Environmental, Social and Governance (ESG) - Principles and Practice · Data Governance

Section 84A IT Act: Modes or Methods for Encryption

Updated 11 October 2026 · Fact-checked

Section 84A of the IT Act, 2000 lets the Central Government prescribe the modes or methods for encryption. It does so for secure use of the electronic medium and to promote e-governance and e-commerce. You answer questions by stating the power, its purpose, how it is exercised through rules under section 87, and its link to data protection.

Understand Encryption Modes and Methods (Section 84A)

Encryption is the process of converting readable information into a coded form so that only a person with the right key can read it. It protects data from unauthorised access, whether the data is stored or moving across a network. Banks, payment apps, company registries and e-filing portals all rely on it.

If every organisation chose its own encryption method, systems would not work together and weak methods would be used. Section 84A solves this. It says: "The Central Government may, for secure use of the electronic medium and for promotion of e-governance and e-commerce, prescribe the modes or methods for encryption." The section was inserted by the 2009 amendment, effective 27 October 2009.

Note the wording. The power is enabling: the word is "may", not "shall". The section itself does not list any algorithm or key length. It only gives the Government the authority to prescribe them. The purpose is stated in the section: secure use of the electronic medium, and promotion of e-governance and e-commerce.

The prescribing is done through rules. Section 87(2)(zh) lists "the modes or methods for encryption under section 84A" among the matters on which the Central Government may make rules. Under section 87(1), rules are made by notification in the Official Gazette and in the Electronic Gazette. Under section 87(3), rules made under section 87 are laid before each House of Parliament for thirty days, and Parliament can modify them or decide they should not be made, without affecting anything already done.

For data governance, encryption is a core security safeguard. Section 43A makes a body corporate that handles sensitive personal data liable to pay compensation if it is negligent in maintaining reasonable security practices and thereby causes wrongful loss or wrongful gain. Encryption is a typical practice that a company would point to when showing reasonable security. Remember, though, that section 43A does not name encryption. Use the word as an illustration, not as a quoted requirement.

Key rules to remember

Section 84A power: Central Government MAY prescribe modes or methods for encryption; Enabling power. The purpose is secure use of the electronic medium and promotion of e-governance and e-commerce.
Rule-making link: Section 87(2)(zh): rules on modes or methods for encryption under section 84A; Rules are made by notification in the Official Gazette and the Electronic Gazette (section 87(1)).
Parliamentary oversight: Rules laid before each House for 30 days (section 87(3)); The period may run over one session or two or more successive sessions. Modification or annulment does not affect things already done.
Section 43A trigger: Body corporate + sensitive personal data in own computer resource + negligence in reasonable security practices + wrongful loss or gain = compensation; All elements must be present. Reasonable security practices may be set by agreement, by law, or by rules if neither exists.

How to solve Encryption Modes and Methods (Section 84A) questions

Use this method for any question on section 84A or on encryption in data governance.

1Define encryption in one or two lines: converting data into coded form so that only authorised key holders can read it.
2State section 84A in words: the Central Government may prescribe modes or methods for encryption.
3State the purpose: secure use of the electronic medium and promotion of e-governance and e-commerce.
4Explain how the power is used: by rules under section 87(2)(zh), notified in the Official Gazette and Electronic Gazette, and laid before Parliament under section 87(3).
5Apply to the facts: identify the company, the data and the security practice, and say whether prescribed methods or agreed practices were followed.
6Link to related provisions where the facts call for it, mainly section 43A for compensation on failure to protect sensitive personal data.
7Conclude clearly: say what the company should do, such as adopt prescribed or recognised encryption and document it.

Quickest way: Four-line answer for section 84A

When to use it: Use it for short-note questions or when you have under five minutes.

Line 1: Section 84A empowers the Central Government to prescribe modes or methods for encryption.
Line 2: Purpose is secure use of the electronic medium and promotion of e-governance and e-commerce.
Line 3: Exercised through rules under section 87(2)(zh), laid before Parliament.
Line 4: Practical link: encryption supports reasonable security practices under section 43A.

Common mistakes in Encryption Modes and Methods (Section 84A)

Writing that section 84A makes encryption compulsory for every company.
Students read the section as a duty instead of a power.
Fix: Use the word "may". The section only empowers the Central Government to prescribe modes or methods. Any duty arises from rules or other laws.
Stating specific algorithms or key lengths as being in section 84A.
Students mix general knowledge of cryptography with the statute.
Fix: Say the section names none. Details come only from what the Government prescribes.
Confusing section 84A with section 69, which deals with interception, monitoring or decryption.
Both involve the idea of decryption or encryption.
Fix: Section 84A is about prescribing encryption modes for secure e-governance and e-commerce. Procedures for interception, monitoring or decryption are a rule-making matter under section 87(2)(y) in connection with section 69.
Forgetting the purpose clause.
Students memorise the power but not why it exists.
Fix: Always add: secure use of the electronic medium and promotion of e-governance and e-commerce.
Saying section 43A names encryption as the required security practice.
Students link the two topics too tightly.
Fix: Section 43A speaks of reasonable security practices, set by agreement, by law, or by prescribed rules. Encryption is an example of such a practice, not the quoted term.

Worked examples

Example 1

Explain the power of the Central Government under section 84A of the IT Act, 2000 and how it is exercised.

Show the solution

Provision: section 84A says the Central Government may, for secure use of the electronic medium and for promotion of e-governance and e-commerce, prescribe the modes or methods for encryption.
Analysis of nature: the power is enabling ("may"), so the section itself fixes no algorithm. It was inserted by the 2009 amendment, effective 27 October 2009.
Analysis of exercise: section 87(2)(zh) lets the Central Government make rules on the modes or methods for encryption under section 84A. Under section 87(1) this is done by notification in the Official Gazette and Electronic Gazette.
Oversight: under section 87(3) the rules are laid before each House of Parliament for thirty days. Both Houses may modify them or agree they should not be made, without prejudice to things already done.
Conclusion: section 84A gives a legal basis for uniform, secure encryption standards, and the standards bind only to the extent the rules prescribe them.

Answer: Section 84A is an enabling power to prescribe encryption modes or methods for secure electronic use and for e-governance and e-commerce, exercised through rules under section 87(2)(zh), notified in the Gazette and laid before Parliament.

Example 2

Suvidha Pay Ltd, a Pune company, stores customers' financial details on its own servers without any encryption. A hacker accesses the data and customer Mr Rao suffers wrongful loss. Advise the company on its exposure and the relevance of encryption.

Show the solution

Provision: section 43A applies where a body corporate possessing, dealing or handling sensitive personal data in a computer resource it owns, controls or operates is negligent in implementing and maintaining reasonable security practices and thereby causes wrongful loss or wrongful gain to any person. It is then liable to pay damages by way of compensation.
Facts check: Suvidha Pay is a company, so it is a body corporate. It handles customers' financial details on its own servers. Whether these are sensitive personal data or information depends on what the Central Government has prescribed, and financial information is commonly treated as such, so confirm it against the prescribed list.
Security practices: reasonable security practices mean those specified in an agreement between the parties or in any law, and if there is neither, those prescribed by the Central Government. Check the customer agreement and prescribed rules for any encryption standard.
Role of section 84A: the Central Government may prescribe encryption modes or methods. If methods are prescribed, using them strengthens the company's position. Storing data in plain, unencrypted form weakens any claim that its practices were reasonable.
Causation: Mr Rao's wrongful loss resulted from the breach, so the loss element is met.
Conclusion: the company faces a strong risk of liability to compensate Mr Rao. It should adopt prescribed or recognised encryption, document its security policy and review its agreements.

Answer: Suvidha Pay is likely liable to pay compensation under section 43A for negligent security practices. Section 84A does not itself impose liability, but encryption methods the Government prescribes under it would help show reasonable security, and their absence weakens the company's defence.

Exam tips

Quote the key words of section 84A: "secure use of the electronic medium and for promotion of e-governance and e-commerce". Examiners reward exact purpose wording.
Always connect 84A to section 87(2)(zh) to show you know how the power is exercised.
In case-based questions, follow provision, analysis of facts, conclusion. Bring in section 43A only when personal data and loss are present.
Do not cite section numbers you are unsure of. Stay with 84A, 87, 43A, 3A and 10, which are clearly in your text.
Keep short notes to about six lines: definition, section text, purpose, rule-making, link to data protection.

Practice questions from Data Governance

Encryption Modes and Methods (Section 84A): frequently asked questions

What does section 84A of the IT Act, 2000 say?

It says the Central Government may, for secure use of the electronic medium and for promotion of e-governance and e-commerce, prescribe the modes or methods for encryption. It is an enabling provision inserted in 2009.

Is encryption mandatory under section 84A?

Section 84A itself does not make encryption mandatory. It only empowers the Central Government to prescribe modes or methods. Any obligation depends on the rules made and on other applicable laws or agreements.

How are encryption methods prescribed?

Through rules made under section 87, which lists the modes or methods for encryption under section 84A as a rule-making matter. The rules are notified in the Official Gazette and Electronic Gazette and laid before Parliament for thirty days.

How is encryption linked to data protection?

Encryption is a common security safeguard against unauthorised access. Under section 43A, a body corporate negligent in maintaining reasonable security practices for sensitive personal data must pay compensation for wrongful loss or gain it causes.