Artificial Intelligence, Data Analytics and Cyber Security - Laws and Practice · Cyber Threats and Cyber Laws

Offences and Penalties under the IT Act: Section 43 to 67B

Updated 11 October 2026 · Fact-checked

The IT Act, 2000 has two tracks. Section 43 gives civil liability: a person who does listed acts to a computer without permission pays compensation. Sections 65, 66, 66C, 66D, 66E and 67 to 67B are criminal: they punish with imprisonment or fine. Section 66 applies when a section 43 act is done dishonestly or fraudulently.

Understand Offences and Penalties under the IT Act

Start with the idea of two tracks. The IT Act deals with wrongs to computers and data in a civil way and in a criminal way. Section 66 links the two: when a section 43 act is done dishonestly or fraudulently, the same act falls in both tracks. Section 77 is a separate rule. It says no compensation awarded, penalty imposed or confiscation made under the Act prevents the award of compensation or the imposition of any other penalty or punishment under any other law.

Section 43 is the civil track. It lists acts done without the permission of the owner or person in charge of a computer, computer system or computer network. These include accessing it, downloading or copying data, introducing a virus or contaminant, damaging it, disrupting it, denying access to an authorised person, helping others to gain access unlawfully, charging services to another person's account, destroying or altering information, and stealing, concealing or altering source code with intent to cause damage. The result is liability to pay damages by way of compensation to the person affected. Section 43 does not require dishonest or fraudulent intent.

Section 66 is the criminal track built on section 43. If any person, dishonestly or fraudulently, does any act referred to in section 43, he is punishable with imprisonment up to three years, or fine up to five lakh rupees, or both. So the extra ingredient is that the act is done dishonestly or fraudulently, as defined by reference to sections 24 and 25 of the Indian Penal Code. This is the core of the difference between sections 43 and 66.

Other offences stand on their own facts. Section 65 covers tampering with computer source code that the law requires to be kept or maintained. Section 66C covers identity theft, 66D cheating by personation using a computer resource, and 66E violation of privacy by capturing, publishing or transmitting the image of a private area. Sections 67, 67A and 67B cover obscene material, sexually explicit material and material depicting children in sexually explicit acts, with higher punishment on second conviction.

Related but separate is section 43A. It makes a body corporate that handles sensitive personal data liable to pay compensation if it is negligent in keeping reasonable security practices and thereby causes wrongful loss or wrongful gain to any person. It is civil, and it applies to companies, firms, sole proprietors and other associations in commercial or professional activity.

Key rules to remember

Section 43 (civil): Act listed in s.43 + without permission of owner/person in charge → damages by way of compensation; No dishonest or fraudulent intention is required. Clauses (a) to (j) list the acts.
Section 66 (criminal): s.43 act + dishonestly or fraudulently → imprisonment up to 3 years or fine up to ₹5,00,000 or both; 'Dishonestly' and 'fraudulently' take their meaning from sections 24 and 25 of the Indian Penal Code.
Section 65: Knowingly or intentionally conceal, destroy or alter source code required by law to be kept → imprisonment up to 3 years or fine up to ₹2,00,000 or both; The source code must be one the law requires to be kept or maintained.
Section 66C: Fraudulent or dishonest use of another's electronic signature, password or unique identification feature → imprisonment up to 3 years and fine up to ₹1,00,000; The text says 'shall also be liable to fine'.
Section 66D: Cheating by personation by means of a communication device or computer resource → imprisonment up to 3 years and fine up to ₹1,00,000; Personation is the key fact, for example a fake bank official on a call or website.
Section 66E: Intentionally or knowingly capture, publish or transmit image of a private area without consent, violating privacy → imprisonment up to 3 years or fine up to ₹2,00,000 or both; Private area means genitals, pubic area, buttocks or female breast, naked or undergarment clad.
Section 67: Obscene material in electronic form: first conviction up to 3 years and fine up to ₹5,00,000; later conviction up to 5 years and fine up to ₹10,00,000; Test: lascivious, appeals to prurient interest, or tends to deprave and corrupt.
Sections 67A and 67B: First conviction up to 5 years and fine up to ₹10,00,000; later conviction up to 7 years and fine up to ₹10,00,000; 67A: sexually explicit act or conduct. 67B: child sexual material and online abuse of children. 'Children' means persons under 18.
Section 43A: Body corporate + sensitive personal data + negligent security + wrongful loss or gain → compensation; Civil liability. Security standards come from agreement, law, or rules prescribed by the Central Government.
Section 77: No compensation awarded, penalty imposed or confiscation made under the Act prevents the award of compensation or imposition of any other penalty or punishment under any other law; Use it to show that remedies under other laws stay open. The link between a section 43 act and punishment under the Act comes from section 66 itself.

How to solve Offences and Penalties under the IT Act questions

Use this method for any fact-based question on IT Act offences. Write provision, analysis, conclusion.

1Read the facts and list each separate act done: access, copying, impersonation, publishing, and so on.
2For each act, ask whether it is a section 43 act done without permission. If yes, civil liability to compensate arises.
3Look for the mental element. Words such as dishonestly or fraudulently bring a section 43 act into section 66. Words such as knowingly or intentionally matter for sections 65 and 66E.
4Check for a specific offence that fits better: source code (65), password or e-signature misuse (66C), personation (66D), private image (66E), obscene or explicit content (67, 67A, 67B).
5State the punishment accurately: term, fine, and whether the text says 'and' or 'or'. Note any higher punishment on second conviction.
6Check whether the accused is a body corporate that failed to protect sensitive personal data. If so, add section 43A.
7Add section 77: compensation, penalty or confiscation under the Act does not prevent compensation or any other penalty or punishment under any other law.
8Conclude clearly with the sections applicable, the nature of liability (civil, criminal or both) and the likely consequence.

Quickest way: Intent test and label test

When to use it: When you have 8 to 10 minutes for a short case question and must name the right sections fast.

Write the act in one line and match it to a label: access or damage (43), source code (65), password (66C), personation (66D), image (66E), content (67 series).
Ask one question: was there dishonest or fraudulent intent? No means section 43 compensation. Yes means section 66 as well.
Quote the punishment figures from memory using the formula list.
Close with one line on section 77 and, if a company held the data, section 43A.

Common mistakes in Offences and Penalties under the IT Act

Treating section 43 as a criminal provision with jail term.
The section is titled 'Penalty and compensation' and students link penalty to punishment.
Fix: Remember that section 43 ends in liability to pay damages by way of compensation. Imprisonment comes only through section 66 and other criminal sections.
Applying section 66 without discussing dishonest or fraudulent intent.
Students see unauthorised access and jump to hacking.
Fix: Always write one sentence on intent and cite sections 24 and 25 of the IPC for the meaning of the two words.
Mixing up the fines under 66C and 66D (₹1,00,000) with section 66 (₹5,00,000).
All three carry three years' imprisonment, so the numbers blur.
Fix: Memorise: 66 is ₹5 lakh, 66C and 66D are ₹1 lakh, 66E is ₹2 lakh, 65 is ₹2 lakh.
Saying section 43A applies to any person who leaks data.
The word 'data' draws attention away from the conditions.
Fix: State the conditions: a body corporate, sensitive personal data in a computer resource it owns, controls or operates, negligence in reasonable security practices, and wrongful loss or gain.
Applying section 65 to any source code deletion.
Students overlook the condition in the text.
Fix: Section 65 needs source code that the law requires to be kept or maintained. Otherwise consider section 43(j) or 66.
Assuming action under the Act bars a case under other laws.
Students think one remedy excludes the other.
Fix: Cite section 77: no compensation, penalty or confiscation under the Act prevents the award of compensation or the imposition of any other penalty or punishment under any other law.

Worked examples

Example 1

Rohan, an employee of Kaveri Textiles Ltd, without permission logs in to the company's server and copies the customer database to a pen drive. He does it out of curiosity and does not use or sell the data. Discuss his liability under the IT Act, 2000.

Show the solution

Provision: section 43(a) and (b) make it a contravention to access a computer system, or download, copy or extract data from it, without the permission of the owner or person in charge. The person is liable to pay compensation to the person affected.
Analysis: Rohan had no permission. He accessed the server and copied data to a removable medium, which section 43(b) expressly covers.
Intent: section 66 needs dishonest or fraudulent intent. The facts say he acted from curiosity and did not use or sell the data. On these facts, dishonest or fraudulent intent is not shown, although the company may argue otherwise if it finds evidence of wrongful gain or loss.
Conclusion: Rohan is civilly liable under section 43 to compensate Kaveri Textiles for the loss caused. Criminal liability under section 66 arises only if dishonest or fraudulent intent is proved.

Answer: Rohan is liable to pay compensation under section 43(a) and (b). Section 66 (imprisonment up to three years or fine up to ₹5,00,000 or both) applies only if dishonest or fraudulent intent is established.

Example 2

Meera receives a call from a person posing as a bank officer and shares her net banking password. The caller uses the password to transfer ₹80,000 from her account. Which sections of the IT Act, 2000 apply and what is the maximum punishment?

Show the solution

Cheating by personation: the caller posed as a bank officer by means of a communication device to cheat Meera. Section 66D applies.
Identity theft: the caller fraudulently or dishonestly used Meera's password, which is a unique identification feature of another person. Section 66C applies.
Punishment: under 66D, imprisonment of either description up to three years and also liable to fine up to ₹1,00,000. Under 66C, the same: up to three years and fine up to ₹1,00,000.
Section 43 and section 66: Meera gave the password herself, but the caller then used it to log in to her account, which the owner had not permitted. That may amount to accessing or securing access under section 43(a). If it was done dishonestly or fraudulently, section 66 may also apply, with imprisonment up to three years or fine up to ₹5,00,000 or both. Section 77 keeps remedies under other laws open.
Conclusion: the caller faces sections 66C and 66D, and possibly section 66 read with section 43(a). Meera may claim compensation under section 43 if that section is made out.

Answer: Sections 66C and 66D apply. Each carries imprisonment up to three years and a fine up to ₹1,00,000. If the login is treated as a section 43(a) act done dishonestly or fraudulently, section 66 may also apply, with a fine up to ₹5,00,000. So the overall maximum fine depends on which sections are charged. Section 77 keeps other laws open.

Exam tips

Structure every answer as provision, analysis, conclusion. Quote the section number and the key words of the text.
Always draw the 43 versus 66 line: compensation without intent, punishment with dishonest or fraudulent intent.
Write the fine amounts in rupees with the correct term. Marks are often lost on figures.
In case questions, list each act separately and map it to its own section instead of one general answer.
Mention section 77 and, where a company held the data, section 43A to show full coverage.

Practice questions from Cyber Threats and Cyber Laws

Offences and Penalties under the IT Act in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Offences and Penalties under the IT Act: frequently asked questions

What is the difference between section 43 and section 66 of the IT Act?

Section 43 lists acts done without permission and makes the person liable to pay compensation. Section 66 applies when any of those acts is done dishonestly or fraudulently, and it adds imprisonment up to three years or fine up to ₹5,00,000, or both.

What is the punishment under section 66C and 66D?

Both carry imprisonment of either description up to three years and liability to a fine of up to ₹1,00,000. Section 66C covers fraudulent or dishonest use of another's password, electronic signature or unique identification feature. Section 66D covers cheating by personation using a communication device or computer resource.

How is compensation for data damage decided under the IT Act?

Section 43 says the person is liable to pay damages by way of compensation to the person affected. The text supplied here does not set a formula, so in the exam state the rule and tie the amount to the loss caused to the affected person.

Can a person face both compensation and criminal punishment?

Yes. If a section 43 act is done dishonestly or fraudulently, section 66 itself makes it punishable, and the person can also be liable to pay compensation under section 43. Section 77 adds that no compensation, penalty or confiscation under the Act prevents the award of compensation or the imposition of any other penalty or punishment under any other law.