Artificial Intelligence, Data Analytics and Cyber Security - Laws and Practice · Cyber Crimes and Investigation Procedures

Offences and Penalties under the IT Act, 2000

Updated 11 October 2026 · Fact-checked

The IT Act, 2000 deals with cyber wrongs in two ways. Section 43 and 43A give civil compensation for damage to computers and failure to protect data. Sections like 66C, 66D and 66F create criminal offences with imprisonment and fine. Section 77 lets both routes run alongside other laws.

Understand Offences and Penalties under the IT Act, 2000

Start with one idea: the IT Act treats a cyber wrong either as a civil wrong (you pay compensation) or as a crime (you face imprisonment or fine). Many facts attract both.

Section 43 is the civil side. If a person, without the permission of the owner or person in charge, accesses a computer, system or network, downloads or copies data, introduces a virus or contaminant, damages or disrupts a system, denies access to an authorised person, helps another to do so, tampers to charge services to someone else's account, destroys, deletes or alters information, or steals, conceals or alters source code with intent to cause damage, the person is liable to pay damages by way of compensation to the person affected. The key trigger is absence of permission.

Section 43A is aimed at companies. A body corporate that holds sensitive personal data in a computer resource it owns, controls or operates, and is negligent in maintaining reasonable security practices, thereby causing wrongful loss or wrongful gain to anyone, must pay compensation. Here the fault is negligence, not a deliberate act.

Criminal offences carry punishment. Section 66C (identity theft) punishes fraudulent or dishonest use of another person's electronic signature, password or unique identification feature. Section 66D punishes cheating by personation using a communication device or computer resource. Both carry imprisonment up to three years and fine up to one lakh rupees. Section 66F (cyber terrorism) is the most serious: imprisonment which may extend to life.

Section 77 says compensation, penalty or confiscation under the Act does not prevent compensation or any other penalty or punishment under any other law. So one act can lead to a claim under section 43 and also a prosecution. On procedure, the BNSS allows alternative charges where it is doubtful which offence the facts make out (section 244 BNSS). Check the Act's text for other offences such as obscene content and for the adjudication provisions, as the extract above does not reproduce them.

Key rules to remember

Section 43 trigger: Act listed in clauses (a) to (j) + no permission of owner or person in charge → compensation to person affected; Civil liability. Covers access, copying, virus, damage, disruption, denial of access, assistance, tampering with billing, deletion or alteration, source code.
Section 43A: Body corporate + sensitive personal data + negligent security practices + wrongful loss or gain → compensation; Body corporate includes a company, firm, sole proprietorship or association engaged in commercial or professional activity.
Section 66C: Fraudulent or dishonest use of another's e-signature, password or unique ID → up to 3 years and fine up to ₹1,00,000; Imprisonment of either description.
Section 66D: Cheating by personation using communication device or computer resource → up to 3 years and fine up to ₹1,00,000; Imprisonment of either description.
Section 66F: Commits or conspires to commit cyber terrorism → imprisonment which may extend to life; Needs intent to threaten unity, integrity, security or sovereignty of India or to strike terror, or restricted-information access under clause (B).
Section 77: Compensation or penalty under the Act does not bar other punishment under any other law; Allows civil and criminal action together.

How to solve Offences and Penalties under the IT Act, 2000 questions

Use this order for any case-based question on IT Act offences.

1List the facts in sequence: who did what, to which computer or data, with whose permission.
2Decide if the act is civil (compensation) or criminal (imprisonment or fine), or both.
3Match each act to a section: access or damage to section 43, data lapse by a company to 43A, password misuse to 66C, impersonation to 66D, terror intent to 66F.
4Check the exact conditions: permission, negligence, wrongful loss or gain, intent, dishonesty.
5State the consequence: compensation, or the maximum imprisonment and fine.
6Apply section 77 to say other laws and remedies are not excluded.
7Conclude clearly and add a practical point, such as preserving evidence or reviewing security practices.

Quickest way: Intent and permission test

When to use it: When time is short and the facts mix several wrongs.

Ask: was there permission? If no, think section 43.
Ask: is the accused a company that was careless with sensitive data? Think 43A.
Ask: was there dishonest use of identity or cheating by personation? Think 66C or 66D.
Ask: was there intent against India's security or to strike terror? Think 66F.
Write one line on section 77 to show both remedies are open.

Common mistakes in Offences and Penalties under the IT Act, 2000

Saying section 43 gives imprisonment.
Students link every IT Act section with punishment.
Fix: Section 43 gives compensation to the person affected. Criminal punishment sits in other sections such as 66C, 66D and 66F.
Applying section 43A to any person or any data.
The title sounds general.
Fix: It applies only to a body corporate handling sensitive personal data, and needs negligence plus wrongful loss or gain.
Mixing up punishments of 66C and 66D.
Both carry three years and ₹1,00,000.
Fix: Use the conduct: 66C is misuse of another's e-signature, password or unique ID; 66D is cheating by personation.
Treating cyber terrorism as only hacking.
Students skip the intent element.
Fix: State the intent to threaten India's unity, integrity, security or sovereignty or to strike terror, and the resulting harm or restricted-information access.
Thinking one remedy shuts out others.
Students assume double jeopardy applies to civil and criminal action.
Fix: Cite section 77: compensation or penalty under the Act does not prevent punishment under other laws.

Worked examples

Example 1

Rahul, an ex-employee of Sunrise Pvt Ltd, uses his old login to enter the company server without permission and deletes customer files. Advise the company.

Show the solution

Facts: access without permission, then deletion of data.
Section 43 covers accessing a computer system without permission of the person in charge and destroying or deleting information.
Result: Rahul is liable to pay damages by way of compensation to the company.
Section 77: this does not stop other punishment under any other law, so criminal proceedings may also be pursued.
Practical point: preserve logs and revoke old credentials.

Answer: Rahul is liable for compensation under section 43, and section 77 keeps other criminal remedies open.

Example 2

Meera uses Anil's password, without his consent, to log in to his account and also poses as a bank officer online to cheat Sunil. Identify the offences and punishment.

Show the solution

Dishonest use of Anil's password attracts section 66C (identity theft).
Cheating Sunil by posing as a bank officer using a computer resource attracts section 66D (cheating by personation).
Each offence carries imprisonment of either description up to three years and fine up to ₹1,00,000.
Section 43 may also give Anil compensation for unauthorised access, and section 77 permits this alongside punishment.

Answer: Meera is liable under sections 66C and 66D, each up to three years and fine up to ₹1,00,000, with possible compensation under section 43.

Exam tips

Always name the section and quote its key condition, such as no permission or negligence.
Separate civil and criminal consequences in your answer.
Learn the punishment figures for 66C, 66D and 66F exactly.
End with section 77 when the facts show both compensation and punishment.

Practice questions from Cyber Crimes and Investigation Procedures

Offences and Penalties under the IT Act, 2000 in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Offences and Penalties under the IT Act, 2000: frequently asked questions

What is the difference between section 43 and section 66?

Section 43 gives civil compensation for acts done without permission. The 66 series, such as 66C and 66D, create offences punishable with imprisonment and fine. The same act can attract both.

What is the punishment for cyber terrorism under the IT Act?

Section 66F provides imprisonment which may extend to life for whoever commits or conspires to commit cyber terrorism.

Can a company be liable under section 43A?

Yes. A body corporate holding sensitive personal data is liable if it is negligent in keeping reasonable security practices and this causes wrongful loss or wrongful gain to a person.

Can compensation and punishment both be imposed?

Yes. Section 77 says compensation, penalty or confiscation under the Act does not prevent other penalty or punishment under any other law.