Alpha Ltd, copies the company's customer database from the office server without permission and sells it to a rival dishonestly. Discuss his liability under the IT Act, 2000.

Show the solution

Ravi downloaded or copied data from a computer system without permission of the person in charge. This is covered by section 43(b).
Section 43 makes him liable to pay damages by way of compensation to Alpha Ltd.
He acted dishonestly by selling it to a rival. So section 66 applies to the same act.
Under section 66 he may be punished with imprisonment up to three years, or fine up to ₹5 lakh, or both.
Under section 77, compensation under the Act does not stop punishment under any other law.

Answer: Ravi is liable to compensate Alpha Ltd under section 43(b) and is also punishable under section 66 with imprisonment up to three years or fine up to ₹5 lakh or both, since he acted dishonestly. Other laws may also apply under section 77.

Example 2

Sunrise Data Services Pvt Ltd handles payroll data for clients under a written contract. Its employee Meena, with knowledge that it is likely to harm the staff of a client, gives their salary and personal details to a debt recovery agent without their consent. Advise on liability under section 72A.

Show the solution

Sunrise provides services under a lawful contract, so its personnel have secured access to personal information about other persons.
Meena disclosed the material to another person without the consent of the persons concerned.
She knew that wrongful loss or wrongful gain was likely. The intent or knowledge element of section 72A is met.
Section 72A applies to any person, including an intermediary, who does this.
The consequence is liability to a penalty which may extend to ₹25 lakh.
Sunrise itself may also face section 43A compensation if its security practices were negligent and sensitive personal data was involved, and section 77 keeps other laws open.

Answer: Meena is liable under section 72A to a penalty which may extend to ₹25 lakh. Sunrise may additionally be liable for compensation under section 43A if it was negligent in maintaining reasonable security practices.

Exam tips

Learn sections 43, 43A, 66, 66C, 66F and 72A as a set. Examiners like questions that test which section applies to given facts.
Always state the limit exactly: ₹5 lakh for section 66, ₹1 lakh for 66C, ₹25 lakh for 72A, and imprisonment up to life for 66F.
For difference questions, use two columns in words: civil compensation (43, 43A) against criminal punishment (66, 66C, 66F).
In case studies, quote the key words from the section, such as "without permission" or "dishonestly or fraudulently", and then link each fact to them.
End every answer with a clear conclusion on liability, and mention section 77 when other laws may also apply.

Practice questions from Law relating to Information Technology

Cyber Offences, Penalties and Compensation in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

CS ProfessionalCyber Offences, Penalties and Adjudication under the IT Act

Cyber Offences, Penalties and Compensation: frequently asked questions

What is section 72A of the IT Act, 2000?

It deals with disclosure of personal information in breach of a lawful contract. A person, including an intermediary, who gets access to personal information while providing services under a lawful contract and discloses it without consent or in breach of the contract, intending or knowing that wrongful loss or gain is likely, is liable to a penalty up to ₹25 lakh.

What is the difference between section 43 and section 66?

Section 43 lists the unauthorised acts and makes the person pay compensation. Section 66 applies when the same acts are done dishonestly or fraudulently. It carries imprisonment up to three years, or fine up to ₹5 lakh, or both.

When is a company liable under section 43A?

A body corporate is liable when it handles sensitive personal data in a computer resource it owns, controls or operates, is negligent in maintaining reasonable security practices, and this causes wrongful loss or gain to someone. It must pay compensation to the person affected.

What is the punishment for identity theft under the IT Act?

Section 66C punishes fraudulent or dishonest use of another person's electronic signature, password or unique identification feature. The punishment is imprisonment up to three years and also a fine up to ₹1 lakh.