Indian Cyber Law Summaries

Prohibits intentionally concealing, destroying, or altering computer source code used for a computer, computer program, computer system or computer network, when the source code is required to be kept or maintained by law.

This section aims to protect the integrity of software and ensure that critical source code, vital for the functioning and understanding of computer systems, is not maliciously altered or hidden.

Addresses various computer-related offenses if committed dishonestly or fraudulently. This includes unauthorized access, data damage, introducing viruses, etc., as detailed in Section 43.

Section 43 outlines penalties for damage to computer, computer system, etc. This includes unauthorized access, downloading, copying, or extracting data, introducing contaminants or viruses, damaging or disrupting systems, denying access, and other related activities. Section 66 makes these acts criminal if done with fraudulent or dishonest intent.

Criminalizes the fraudulent or dishonest use of another person's electronic signature, password, or any other unique identification feature.

This section specifically targets identity theft in the digital realm, such as stealing someone's digital signature or login credentials, where impersonation can lead to significant financial or reputational harm.

Punishes cheating by personation using any communication device or computer resource.

This targets individuals who impersonate others online (e.g., creating fake social media profiles for fraudulent purposes) to deceive and cheat victims.

Criminalizes capturing, publishing, or transmitting images of a private area of any person without their consent, under circumstances violating their privacy.

This section is crucial for protecting personal privacy against voyeurism and non-consensual image sharing (e.g. upskirting, hidden cameras) in the digital age.

Deals with acts of cyber terrorism, including denying access to authorized persons, unauthorized access to or penetration of a computer resource, or introducing contaminants with intent to threaten national security, unity, integrity, or sovereignty, or to strike terror.

This is a serious offense targeting large-scale attacks that can cripple critical infrastructure or threaten national security.

Punishes the publication or transmission of material which is lascivious or appeals to the prurient interest or if its effect is such as to tend to deprave and corrupt persons.

This section addresses the dissemination of pornographic or obscene content online. It has different penalties for first conviction and subsequent convictions.

Prescribes penalties for unauthorized actions such as accessing, downloading, or damaging computer systems, introducing viruses, or denying access.

This section covers a range of civil wrongs including hacking, virus attacks, data theft, denial of service, and using a computer resource without permission of the owner. Compensation not exceeding one crore rupees to the person so affected.

Specifically punishes publishing or transmitting material containing sexually explicit acts or conduct in electronic form.

This section is more specific than Section 67 and focuses on material depicting sexual acts involving adults.

Punishes publishing, transmitting, or creating material depicting children in sexually explicit acts (Child Pornography). Also covers possession and distribution.

This section imposes stringent penalties for offences related to child pornography and aims to protect children from sexual exploitation online.

Grants powers to the Central or State Government to issue directions for interception, monitoring, or decryption of any information transmitted through any computer resource.

This power can be exercised in the interest of the sovereignty or integrity of India, defense of India, security of the State, friendly relations with foreign States, public order, or for preventing incitement to the commission of any cognizable offence relating to above or for investigation of any offence.

Provides for the declaration of any computer resource which directly or indirectly affects the facility of Critical Information Infrastructure, as a protected system.

Unauthorized access or attempt to access such protected systems is an offense. Critical Information Infrastructure includes facilities like power, telecom, banking, transportation, etc., whose incapacitation would have a debilitating impact on national security, economy, public health or safety.

Punishes any person who, having secured access to any electronic record, book, register, correspondence, information, document or other material without the consent of the person concerned, discloses such material to any other person.

This applies when a person has gained access in pursuance of powers conferred under the IT Act or its rules, and then discloses it without consent, causing wrongful loss or gain.

Provides conditional exemption from liability for intermediaries (like social media platforms, ISPs) for any third-party information, data, or communication link made available or hosted by them.

This "safe harbour" protection is contingent upon the intermediary observing due diligence and obeying government guidelines, including expeditiously removing unlawful content upon receiving actual knowledge or being notified by the appropriate government or its agency.

Although an old law, it is used in cyber porn cases for the sale, distribution, public exhibition, or possession of obscene materials, including in electronic form.

This section is often invoked alongside the IT Act for cases involving pornographic content, especially when commercial distribution is involved.

Criminalizes stalking, including monitoring the use by a woman of the internet, email or any other form of electronic communication.

This section specifically addresses online stalking, persistent following, or attempts to contact a woman despite clear indication of disinterest, causing fear or distress.

General provision for theft, which can be applied to data theft where intangible property like data is stolen with dishonest intention.

While data itself is intangible, its theft can be prosecuted under this section if it involves moving it from someone's possession dishonestly.

Addresses cheating and online fraud where victims are dishonestly induced to deliver property or consent to retention of property.

This is a commonly invoked section for various online financial frauds, scams, and deceptions leading to monetary loss.

Section 465 provides punishment for forgery. Section 468 punishes forgery for the purpose of cheating.

These sections are used in cases involving creation of fake electronic documents, emails, or digital signatures to commit fraud or cause damage.

Defines defamation as making or publishing any imputation concerning any person intending to harm, or knowing or having reason to believe that such imputation will harm, the reputation of such person.

This applies to online defamation through social media, blogs, websites, or emails. Punishment is under Section 500.

Defines criminal intimidation as threatening another with injury to their person, reputation, or property, to cause alarm or to cause them to do any act which they are not legally bound to do, or to omit to do any act which they are legally entitled to do.

This is applicable to cyber threats, online blackmail, and extortion. Punishment is under Section 506.

India’s dedicated law on personal data protection. It applies to the processing of digital personal data within India, and also outside India if related to offering goods or services to individuals in India.

The DPDP Act is built on principles like Lawfulness, Fairness, Transparency, Purpose Limitation, Data Minimisation, Accuracy, Storage Limitation, and Accountability. It establishes the rights of Data Principals (individuals) and the obligations of Data Fiduciaries (entities processing data).

Consent must be free, specific, informed, and unambiguous. Users (Data Principals) have the right to access, correct, erase their data, and nominate someone to exercise these rights in case of death or incapacity.

A key feature is the "Consent Manager" framework, an interoperable platform to help individuals give, manage, and withdraw their consent. Users also have the Right to Grievance Redressal, allowing them to complain to the Data Fiduciary before approaching the Board.

Companies (Data Fiduciaries) must ensure data accuracy, implement security safeguards to prevent breaches, and erase personal data once the purpose for which it was collected is met.

In case of a personal data breach, the company must notify both the Data Protection Board of India and the affected individuals. They are also responsible for the actions of their data processors (third-party vendors). Special, more stringent obligations apply when processing children's data.

Governs the use of Aadhaar numbers and data, with provisions for data security, privacy, and penalties for misuse of Aadhaar details.

The Act criminalizes unauthorized access to the Aadhaar database, disclosure of identity information, and impersonation using Aadhaar.

Allows electronic records (e-mails, logs, CCTV footage, etc.) to be treated as evidence in court proceedings.

Sections 65A and 65B lay down the conditions for the admissibility of electronic evidence, ensuring its authenticity and integrity. A certificate under 65B is often required.

Mandates cybersecurity compliance for companies, especially those handling financial data. May require appointment of cyber risk officers.

The Act includes provisions for maintaining proper books of account in electronic mode, data security, and director responsibilities related to IT governance. Penalties exist for data breaches and non-compliance.

A strategic framework to safeguard Indian cyberspace. It is not a law but a guiding policy.

Promotes creation of a secure cyber ecosystem, awareness, R&D, and incident response through CERT-In. Aims to build capabilities to prevent and respond to cyber threats.

Handles appeals against the orders of adjudicating officers appointed under the IT Act.

CRAT provides a judicial forum for challenging decisions made by adjudicating officers regarding compensation claims for contraventions under the IT Act (e.g., Section 43).

The Indian Computer Emergency Response Team (CERT-In) issues directions mandating organizations to report various types of cybersecurity incidents.

Incidents to be reported include data breaches, DDoS attacks, system compromise, ransomware attacks, botnet activity, unauthorized access to IT systems/data, etc., within a stipulated timeframe (e.g., 6 hours). Non-compliance can lead to penalties.

The National Critical Information Infrastructure Protection Centre (NCIIPC) issues guidelines for the protection of critical infrastructure sectors like power, telecom, transport, banking, etc.

These guidelines aim to enhance the resilience of critical sectors against cyber attacks and ensure their continuous operation.

The Reserve Bank of India issues guidelines and regulations for banking and online transaction security.

Covers KYC norms, fraud reporting mechanisms, security of digital wallets & UPI, mandatory 2FA (two-factor authentication), customer liability limits in case of unauthorized transactions, and cybersecurity preparedness for banks and payment system operators.

Mandates reporting of specified high-value or suspicious digital transactions to the income tax authorities.

This helps in tracking large financial movements and curbing tax evasion or illicit activities conducted through digital channels.

Protects original literary, dramatic, musical, artistic works, films, and sound recordings. Making or distributing unauthorized copies (piracy) online is a criminal offense.

The Act criminalizes the use of infringing copies of computer programs, films, and music. It also criminalizes the circumvention of technical protection measures (like DRM) and tampering with rights management information embedded in digital works. This is the primary law against digital piracy of software, movies, music, etc.

Although an old law, this section (along with IT Act Sec 69) provides powers to the government for lawful interception of messages in specific situations.

These powers are invoked for reasons of public safety, national security, etc., and are subject to procedural safeguards.

Provides rules and regulations to protect online buyers from fraud, unfair trade practices, and deficient services by e-commerce platforms.

Includes provisions for clear display of seller information, country of origin, grievance redressal mechanisms, and rules for flash sales and misleading advertisements.

Involves using electronic communication to bully a person, typically by sending messages of an intimidating or threatening nature, or spreading rumors.

Can be addressed under laws related to criminal intimidation, stalking, defamation, violation of privacy, or transmission of obscene material depending on the nature of bullying.

Distribution of sexually explicit images or videos of individuals without their consent, often by ex-partners.

Covered under laws related to violation of privacy, publishing obscene or sexually explicit material, voyeurism, and outraging modesty of a woman.

Creation and distribution of synthetic media where a person in an existing image or video is replaced with someone else's likeness, often for malicious purposes.

Can involve identity theft, cheating by impersonation, violation of privacy, defamation, or publishing obscene/explicit content, depending on the deepfake's nature and intent.

Involves various fraudulent activities related to online gaming, such as account hijacking, theft of in-game virtual items, or scams related to game currency.

Can be treated as hacking, cheating, or theft depending on the specifics. Some states also have specific gaming laws.

The Dark Web is often used for illicit activities like drug trafficking, arms dealing, sale of stolen data, and child exploitation material. Law enforcement monitors and investigates such activities.

Crimes committed using the Dark Web are prosecuted under relevant laws (e.g., Narcotic Drugs and Psychotropic Substances Act for drug offenses, IT Act for cybercrimes, IPC for various offenses).

Online child sexual abuse and exploitation, including grooming, sextortion, and creation/distribution of Child Sexual Abuse Material (CSAM).

The Protection of Children from Sexual Offences (POCSO) Act, 2012, is the primary law, often used in conjunction with IT Act Section 67B. These laws prescribe stringent punishments.

Prohibits intentionally concealing, destroying, or altering computer source code used for a computer, computer program, computer system or computer network, when the source code is required to be kept or maintained by law.

This section aims to protect the integrity of software and ensure that critical source code, vital for the functioning and understanding of computer systems, is not maliciously altered or hidden.

Addresses various computer-related offenses if committed dishonestly or fraudulently. This includes unauthorized access, data damage, introducing viruses, etc., as detailed in Section 43.

Section 43 outlines penalties for damage to computer, computer system, etc. This includes unauthorized access, downloading, copying, or extracting data, introducing contaminants or viruses, damaging or disrupting systems, denying access, and other related activities. Section 66 makes these acts criminal if done with fraudulent or dishonest intent.

Criminalizes the fraudulent or dishonest use of another person's electronic signature, password, or any other unique identification feature.

This section specifically targets identity theft in the digital realm, such as stealing someone's digital signature or login credentials, where impersonation can lead to significant financial or reputational harm.

Punishes cheating by personation using any communication device or computer resource.

This targets individuals who impersonate others online (e.g., creating fake social media profiles for fraudulent purposes) to deceive and cheat victims.

Criminalizes capturing, publishing, or transmitting images of a private area of any person without their consent, under circumstances violating their privacy.

This section is crucial for protecting personal privacy against voyeurism and non-consensual image sharing (e.g. upskirting, hidden cameras) in the digital age.

Deals with acts of cyber terrorism, including denying access to authorized persons, unauthorized access to or penetration of a computer resource, or introducing contaminants with intent to threaten national security, unity, integrity, or sovereignty, or to strike terror.

This is a serious offense targeting large-scale attacks that can cripple critical infrastructure or threaten national security.

Punishes the publication or transmission of material which is lascivious or appeals to the prurient interest or if its effect is such as to tend to deprave and corrupt persons.

This section addresses the dissemination of pornographic or obscene content online. It has different penalties for first conviction and subsequent convictions.

Prescribes penalties for unauthorized actions such as accessing, downloading, or damaging computer systems, introducing viruses, or denying access.

This section covers a range of civil wrongs including hacking, virus attacks, data theft, denial of service, and using a computer resource without permission of the owner. Compensation not exceeding one crore rupees to the person so affected.

Specifically punishes publishing or transmitting material containing sexually explicit acts or conduct in electronic form.

This section is more specific than Section 67 and focuses on material depicting sexual acts involving adults.

Punishes publishing, transmitting, or creating material depicting children in sexually explicit acts (Child Pornography). Also covers possession and distribution.

This section imposes stringent penalties for offences related to child pornography and aims to protect children from sexual exploitation online.

Grants powers to the Central or State Government to issue directions for interception, monitoring, or decryption of any information transmitted through any computer resource.

This power can be exercised in the interest of the sovereignty or integrity of India, defense of India, security of the State, friendly relations with foreign States, public order, or for preventing incitement to the commission of any cognizable offence relating to above or for investigation of any offence.

Provides for the declaration of any computer resource which directly or indirectly affects the facility of Critical Information Infrastructure, as a protected system.

Unauthorized access or attempt to access such protected systems is an offense. Critical Information Infrastructure includes facilities like power, telecom, banking, transportation, etc., whose incapacitation would have a debilitating impact on national security, economy, public health or safety.

Punishes any person who, having secured access to any electronic record, book, register, correspondence, information, document or other material without the consent of the person concerned, discloses such material to any other person.

This applies when a person has gained access in pursuance of powers conferred under the IT Act or its rules, and then discloses it without consent, causing wrongful loss or gain.

Provides conditional exemption from liability for intermediaries (like social media platforms, ISPs) for any third-party information, data, or communication link made available or hosted by them.

This "safe harbour" protection is contingent upon the intermediary observing due diligence and obeying government guidelines, including expeditiously removing unlawful content upon receiving actual knowledge or being notified by the appropriate government or its agency.

Although an old law, it is used in cyber porn cases for the sale, distribution, public exhibition, or possession of obscene materials, including in electronic form.

This section is often invoked alongside the IT Act for cases involving pornographic content, especially when commercial distribution is involved.

Criminalizes stalking, including monitoring the use by a woman of the internet, email or any other form of electronic communication.

This section specifically addresses online stalking, persistent following, or attempts to contact a woman despite clear indication of disinterest, causing fear or distress.

General provision for theft, which can be applied to data theft where intangible property like data is stolen with dishonest intention.

While data itself is intangible, its theft can be prosecuted under this section if it involves moving it from someone's possession dishonestly.

Addresses cheating and online fraud where victims are dishonestly induced to deliver property or consent to retention of property.

This is a commonly invoked section for various online financial frauds, scams, and deceptions leading to monetary loss.

Section 465 provides punishment for forgery. Section 468 punishes forgery for the purpose of cheating.

These sections are used in cases involving creation of fake electronic documents, emails, or digital signatures to commit fraud or cause damage.

Defines defamation as making or publishing any imputation concerning any person intending to harm, or knowing or having reason to believe that such imputation will harm, the reputation of such person.

This applies to online defamation through social media, blogs, websites, or emails. Punishment is under Section 500.

Defines criminal intimidation as threatening another with injury to their person, reputation, or property, to cause alarm or to cause them to do any act which they are not legally bound to do, or to omit to do any act which they are legally entitled to do.

This is applicable to cyber threats, online blackmail, and extortion. Punishment is under Section 506.