Environmental, Social and Governance (ESG) - Principles and Practice · Data Governance

Section 69B IT Act: Monitoring and Collection of Traffic Data

Updated 11 October 2026 · Fact-checked

Section 69B of the IT Act, 2000 lets the Central Government, by gazette notification, authorise a Government agency to monitor and collect traffic data or information in any computer resource, to enhance cyber security and to identify, analyse and prevent intrusion or spread of computer contaminant. Intermediaries must assist. Non-compliance is punishable.

Understand Monitoring and Collection of Traffic Data (Section 69B)

Every online communication leaves a trail. That trail shows who talked to whom, from where, when and for how long, without showing the message itself. The Act calls this traffic data. Section 69B deals with collecting and watching this trail for one purpose: cyber security.

Under section 69B(1), the Central Government may, by notification in the Official Gazette, authorise any agency of the Government to monitor and collect traffic data or information generated, transmitted, received or stored in any computer resource. The stated aim is to enhance cyber security and to identify, analyse and prevent intrusion or spread of computer contaminant in the country. Computer contaminant has the meaning given in section 43.

The Act defines traffic data as any data identifying or purporting to identify any person, computer system, computer network or location to or from which a communication is or may be transmitted. It includes the communication's origin, destination, route, time, data, size, duration or type of underlying service, and any other information.

Section 69B(2) puts a duty on the intermediary or any person in charge of the computer resource. When the authorised agency calls upon them, they must provide technical assistance and extend all facilities so that the agency gets online access, or can secure and provide online access, to the computer resource handling that data. Section 69B(3) says the procedure and safeguards will be as prescribed. Section 87(2)(za) confirms the Central Government's rule-making power for this.

Section 69B(4) punishes an intermediary who intentionally or knowingly contravenes sub-section (2): imprisonment up to one year, or fine up to one crore rupees, or both. Since the 2023 amendment, the earlier term of three years and compulsory fine no longer applies.

For governance, this matters because companies that run networks, platforms or hosting services may be intermediaries. They need a process to respond to a lawful request, and must not confuse this section with sections 69 and 69A.

Key rules to remember

Who may authorise: Central Government, by notification in the Official Gazette → authorises any agency of the Government; Section 69B(1). The agency is authorised by notification, not by a private request.
Purpose: Enhance cyber security + identify, analyse and prevent intrusion or spread of computer contaminant; The power is limited to cyber security. Do not add sovereignty or public order grounds; those belong to sections 69 and 69A.
Subject matter: Traffic data or information generated, transmitted, received or stored in any computer resource; Traffic data covers origin, destination, route, time, data, size, duration, type of underlying service and other information.
Duty of intermediary: On being called upon: provide technical assistance + extend all facilities for online access; Section 69B(2). Applies to the intermediary or any person in charge of the computer resource.
Procedure and safeguards: Such as may be prescribed; Section 69B(3); rule-making power in section 87(2)(za).
Penalty: Intermediary who intentionally or knowingly contravenes s.69B(2): imprisonment up to 1 year, or fine up to ₹1 crore, or both; Section 69B(4). Substituted by Act 18 of 2023 with effect from 30-11-2023.

How to solve Monitoring and Collection of Traffic Data (Section 69B) questions

Use this sequence for any case-based question on section 69B. It keeps you in provision, analysis, conclusion order.

1Identify the issue: is it monitoring or collecting traffic data for cyber security, or something else such as content interception or blocking?
2State the provision: section 69B(1) power of the Central Government to authorise an agency by Gazette notification.
3Check the purpose: cyber security, and identification, analysis and prevention of intrusion or spread of computer contaminant.
4Classify the data: does it identify a person, system, network or location, or show origin, destination, route, time, size, duration or service type? If yes, it is traffic data.
5Apply the duty: was the intermediary or person in charge called upon by the authorised agency? State the duty to give technical assistance and facilities.
6Note the safeguards: procedure and safeguards are as prescribed under section 69B(3).
7Check the contravention: was it intentional or knowing? If yes, apply section 69B(4).
8Conclude clearly with the practical step, such as a compliance protocol or a written response.

Quickest way: Four-point recall for section 69B

When to use it: Use when you have limited time or the question asks for a short note on section 69B.

Who: Central Government authorises a Government agency by notification.
What: monitors and collects traffic data or information in any computer resource.
Why: cyber security and prevention of intrusion or computer contaminant spread.
Duty and penalty: intermediary assists; knowing contravention means up to one year, or fine up to ₹1 crore, or both.

Common mistakes in Monitoring and Collection of Traffic Data (Section 69B)

Mixing section 69B with section 69 (interception, monitoring, decryption).
Both deal with monitoring and sit side by side.
Fix: Section 69B is for traffic data and cyber security. Section 69 covers interception, monitoring or decryption of information for grounds like sovereignty, public order or investigation, by recorded written order.
Quoting the old penalty of three years and fine.
Older notes and books show the earlier text.
Fix: The current text reads imprisonment up to one year, or fine up to one crore rupees, or both, from 30-11-2023.
Saying that section 69B covers blocking of websites.
Students link all of sections 69 to 69B with government powers.
Fix: Blocking for public access is section 69A. Section 69B only monitors and collects traffic data.
Treating traffic data as the content of messages.
The word data sounds like content.
Fix: Traffic data is about origin, destination, route, time, size, duration and type of service. Learn the definition in the Explanation.
Saying any officer can order monitoring.
Students overlook the notification requirement.
Fix: The Central Government must authorise an agency by notification in the Official Gazette.
Applying the penalty to every person, or to an innocent delay.
The words of sub-section (4) are skipped.
Fix: Penalty applies to an intermediary who intentionally or knowingly contravenes sub-section (2).

Worked examples

Example 1

Nilgiri Cloud Services Pvt Ltd hosts servers for several clients. A Government agency, authorised by Gazette notification under section 69B, asks Nilgiri's compliance head for online access to traffic data of a server suspected to be spreading malware. The head refuses, saying client confidentiality prevents it. Advise Nilgiri.

Show the solution

Provision: under section 69B(1), the Central Government may authorise a Government agency to monitor and collect traffic data for cyber security, including prevention of spread of computer contaminant.
Facts: the agency is authorised by notification and the purpose is malware spread, which is within cyber security.
Analysis: section 69B(2) requires the intermediary or person in charge of the computer resource, when called upon, to provide technical assistance and extend all facilities to enable online access. Client confidentiality is not an exception in the text.
Safeguards: the procedure and safeguards are as prescribed under section 69B(3). Nilgiri should verify the notification and the agency's request against them before giving access, not simply refuse.
Consequence: if Nilgiri intentionally or knowingly contravenes sub-section (2), section 69B(4) applies: imprisonment up to one year, or fine up to ₹1 crore, or both.

Answer: Nilgiri must cooperate after verifying the notification and the prescribed procedure. Refusal on confidentiality grounds is not supported by section 69B(2), and a knowing refusal can attract punishment under section 69B(4).

Example 2

Write a short note on what counts as traffic data under section 69B and explain how it differs from content.

Show the solution

Definition: traffic data means any data identifying or purporting to identify any person, computer system, computer network or location to or from which a communication is or may be transmitted.
Scope: it includes the communication's origin, destination, route, time, data, size, duration or type of underlying service, and any other information.
Illustration: for an email, the sender and recipient addresses, time sent, route and size are traffic data.
Difference: the Act defines traffic data by reference to identification and transmission details. Interception or decryption of information itself falls under section 69, which needs a recorded written order and prescribed safeguards.
Purpose link: section 69B allows collection of such data only to enhance cyber security.

Answer: Traffic data is the identifying and transmission detail of a communication, such as origin, destination, route, time, size, duration and service type. Section 69B allows its monitoring and collection for cyber security; access to the information itself is dealt with under section 69.

Exam tips

Write the section number and sub-section for each point: 69B(1) power, 69B(2) duty, 69B(3) procedure, 69B(4) penalty.
Quote the definition of traffic data in the Act's own terms, since short notes often ask for it.
In case questions, check first whether the agency is authorised by notification and whether the purpose is cyber security.
Give a practical point in your conclusion: keep a log of requests, verify authority, assign a nodal officer and respond in writing.
Use a brief contrast with sections 69 and 69A to show you know the three provisions apart.

Practice questions from Data Governance

Monitoring and Collection of Traffic Data (Section 69B) in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

CMA FinalMonitoring of Traffic Data and Cyber Security (Section 69B)

Monitoring and Collection of Traffic Data (Section 69B): frequently asked questions

What is section 69B of the IT Act, 2000?

It empowers the Central Government to authorise a Government agency to monitor and collect traffic data or information in any computer resource. The aim is cyber security and prevention of intrusion or spread of computer contaminant. Intermediaries must assist when called upon.

What is the penalty under section 69B?

An intermediary who intentionally or knowingly contravenes the duty to assist is punishable with imprisonment up to one year, or fine up to one crore rupees, or both. This is the text substituted by Act 18 of 2023, effective 30-11-2023.

How is section 69B different from section 69?

Section 69B deals with monitoring and collecting traffic data for cyber security. Section 69 deals with interception, monitoring or decryption of information on stated grounds such as sovereignty, public order or investigation, under a recorded written order. Section 69 also carries a higher penalty of up to seven years plus fine.

Who makes the procedure and safeguards for section 69B?

Section 69B(3) says they will be as prescribed. Section 87(2)(za) gives the Central Government the power to make rules on this.