Environmental, Social and Governance (ESG) - Principles and Practice · Data Governance

Information Technology Act, 2000: Overview and Key Definitions

Updated 11 October 2026 · Fact-checked

The Information Technology Act, 2000 is the Indian law on electronic records, electronic signatures, cyber security and cyber offences. Its definitions, such as computer resource, data, electronic record and intermediary, decide who and what the Act covers. To answer questions, state the definition, apply it to the facts, then conclude.

Understand Information Technology Act, 2000: Overview

Data governance begins with knowing which law covers your data and your systems. In India, the Information Technology Act, 2000 (the IT Act) is the main law that deals with electronic records, electronic signatures, cyber security and the powers of the Government over digital information. Its provisions sit on a set of definitions in section 2(1).

The Act works by defining its terms widely. A computer is not just a laptop. It is any electronic, magnetic, optical or other high-speed data processing device or system that performs logical, arithmetic and memory functions, and it includes the input, output, processing, storage, software or communication facilities connected to it. A computer resource is wider still: it means computer, computer system, computer network, data, computer data base or software.

Two more terms carry the topic. Data is a representation of information, knowledge, facts, concepts or instructions, prepared in a formalised manner and intended to be, being, or already processed in a computer system or network, in any form. An electronic record means data, record or data generated, image or sound stored, received or sent in an electronic form or micro film or computer generated micro fiche. So a company's emails, database entries and scanned files are all electronic records.

The intermediary is the party the Act places many duties on. With respect to any particular electronic record, it means any person who on behalf of another person receives, stores or transmits that record or provides any service with respect to it. The list includes telecom service providers, network service providers, internet service providers, web-hosting service providers, search engines, online payment sites, online-auction sites, online-marketplaces and cyber cafes. Note that an originator or addressee is not an intermediary by definition.

The definitions link IT law to data governance. Section 69B lets the Central Government authorise an agency to monitor and collect traffic data for cyber security, and intermediaries must give technical assistance. The Digital Personal Data Protection Act, 2023 also borrows the IT Act meanings of computer resource, information and intermediary for its blocking power in section 37. If you know the definitions, you can read both Acts.

Key rules to remember

Computer resource: Computer resource = computer + computer system + computer network + data + computer data base + software; Section 2(1)(k). It is the widest term, so use it when a question asks what the Act's powers can reach.
Data: Data = representation of information, knowledge, facts, concepts or instructions, formalised, and intended to be / being / already processed in a computer system or network; Section 2(1)(o). It can be in any form, including printouts, storage media or computer memory.
Electronic record: Electronic record = data, record or generated data, image or sound, stored, received or sent in electronic form or micro film or computer generated micro fiche; Section 2(1)(t). Electronic form is defined in clause (r).
Intermediary: Intermediary = any person who, on behalf of another, receives, stores or transmits a particular electronic record or provides any service with respect to it; Section 2(1)(w). It includes telecom, network, internet and web-hosting service providers, search engines, online payment sites, auction sites, marketplaces and cyber cafes. It is judged record by record.
Cyber security: Cyber security = protecting information, equipment, devices, computer, computer resource, communication device and stored information from unauthorised access, use, disclosure, disruption, modification or destruction; Section 2(1)(nb). Note the six harms listed.
Originator and addressee: Originator sends or causes to be sent; addressee is intended to receive; neither includes an intermediary; Section 2(1)(za) and (b).
Section 69B intermediary penalty: Intentional or knowing contravention of s 69B(2): imprisonment up to one year, or fine up to ₹1 crore, or both; As amended by Act 18 of 2023, effective 30-11-2023. Earlier text had up to three years and a fine.

How to solve Information Technology Act, 2000: Overview questions

Use this method for any question on the scope, objectives or definitions of the IT Act, 2000. Descriptive answers earn marks for the provision, the application and the conclusion.

1Read the question and mark the exact term or issue: computer resource, data, electronic record, intermediary or a power such as section 69B.
2Write the definition from section 2(1) in your own words, keeping its key elements in the right order.
3Name the clause only if you are sure, for example 2(1)(k) for computer resource and 2(1)(w) for intermediary.
4Apply the definition to the facts. Tick off each element of the definition against what the case says.
5Check for exclusions, such as the originator and addressee not being intermediaries.
6Link to data governance: mention cyber security, section 69B traffic data monitoring or the DPDP Act, 2023 where the facts invite it.
7Conclude in one clear line: the entity or item does or does not fall under the term, and what duty follows.
8If the question asks for drafting or compliance points, add a short action list, such as a policy or an assistance procedure.

Quickest way: Element tick-list method

When to use it: Use when you have little time and the question asks whether something is a computer resource, electronic record or intermediary.

Write the term and its definition in one sentence.
List the elements as short bullets.
Match each fact in the case to one bullet.
Write a one-line conclusion naming the Act and clause.

Common mistakes in Information Technology Act, 2000: Overview

Treating computer as only a desktop or laptop.
Everyday use of the word is narrow.
Fix: Quote the definition: any electronic, magnetic, optical or other high-speed data processing device or system, including connected input, output, storage, software or communication facilities.
Confusing computer resource with computer.
The two words look alike.
Fix: Remember that computer resource also covers computer system, network, data, data base and software, so it is wider.
Saying every user or sender of data is an intermediary.
Students focus on the word transmits.
Fix: An intermediary acts on behalf of another person for a particular record. The originator and the addressee are expressly not intermediaries.
Writing the old section 69B penalty of three years and fine.
Older notes and bare Acts still show the earlier text.
Fix: State the current text: imprisonment up to one year, or fine up to ₹1 crore, or both, after Act 18 of 2023.
Mixing up data, information and electronic record.
They overlap in daily speech.
Fix: Data is the formalised representation processed in a computer. Information is defined as including data, message, text, images, sound, voice, codes, software and data bases. An electronic record is data or a record in electronic form.
Leaving out the link to data governance in a case-based answer.
Students stop after reciting definitions.
Fix: Add one or two lines on how the definition decides a duty, for example technical assistance to an authorised agency.

Worked examples

Example 1

Nivaan Cloud Services Pvt Ltd provides web hosting to Kaveri Textiles Ltd and stores its customer files on its servers. A government agency authorised under section 69B asks Nivaan for technical assistance. Is Nivaan an intermediary, and what follows?

Show the solution

Provision: under section 2(1)(w), an intermediary is any person who on behalf of another person receives, stores or transmits an electronic record or provides any service with respect to it. The list includes web-hosting service providers.
Analysis: Nivaan stores Kaveri's customer files on its servers on Kaveri's behalf. It is a web-hosting service provider.
Section 69B(2) requires an intermediary or person in charge of the computer resource, when called upon by the authorised agency, to provide technical assistance and extend all facilities for online access to the computer resource holding the traffic data or information.
Consequence: if Nivaan intentionally or knowingly fails to comply, section 69B(4) provides imprisonment up to one year, or a fine up to ₹1 crore, or both.
Practical point: Nivaan should have a documented procedure for handling such requests and should verify that the agency is authorised by Gazette notification.

Answer: Yes. Nivaan is an intermediary as a web-hosting service provider. It must give technical assistance to the authorised agency under section 69B(2), and intentional or knowing default can attract up to one year's imprisonment, a fine up to ₹1 crore, or both.

Example 2

Explain whether the following are covered by computer resource under the IT Act, 2000: (a) a company's accounting software, (b) its customer database, (c) its office network. Also state why a printed copy of the database is still relevant to the definition of data.

Show the solution

Provision: section 2(1)(k) defines computer resource as computer, computer system, computer network, data, computer data base or software.
(a) Accounting software is software, so it is a computer resource.
(b) The customer database is a computer data base, and the entries are data, so it is a computer resource.
(c) The office network is a computer network, meaning the interconnection of computers, computer systems or communication devices through satellite, microwave, terrestrial line, wire, wireless or other media. It is a computer resource.
Printed copy: the definition of data in section 2(1)(o) says it may be in any form, including computer printouts, if it has been prepared in a formalised manner and is intended to be processed, is being processed or has been processed in a computer system or network.
Conclusion: all three items are computer resources, and a printout of data processed in a computer system still counts as data.

Answer: All three, namely the software, the database and the network, are computer resources under section 2(1)(k). A printout of processed data is still data because the definition covers data in any form, including computer printouts.

Exam tips

Learn the definitions of computer resource, data, electronic record and intermediary almost word for word. Examiners reward accuracy of elements.
In case-based questions, name the party first (originator, addressee or intermediary) and then state the duty that follows.
Quote section 69B(4) in its current form: up to one year, or fine up to ₹1 crore, or both.
Connect the IT Act to the DPDP Act, 2023: its section 37 borrows the IT Act meanings of computer resource, information and intermediary.
Do not quote a section number you are unsure of. Describe the rule in plain words instead.

Practice questions from Data Governance

Information Technology Act, 2000: Overview in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Information Technology Act, 2000: Overview: frequently asked questions

What is the main purpose of the IT Act, 2000?

It provides the legal framework for electronic records, electronic signatures, cyber security and the handling of electronic information in India. In your answer, tie the purpose to its definitions and to powers such as monitoring traffic data for cyber security.

Where are the key definitions in the IT Act, 2000?

They are in section 2(1). Computer resource is in clause (k), data in clause (o), electronic record in clause (t), and intermediary in clause (w).

Who is an intermediary under the IT Act?

It is any person who, on behalf of another, receives, stores or transmits a particular electronic record or provides a service with respect to it. It includes telecom, network, internet and web-hosting service providers, search engines, online payment and auction sites, online marketplaces and cyber cafes. The originator and addressee are not intermediaries.

Is data the same as an electronic record?

No. Data is a formalised representation of information processed or intended to be processed in a computer system or network. An electronic record is data, a record or generated data, image or sound stored, received or sent in electronic form or micro film. Data can be a part of an electronic record.