Internal and Forensic Audit · Cyber Forensics

Section 69B IT Act: Monitoring and Collection of Traffic Data

Updated 11 October 2026 · Fact-checked

Section 69B of the IT Act, 2000 lets the Central Government, by Gazette notification, authorise a Government agency to monitor and collect traffic data or information in any computer resource. The purpose is cyber security: identifying, analysing and preventing intrusion or spread of computer contaminants. Intermediaries must give technical assistance, or face penalty.

Understand Monitoring and Collection of Traffic Data (Section 69B)

Start with the idea of traffic data. It is not the content of a message. It is the data about the communication: who or what it came from, where it went, the route, time, size, duration and type of service. Think of the envelope, not the letter.

Section 69B gives the Central Government a power to enhance cyber security. By notification in the Official Gazette, it may authorise any agency of the Government to monitor and collect traffic data or information generated, transmitted, received or stored in any computer resource. The stated aim is the identification, analysis and prevention of intrusion or spread of a computer contaminant in the country. Computer contaminant has the meaning given in section 43.

The agency cannot do this alone. Under sub-section (2), the intermediary or any person in charge of the computer resource must, when called upon by the authorised agency, provide technical assistance and extend all facilities. This is to enable online access, or to secure and provide online access, to the computer resource that generates, transmits, receives or stores the data.

The procedure and safeguards are not in the section itself. Sub-section (3) says they shall be as prescribed, so a good answer notes that the power is subject to prescribed safeguards. Sub-section (4) is the penalty: an intermediary who intentionally or knowingly contravenes sub-section (2) faces imprisonment up to one year, or fine up to one crore rupees, or both. This wording was substituted by Act 18 of 2023 with effect from 30-11-2023 for the earlier three years and fine.

For the Cyber Forensics chapter, link this to investigation. Traffic data helps trace the origin, route and timing of an attack, which is the starting point of many forensic reviews.

Key rules to remember

Who acts and how: Central Government → notification in Official Gazette → authorises any agency of the Government; Section 69B(1). The authority is the Central Government only, not a State Government.
Purpose: Enhance cyber security + identify, analyse and prevent intrusion or spread of computer contaminant; Section 69B(1). This is the only stated ground, unlike section 69.
What can be monitored and collected: Traffic data or information generated, transmitted, received or stored in any computer resource; Traffic data includes origin, destination, route, time, data, size, duration or type of underlying service and any other information.
Duty of intermediary: On being called upon: provide technical assistance + extend all facilities to enable online access; Section 69B(2). Applies to the intermediary or any person in charge of the computer resource.
Procedure and safeguards: As may be prescribed; Section 69B(3).
Penalty: Intentional or knowing contravention of s 69B(2) by an intermediary: imprisonment up to 1 year, or fine up to ₹1 crore, or both; Section 69B(4), as substituted by Act 18 of 2023 w.e.f. 30-11-2023.
Section 69 vs 69B: 69: interception, monitoring, decryption of information, up to 7 years + fine. 69B: traffic data for cyber security, up to 1 year or fine or both; Section 69 covers content and several grounds. Section 69B covers traffic data and one purpose.

How to solve Monitoring and Collection of Traffic Data (Section 69B) questions

Use this order for any question on section 69B, whether theory, comparison or a short case.

1Identify the act in the facts: is it monitoring or collection of traffic data, or interception or decryption of content, or blocking?
2State the provision: Central Government, notification in the Official Gazette, authorised Government agency, purpose of cyber security.
3Define traffic data in your own words and list its parts: origin, destination, route, time, size, duration, type of service.
4Check whether the agency is authorised by notification and has called upon the intermediary or person in charge of the computer resource.
5Apply sub-section (2): did the intermediary give technical assistance and all facilities? Check whether any refusal was intentional or knowing.
6Conclude on the penalty under sub-section (4): imprisonment up to one year, or fine up to ₹1 crore, or both.
7Add the safeguard point: procedure and safeguards are as prescribed under sub-section (3).
8If the question asks for a comparison, contrast with section 69 on authority, purpose, subject matter and penalty.

Quickest way: Five-point 69B checklist

When to use it: Use when you have little time or the question is a short note or a comparison.

Who: Central Government, by Gazette notification, authorises a Government agency.
What: monitor and collect traffic data, meaning data about the communication.
Why: cyber security, to identify, analyse and prevent intrusion or computer contaminant spread.
Duty: intermediary or person in charge gives technical assistance and facilities.
Penalty: up to one year, or fine up to ₹1 crore, or both, for intentional or knowing default.

Common mistakes in Monitoring and Collection of Traffic Data (Section 69B)

Saying section 69B allows interception or decryption of message content.
Students blend sections 69 and 69B because both deal with monitoring.
Fix: Remember 69B covers traffic data for cyber security. Interception, monitoring and decryption of information is section 69.
Writing that a State Government can authorise an agency under 69B.
Section 69 mentions the State Government, and students carry that over.
Fix: Section 69B(1) names only the Central Government.
Quoting the old penalty of three years and fine.
Older notes still show the pre-2023 wording.
Fix: Use the current wording: imprisonment up to one year, or fine up to one crore rupees, or both, with effect from 30-11-2023.
Saying the penalty applies to any person who refuses help.
Students read sub-section (2) and ignore sub-section (4).
Fix: Sub-section (4) penalises an intermediary who intentionally or knowingly contravenes sub-section (2). Mention both the intermediary and the mental element.
Listing many grounds such as public order and defence of India.
These grounds belong to sections 69 and 69A.
Fix: For 69B, the purpose is cyber security: intrusion or spread of computer contaminant.
Omitting the Gazette notification and prescribed safeguards.
Students focus on the power and forget the conditions.
Fix: Always state that authorisation is by notification and the procedure and safeguards are as prescribed.

Worked examples

Example 1

Distinguish between section 69 and section 69B of the Information Technology Act, 2000.

Show the solution

Subject matter: section 69 deals with interception, monitoring or decryption of any information in a computer resource. Section 69B deals with monitoring and collecting traffic data or information.
Authority: section 69 is exercised by the Central Government or a State Government, or officers specially authorised by them. Section 69B is exercised by the Central Government, which authorises a Government agency by notification.
Grounds or purpose: section 69 applies for sovereignty or integrity of India, defence, security of the State, friendly relations with foreign States, public order, preventing incitement to a cognizable offence relating to these, or investigation of any offence, with reasons recorded in writing. Section 69B has one purpose: cyber security, meaning identification, analysis and prevention of intrusion or spread of computer contaminant.
Duty to assist: under section 69(3), the subscriber, intermediary or person in charge must extend all facilities and technical assistance. Under section 69B(2), the intermediary or person in charge must provide technical assistance and facilities for online access.
Penalty: failure to assist under section 69 is punishable with imprisonment up to seven years and fine. Contravention of section 69B(2) by an intermediary is punishable with imprisonment up to one year, or fine up to ₹1 crore, or both.
Safeguards: both sections leave the procedure and safeguards to be prescribed.

Answer: Section 69 is a wider interception and decryption power on several public interest grounds, with a penalty up to seven years and fine. Section 69B is a narrower power to monitor and collect traffic data for cyber security, with a penalty up to one year, or fine up to ₹1 crore, or both.

Example 2

The Central Government notifies a Government agency under section 69B to track a malware outbreak. The agency asks Nimbus Hosting Pvt Ltd, an intermediary, for technical assistance to access its servers carrying the traffic. Nimbus knowingly refuses. Advise on the legal position.

Show the solution

Provision: section 69B(1) allows the Central Government, by Gazette notification, to authorise any Government agency to monitor and collect traffic data in any computer resource to enhance cyber security and prevent spread of a computer contaminant.
Facts: the agency is notified, and the purpose is tracking a malware outbreak, which is a computer contaminant issue. The power is validly used, assuming the notification and prescribed safeguards are followed.
Duty: under section 69B(2), Nimbus, as an intermediary, must provide technical assistance and extend all facilities when called upon, to enable online access to the computer resource.
Breach: Nimbus refused knowingly. Section 69B(4) applies to an intermediary who intentionally or knowingly contravenes sub-section (2).
Consequence: imprisonment up to one year, or fine up to one crore rupees, or both.

Answer: Nimbus Hosting has contravened section 69B(2) and is liable under section 69B(4) to imprisonment up to one year, or fine up to ₹1 crore, or both. Its refusal cannot be justified, provided the agency was notified and the prescribed safeguards were observed.

Exam tips

Write the section number with each sub-section you cite: 69B(1) power, (2) duty, (3) safeguards, (4) penalty.
Keep a ready comparison of 69, 69A and 69B. Examiners like contrast questions on authority, purpose and penalty.
In case-based questions, follow the order: provision, analysis of facts, conclusion. Check notification, purpose, request and intent.
Define traffic data with examples such as origin, destination, route and time. It earns easy marks.
Quote the penalty as it stands after 30-11-2023, and say it is for an intermediary.

Practice questions from Cyber Forensics

Monitoring and Collection of Traffic Data (Section 69B) in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

CMA FinalMonitoring of Traffic Data and Cyber Security (Section 69B)

Monitoring and Collection of Traffic Data (Section 69B): frequently asked questions

What is traffic data under section 69B?

It means any data identifying or purporting to identify any person, computer system, network or location to or from which a communication is or may be transmitted. It includes origin, destination, route, time, data, size, duration or type of underlying service and any other information.

What is the difference between section 69 and section 69B?

Section 69 allows interception, monitoring or decryption of information on public interest grounds, by the Central or a State Government. Section 69B allows the Central Government to authorise an agency to monitor and collect traffic data for cyber security only. The penalties also differ: up to seven years and fine under 69, and up to one year or fine up to ₹1 crore or both under 69B.

What is the penalty under section 69B?

An intermediary who intentionally or knowingly contravenes section 69B(2) is punishable with imprisonment up to one year, or fine up to one crore rupees, or both. This wording came in by Act 18 of 2023 with effect from 30-11-2023.

Who can be asked to help the agency under section 69B?

The intermediary or any person in charge of the computer resource must provide technical assistance and extend all facilities when called upon by the authorised agency. The penalty in sub-section (4) is aimed at intermediaries.