Information Technology Act, 2000

· About Information Technology Act, 2000

Key Takeaways

  • The Information Technology Act, 2000 is India’s core statute for electronic records, e-signatures, cyber offences, intermediary liability, and certain data-security duties, and it remains in force nationwide.[4][11]
  • The Act is enforced by the Central Government through the Ministry of Electronics and Information Technology, with adjudication and appellate functions provided under the Act’s enforcement framework and related rules.[4][11]
  • Section 43A applies to a body corporate that owns, controls, or operates a computer resource and handles sensitive personal data or information; if negligent security causes wrongful loss or wrongful gain, it must pay compensation.[6]
  • Section 72A criminalises disclosure of information in breach of lawful contract, including by a service provider or intermediary, and may result in imprisonment and fine.[7][8]
  • The Act itself has not been replaced by a new general cyber law as of 6 September 2026, but it has been supplemented by later rules, including 2025 and 2026 intermediary-rule amendments, which do not repeal the Act.[1][2][12]
  • A pending Information Technology (Amendment) Bill, 2025 has been introduced in Parliament, but it is only a bill and does not currently change the Act unless enacted and brought into force.[10]

What It Is

The Information Technology Act, 2000 is India’s principal digital-law statute. It covers legal recognition of electronic records and signatures, cybercrime offences, intermediary obligations, and certain civil and criminal consequences for data misuse and confidentiality breaches.[4][11]

The Act was enacted in 2000 and entered into force on 17 October 2000.[14] India Code’s current consolidated version shows the Act as amended through later legislation, including amendments up to 2023, while MeitY’s official page continues to treat it as the governing statute for the sector.[11][14]

A key later development is that the Act’s rulemaking power under section 87 has been used repeatedly to update intermediary obligations. MeitY and government notices show amendments in 2025 and 2026, including the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, notified on 10 February 2026 and effective from 20 February 2026.[1][2][3][12]

The Act’s most compliance-relevant data clauses remain section 43A and section 72A. Section 43A creates a compensation remedy for negligent failure to protect sensitive personal data, and section 72A imposes criminal punishment for unauthorised disclosure in breach of contract.[6][7][8]

Who Must Comply

The Act applies across India, and several provisions have extraterritorial reach where a computer system, computer network, or computer resource located in India is involved.[4][11] That reach matters for foreign cloud providers, platforms, outsourcing vendors, and remote support providers whose systems interact with Indian assets or users.

Section 43A applies to a body corporate that owns, controls, or operates a computer resource and handles sensitive personal data or information.[6] The statutory trigger is negligence in maintaining reasonable security practices and procedures that causes wrongful loss or wrongful gain.[6]

Section 72A can apply to service providers and intermediaries that secure material or information from a user and later disclose it in breach of a lawful contract.[7][8] The provision is not limited to Indian-owned firms if the conduct falls within the Act’s jurisdictional scope.

The Act does not contain a single, modern sector-wide exemption scheme comparable to newer privacy laws. Instead, applicability depends on the specific section, the nature of the actor, and whether the activity falls within the statutory definitions and jurisdictional hooks in the Act and rules.[4][11][14]

Core Requirements

  1. Maintain reasonable security practices: A body corporate handling sensitive personal data or information must implement and maintain reasonable security practices and procedures; negligence that causes wrongful loss or gain creates compensation exposure under section 43A.[6]
  1. Protect contractual confidentiality: Service providers and intermediaries must not disclose user information in breach of a lawful contract; section 72A provides criminal liability for unauthorised disclosure.[7][8]
  1. Preserve electronic record integrity: Organisations relying on the Act must ensure that electronic records, signatures, and related logs are maintained in a way that supports authenticity, integrity, and evidentiary use under the Act’s framework.[4][11]
  1. Follow applicable intermediary rules: Online intermediaries and digital platforms must comply with the current intermediary guidelines and digital media ethics code, including the 2026 amendments where applicable.[1][2][12]
  1. Cooperate with lawful government process: Entities within scope must comply with lawful directions, investigation requirements, and notice-based duties created by the Act and subordinate rules.[4][11]
  1. Implement incident-ready controls: Although the Act does not prescribe a single universal control set, the combination of section 43A liability and modern rules means affected organisations need documented security governance, incident handling, and access controls.[6][11]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | Act enacted | 2000 | The Information Technology Act was enacted as India’s core electronic-transactions and cyber-law statute.[14] | | Act in force | 17 October 2000 | The Act became operational nationwide.[14] | | 2025 intermediary-rule amendment | 22 October 2025 / 15 November 2025 | MeitY notified intermediary-rule changes in 2025, with an effective date reported as 15 November 2025 in commentary on the amendment package.[9][12] | | 2026 intermediary-rule amendment | 10 February 2026 / 20 February 2026 | MeitY notified further amendments on synthetically generated information and content governance, effective from 20 February 2026.[1][2][3] |

Maximum fines and other sanctions

  • Section 43A: civil compensation is payable to the affected person; the statute does not set a fixed cap in the provision itself.[6]
  • Section 72A: imprisonment may extend up to three years and fine may extend up to ₹5 lakh, or both.[7][8]
  • Other sections of the Act create additional cyber-offence penalties, but the amounts vary by offence and are not all tied to personal-data handling.[4][11]

How to Comply

  1. Map data and systems: Identify whether your entity is a body corporate handling sensitive personal data or an intermediary subject to the Act and rules.[6][11]
  1. Adopt a documented security baseline: Use ISO 27001 as the security-management foundation for access control, supplier governance, logging, and incident response, because section 43A liability turns on “reasonable security practices.”[6]
  1. Align cyber risk governance: Map the control environment to NIST CSF 2.0 functions for governance, identify, protect, detect, respond, and recover; that helps operationalise the Act’s vague reasonableness standard.[6]
  1. Add AI and platform governance where relevant: If you operate user-facing digital services, use ISO 42001 to manage synthetic content, model misuse, content provenance, and human oversight, especially under the 2026 intermediary-rule changes.[1][2][3]
  1. Review contracts and notices: Ensure employee, vendor, platform, and customer agreements clearly restrict disclosure of user information and define lawful processing, because section 72A is triggered by disclosure in breach of lawful contract.[7][8]
  1. Build incident response and evidence retention: Maintain forensics-ready logs, breach triage, and legal-hold procedures so you can prove security diligence and investigate alleged unauthorised disclosures.[6][11]
  1. Test compliance on a schedule: Run periodic internal audits, red-team or tabletop exercises, and supplier reviews, then remediate gaps before they become negligence evidence under section 43A.[6]

Related Regulations

  • Digital Personal Data Protection Act, 2023: This is India’s newer general personal-data law and overlaps with the IT Act on security and breach response, but it does not repeal section 43A or section 72A.[14][15]
  • CERT-In Directions (2022 and later practice): These create incident-reporting and log-retention duties that operate alongside the IT Act’s security and enforcement framework.
  • Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended in 2025 and 2026: These are the main operational rules for online intermediaries and digital media services under the IT Act.[1][2][12]
  • Indian Evidence Act / Bharatiya Sakshya framework: Electronic evidence rules interact with the IT Act because record integrity and admissibility depend on technical and procedural controls.
  • Spencer-era and sectoral cybersecurity norms from RBI, SEBI, and telecom regulators: These may impose stricter control and reporting duties for regulated entities, creating layered compliance obligations.

FAQ

Does the IT Act apply to companies outside India?

Yes, if the relevant computer system, computer network, or computer resource is located in India or the conduct otherwise falls within the Act’s jurisdictional scope.[4][11] Foreign cloud, SaaS, outsourcing, and platform providers can therefore face obligations even without a physical office in India.

Does section 43A require a fixed security standard?

No single fixed standard is written into the section itself. The law requires reasonable security practices and procedures, so organisations usually evidence compliance through recognised frameworks, internal policies, vendor controls, and audit trails.[6]

Is section 72A a privacy offence?

It is primarily a confidentiality and unlawful-disclosure offence, but in practice it is highly relevant to privacy programs because it punishes disclosure of information obtained under a lawful contract.[7][8] The provision is often used alongside privacy and cyber controls rather than as a standalone privacy law.

Have the 2025 and 2026 amendments replaced the IT Act?

No. The 2025 and 2026 changes are rule-level amendments under the Act, especially to intermediary governance, not a wholesale replacement of the statute.[1][2][12] The Act itself remains the governing framework unless Parliament enacts and commences a new amending law.

Is the Information Technology (Amendment) Bill, 2025 in force?

No. It has been introduced as a bill, but a bill has no legal effect until enacted and brought into force by notification where required.[10] Compliance teams should treat it as a legislative proposal, not an operative duty.

What should companies document for section 43A?

They should document risk assessments, security controls, access management, vendor due diligence, incident handling, training, and periodic testing. Those records help show that the organisation maintained reasonable security practices if a compensation claim is filed.[6]

Sources

Put it into practice

More compliance guides