The Information Technology Act, 2000

What it does

The Act (Act No. 21 of 2000) did three things at the start. It gave electronic records and digital signatures the same legal standing as paper and handwritten signatures, so that a contract or filing could be made electronically. It set up a regime for certifying authorities that issue digital signature certificates. And it created offences connected with computers, such as unauthorised access and tampering with source code.

Over time it became the main statute for conduct online. It contains the offences relating to computer systems and identity, including identity theft and cheating by personation using a computer resource, as well as provisions on obscene material and on interception and blocking of information by the Government. It contains the provision on intermediaries, section 79, which protects an intermediary from liability for third-party content if it observes due diligence and acts on notice, and the rules made under the Act, notably the intermediary rules, say what that due diligence is.

Section 43A, inserted by the Information Technology (Amendment) Act, 2008, makes a body corporate that handles sensitive personal data liable to pay compensation if it is negligent in keeping reasonable security practices. The rules of 2011 made under it set those practices.

Who it binds

Individuals and companies that use computers and communication resources, certifying authorities, intermediaries and the Government. It extends to offences committed outside India that involve a computer or network in India.

What moved out of it

Provisions of the Act inserted section 65B into the Indian Evidence Act, 1872, on proof of electronic records by certificate. That law of evidence is now the Bharatiya Sakshya Adhiniyam, 2023, and the firm's notes record that section 63 of it carries forward the certificate requirement.

Section 43A is to go. The Digital Personal Data Protection Act, 2023 will omit it, but the firm's note on artificial intelligence law records that the omission falls in the tranche of that Act that takes effect on 13 May 2027. Until that date the older regime is the operative data security law.

What has changed, and when

The Act came into force on 17 October 2000. It was substantially amended by the Information Technology (Amendment) Act, 2008, in force from 27 October 2009, which added section 43A and the provisions on electronic signature technology, and widened the offences. In Shreya Singhal v. Union of India, decided in 2015, the Supreme Court struck down section 66A, which had made sending offensive messages an offence. The intermediary rules were remade in 2021.

What turns on it in practice

Several practice areas on this site work under the Act. Technology, data and product advisory covers data protection and technology contracting. White-collar and cyber defence deals with cybercrime and digital evidence, where the offences in the Act sit beside the forgery provisions of the Bharatiya Nyaya Sanhita, 2023. The practice on artificial intelligence advises on how the Act and the Digital Personal Data Protection Act, 2023 apply to AI.

Two questions recur. A company that hosts third-party content needs to know whether it keeps its protection under section 79. The firm's note on a deepfake of a chief executive observes that losing that protection creates no new offence but removes a shield, and the ordinary consequences follow. And a company that suffers a security failure today is judged under section 43A and the 2011 rules, not the newer data protection law.