Environmental, Social and Governance (ESG) - Principles and Practice · Data Governance

Section 29 IT Act 2000: Access to Computers and Data

Updated 11 October 2026 · Fact-checked

Section 29 of the IT Act, 2000 lets the Controller, or a person he authorises, access any computer system, apparatus, data or connected material if there is reasonable cause to suspect a contravention of Chapter VI. The Controller may also order those in charge of the system to give reasonable technical and other assistance.

Understand Access to Computers and Data (Section 29)

The Information Technology Act, 2000 has a chapter on Certifying Authorities, which issue digital signature certificates. The Controller supervises them. To do that job, the Controller needs a way to check systems when something looks wrong. Section 29 gives that power.

Under section 29(1), the Controller or any person authorised by him may get access to any computer system, any apparatus, data or any other material connected with such system. The purpose is searching, or causing a search to be made, to obtain information or data contained in or available to that system.

The power is not open-ended. It depends on a reasonable cause to suspect that a contravention has been committed. Originally the text referred to contravention of the Act, rules and regulations. Since 27-10-2009 it reads "any contravention of the provisions of this Chapter". So it is a supervisory power linked to the Chapter on Certifying Authorities, not a general search power over all cyber offences.

Section 29(2) adds a duty to assist. The Controller or authorised person may, by order, direct any person in charge of, or otherwise concerned with the operation of, the computer system, data, apparatus or material, to give such reasonable technical and other assistance as he considers necessary. Think of a person who must hand over passwords or explain how the system works.

The section opens with "without prejudice to section 69(1)". This means section 29 does not cut down the separate government power to direct interception, monitoring or decryption. Section 69 is for security, public order and investigation of offences. Section 29 is for the Controller's supervisory checks.

Key rules to remember

Who may access: Controller OR any person authorised by him; Section 29(1). The authorisation must come from the Controller.
Trigger condition: Reasonable cause to suspect a contravention of the provisions of Chapter VI; Suspicion must be reasonable. Wording since 27-10-2009 is "this Chapter", replacing "this Act, rules and regulations made thereunder".
What can be accessed: Any computer system, apparatus, data or other material connected with the system; Purpose: searching, or causing a search, to obtain information or data contained in or available to the system.
Duty to assist: Controller may, by order, direct any person in charge of or concerned with the operation of the system to give reasonable technical and other assistance; Section 29(2). Assistance must be reasonable and considered necessary by the Controller.
Relation to section 69: Section 29(1) is without prejudice to section 69(1); Section 69 is a separate power for interception, monitoring and decryption on grounds such as security of the State and investigation of offences.

How to solve Access to Computers and Data (Section 29) questions

Use this method for any fact-based question on section 29. Keep the answer in the order: provision, facts, conclusion.

1State the provision: the Controller or an authorised person may access computers, data and connected material under section 29(1).
2Check who is acting. Is it the Controller or a person authorised by him? A private party or an unauthorised officer cannot use section 29.
3Check the trigger. Is there reasonable cause to suspect a contravention of the provisions of Chapter VI (Certifying Authorities)? If the suspected wrong is outside that chapter, section 29 does not fit.
4Identify what is being accessed: computer system, apparatus, data or connected material, and whether the purpose is searching for information or data.
5Apply section 29(2) if the facts show someone refusing help. The Controller can order the person in charge or concerned with operation to give reasonable technical and other assistance.
6Note the link with section 69 if the facts involve security, public order or investigation of an offence. Say section 29 is without prejudice to it.
7Conclude clearly: access lawful or not, assistance order valid or not, with the reason in one line.

Quickest way: Who, why, what, help

When to use it: Use when you have under five minutes for a short case or a 5-mark note.

Who: Controller or his authorised person.
Why: reasonable cause to suspect contravention of Chapter VI.
What: any computer system, apparatus, data or connected material, to search for information.
Help: order for reasonable technical and other assistance under sub-section (2).
Add one line: without prejudice to section 69(1).

Common mistakes in Access to Computers and Data (Section 29)

Saying any police officer or any government officer can use section 29.
Students mix section 29 with section 69, which allows government agencies to intercept or monitor.
Fix: Section 29 names only the Controller or a person authorised by him. Link agencies and interception to section 69.
Writing that access needs proof of a contravention.
Students overlook the words used in the section.
Fix: The test is reasonable cause to suspect. Proof is not required before access. Suspicion must still have a reasonable basis.
Saying section 29 covers contravention of the whole Act.
Older notes carry the pre-2009 wording.
Fix: The current text says contravention of the provisions of this Chapter. Mention the 2009 substitution if you want extra marks.
Confusing section 29 with section 69B or section 43A.
All three sit in the data governance topic and sound alike.
Fix: Section 29: Controller's access. Section 69B: monitoring and collecting traffic data for cyber security by an authorised agency. Section 43A: compensation by body corporate for failure to protect sensitive data.
Stating a penalty for refusing assistance under section 29(2).
Students assume every duty has a stated punishment, as in sections 69 and 69B.
Fix: The text of section 29 supplied here states no penalty. Say only that the Controller may direct assistance by order. Do not invent a penalty.

Worked examples

Example 1

A Certifying Authority, SecureSign Ltd., Pune, is suspected of issuing digital signature certificates in breach of the provisions of the Chapter on Certifying Authorities. The Controller authorises an officer to inspect its servers and the data stored on them. The company's IT head refuses to give technical help. Advise on the legality of the Controller's action.

Show the solution

Provision: Section 29(1) lets the Controller or any person authorised by him access any computer system, apparatus, data or connected material if he has reasonable cause to suspect a contravention of the provisions of Chapter VI.
Facts on who acts: the officer is authorised by the Controller, so the first condition is met.
Facts on trigger: the suspected breach concerns issue of certificates by a Certifying Authority, which falls within the Chapter on Certifying Authorities. If the suspicion is reasonable, the trigger is met.
Facts on access: servers and stored data are a computer system and data, and the purpose is to search for information.
Refusal to help: under section 29(2) the Controller or authorised person may, by order, direct the person in charge or concerned with operation of the system to give reasonable technical and other assistance.
Practical point: the Controller should issue a written order to the IT head so that the direction is on record.

Answer: The access is lawful, provided the Controller had reasonable cause to suspect a contravention of Chapter VI. The IT head can be directed by order under section 29(2) to give reasonable technical and other assistance.

Example 2

Distinguish section 29 from section 69 of the IT Act, 2000 in respect of the power to access computer data. Use a short example.

Show the solution

Section 29: power of the Controller or his authorised person. Trigger is reasonable cause to suspect contravention of Chapter VI. Purpose is searching for information or data. Assistance can be directed by order.
Section 69: power of the Central or a State Government, or officers specially authorised, to direct any agency to intercept, monitor or decrypt information. Grounds include sovereignty and integrity of India, defence, security of the State, friendly relations with foreign States, public order, preventing incitement to related cognizable offences, or investigation of any offence. Reasons must be recorded in writing and the prescribed procedure and safeguards apply.
Penalty: section 69(4) provides imprisonment up to seven years and fine for failing to assist. Section 29 as supplied states no penalty.
Link: section 29(1) is expressly without prejudice to section 69(1), so both can exist side by side.
Example: the Controller checking a Certifying Authority's records for a suspected breach uses section 29. An agency ordered to decrypt messages in an investigation of an offence acts under section 69.

Answer: Section 29 is a supervisory access power of the Controller based on reasonable suspicion of contravention of Chapter VI. Section 69 is a government power to intercept, monitor or decrypt on grounds such as security and investigation, with a seven-year penalty for non-assistance. Section 29 is without prejudice to section 69(1).

Exam tips

Quote the key phrases: "reasonable cause to suspect", "any person authorised by him" and "reasonable technical and other assistance". Examiners look for them.
In case questions, check the trigger first. Many facts are built so that the suspected wrong is outside Chapter VI or the person acting is not authorised.
Prepare a one-line contrast table in your head for sections 29, 69, 69B and 43A. Distinction questions come from this group.
Do not state a penalty or section number you cannot find in the text. Say the section is silent on penalty rather than guess.
For a short note, write four points: who, trigger, what, assistance. Add the section 69 link as a closing line.

Practice questions from Data Governance

Access to Computers and Data (Section 29): frequently asked questions

Who can access computer data under section 29 of the IT Act, 2000?

The Controller, or any person authorised by him, can do so. This is a supervisory power linked to suspected contravention of Chapter VI. A person without the Controller's authorisation cannot use it.

Does section 29 need proof of a contravention before access?

No. The Controller needs reasonable cause to suspect that a contravention of the provisions of Chapter VI has been committed. The suspicion must be reasonable, but proof is not required at this stage.

What can be accessed under section 29?

Any computer system, any apparatus, data or any other material connected with such system. The purpose is to search, or cause a search, for information or data contained in or available to the system.

Can the Controller force someone to help with the access?

Yes. Under section 29(2) the Controller or authorised person may, by order, direct any person in charge of or concerned with the operation of the system to give reasonable technical and other assistance he considers necessary.

How is section 29 different from section 69B?

Section 29 is the Controller's power to access systems on reasonable suspicion of contravention of Chapter VI. Section 69B lets the Central Government authorise a Government agency to monitor and collect traffic data to enhance cyber security, with a penalty for intermediaries who knowingly fail to assist.