Artificial Intelligence, Data Analytics and Cyber Security - Laws and Practice · Cyber Security

Information Technology Act, 2000 and Cyber Offences

Updated 11 October 2026 · Fact-checked

The Information Technology Act, 2000 is India's main law on cyber crime. Section 43 gives civil compensation for unauthorised computer acts. Section 66 makes the same acts criminal when done dishonestly or fraudulently. Sections 66C and 66D punish identity theft and cheating by personation. Section 79 protects intermediaries if they meet due diligence conditions.

Understand Information Technology Act, 2000 and Cyber Offences

The IT Act, 2000 gives legal recognition to electronic records and digital signatures. It also defines cyber wrongs and sets out how they are punished or compensated. For exams, think of it in two layers: civil liability and criminal liability.

The civil layer is section 43. It lists acts done without the permission of the owner or person in charge of a computer, computer system or network. Examples are unauthorised access, downloading or copying data, introducing a virus, damaging a system, denying access to an authorised user, and helping someone else do these acts. The wrongdoer must pay compensation to the affected person. Claims are decided by the adjudicating officer under section 46, up to the limit the Act sets for that forum. Larger claims go to the civil court.

The criminal layer starts with section 66. If a person does any act in section 43 dishonestly or fraudulently, it becomes an offence. The key difference is the mental element: section 43 needs no criminal intent, while section 66 needs dishonesty or fraud. Other offences build on this, such as section 66C (fraudulent or dishonest use of another person's electronic signature, password or unique identification feature) and section 66D (cheating by personation using a computer resource or communication device).

The Act also covers other cyber offences, such as section 66B (dishonestly receiving stolen computer resource or device), section 66E (violation of privacy), section 66F (cyber terrorism), and sections 67 to 67B (obscene material and child sexual abuse material in electronic form). Learn each as: act, mental element, and punishment.

Section 79 deals with intermediaries such as internet service providers, social media platforms and marketplaces. An intermediary is not liable for third-party information, data or communication links that it hosts or transmits, if it only provides access, does not initiate, select the receiver or modify the content, and observes due diligence. The protection is lost if it conspires or abets the unlawful act, or fails to remove the unlawful material after actual knowledge or a government notice, without vitiating the evidence.

Key rules to remember

Section 43 test: Act listed in s.43 + without permission of owner/person in charge = civil liability to pay compensation; No dishonest or fraudulent intention is needed. Compensation is claimed from the wrongdoer.
Section 66 test: Act in s.43 + dishonestly or fraudulently = criminal offence; The mental element is what separates s.66 from s.43. Punishment is imprisonment, fine, or both; confirm the exact term and fine amount from the bare Act before quoting them.
Section 66C: Fraudulent or dishonest use of another's electronic signature, password or other unique identification feature = identity theft; Think of misuse of someone's login credentials or digital signature.
Section 66D: Cheating by personation using a computer resource or communication device = offence; Typical facts are fake emails, phishing and impersonating a bank official online.
Section 79 safe harbour: Intermediary protected if: passive role + no initiating, selecting receiver or modifying + due diligence + removal on actual knowledge or government notice; Protection is lost on conspiracy, abetment or inducement, or failure to act after notice.
Adjudication: Section 46: adjudicating officer decides contraventions and compensation claims under Chapter IX; Appeals go to the appellate tribunal under the Act. Check the current forum for appeals.

How to solve Information Technology Act, 2000 and Cyber Offences questions

Case questions on the IT Act reward a clear structure: provision, facts, conclusion. Use the same sequence every time.

1Read the facts and list each act done by each person, such as logging in, copying data, sending a fake mail or hosting content.
2Ask whether the act was done without permission of the owner or person in charge. If yes, section 43 is likely engaged.
3Check the mental element. If there is dishonesty or fraud, add section 66. If not, stay with civil liability under section 43.
4Look for a specific offence that fits better: 66C for credentials or signatures, 66D for personation cheating, 66E for privacy, 66F for terror aims, 67 for obscene content.
5If a platform or service provider is involved, test it against section 79: passive role, due diligence, and action on notice.
6Identify the forum: adjudicating officer for compensation under section 46, criminal court for offences.
7Write the conclusion in one or two lines, naming the section and the likely liability or remedy. Add a practical compliance point if the question asks for advice.

Quickest way: Act, Intent, Section

When to use it: Use it for short case-based questions when time is limited.

Write the act in one line.
Mark intent: none means s.43, dishonest or fraudulent means s.66 or a specific section.
Match the specific section: credentials 66C, personation 66D.
Add the intermediary check under s.79 if a platform is involved.
State the remedy and forum in a final line.

Common mistakes in Information Technology Act, 2000 and Cyber Offences

Treating sections 43 and 66 as the same thing.
Both list the same acts, so students merge them.
Fix: Write one line: s.43 is civil compensation with no intent needed; s.66 is a crime needing dishonesty or fraud.
Using section 66C for any online cheating.
Identity theft sounds like a general term.
Fix: Use 66C when the accused uses another person's password, electronic signature or unique identification feature. Use 66D when cheating is by pretending to be someone.
Saying an intermediary is never liable.
Students remember safe harbour but forget the conditions.
Fix: State that protection depends on passive role, due diligence and prompt removal after actual knowledge or government notice.
Quoting punishments and fines from memory without certainty.
There are many sections with different terms.
Fix: Learn the offence and mental element first. Quote a term or fine only when you are sure of it from the bare Act.
Skipping the conclusion in case questions.
Students spend time listing sections.
Fix: End with a clear finding: who is liable, under which section, and before which forum.

Worked examples

Example 1

Rohan, an employee of Sunrise Logistics Ltd, uses a colleague's password without permission and copies the client database to his pen drive. He does not sell it or use it. Advise on liability under the IT Act, 2000.

Show the solution

Provision: section 43 covers accessing a computer system without permission of the person in charge and downloading or copying data from it.
Facts: Rohan used a colleague's password and copied the database. Both access and copying were without permission.
Intent: the facts show no dishonest or fraudulent purpose, such as sale or gain. But using another's password may point to dishonest use, so it must be examined.
Analysis: if dishonesty is shown, section 66 and possibly section 66C apply. Without it, liability is civil under section 43.
Forum: the company can claim compensation before the adjudicating officer under section 46, or approach the civil court for larger claims.

Answer: Rohan is liable under section 43 to pay compensation for unauthorised access and copying. If dishonest intention is proved, he also commits an offence under section 66 and, for the misuse of the password, section 66C.

Example 2

A social media platform hosts a post in which a user pretends to be a bank officer and collects customers' OTPs to withdraw money. The platform was told of the post by the police and did not remove it for several weeks. Discuss the liability of the user and the platform.

Show the solution

User: pretending to be a bank officer to obtain OTPs is cheating by personation using a computer resource, so section 66D applies.
User: using the OTPs to withdraw money also involves fraudulent use of customers' unique identification features, so section 66C may also apply.
Platform: it is an intermediary, and section 79 gives conditional protection for third-party content.
Test: the platform did not create or modify the post, but it failed to remove the material after government or police notice.
Conclusion on the platform: failing to act after notice defeats the safe harbour, so it may lose protection and face liability.

Answer: The user is liable under section 66D and likely 66C. The platform loses section 79 protection by not removing the unlawful content after notice, and may face liability. It should have acted on the notice promptly while preserving evidence.

Exam tips

Always name the section and then the idea. A section number alone earns few marks.
Draw the civil versus criminal line in every answer on sections 43 and 66.
For intermediary questions, list the conditions of section 79 and then apply them to the facts.
Add one practical point such as preserving logs, reporting to the police or CERT-In, and removing the content.
Quote punishment terms only when you are sure; otherwise state the offence and its nature.

Practice questions from Cyber Security

Information Technology Act, 2000 and Cyber Offences in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Information Technology Act, 2000 and Cyber Offences: frequently asked questions

What is the difference between section 43 and section 66 of the IT Act?

Section 43 gives civil compensation for listed acts done without permission. Section 66 makes the same acts a crime when done dishonestly or fraudulently. The difference is the mental element.

What does section 66C cover?

It covers fraudulent or dishonest use of another person's electronic signature, password or other unique identification feature. It is commonly called identity theft.

What is the difference between section 66C and 66D?

Section 66C deals with misuse of someone's credentials or signature. Section 66D deals with cheating by personation using a computer resource or communication device, such as a phishing email.

When is an intermediary protected under section 79?

It is protected when it only provides access or hosting, does not initiate, select the receiver or modify the content, and follows due diligence. It loses protection if it abets the act or fails to remove content after actual knowledge or notice.

Who decides compensation claims under the IT Act?

The adjudicating officer under section 46 decides contraventions and compensation up to the limit set by the Act. Claims above it go to the civil court.