The Information Technology (IT) Act, 2000 is the law that gives legal value to digital records and electronic signatures in India. It is also India’s main law on cybercrime. When you sign a form with a One-Time Password (OTP), accept an app’s terms online or report an online fraud, this is the law that applies.
As a company that builds apps, we deal with the IT Act regularly. In this article, we cover what the Act does, how it has changed since 2000, the common cybercrimes it covers, what it means for businesses and how it relates to the Digital Personal Data Protection (DPDP) Act.
What the IT Act does?
The IT Act has two main purposes.
- The first is to make digital transactions legally valid. Under the Act, an electronic record, such as an email, a PDF or an online agreement, is accepted in the same way as a paper document. An electronic signature is accepted in the same way as a handwritten one. A few documents are excluded and still need the paper process: wills, powers of attorney, trusts and contracts for the sale of property.
- The second is to deal with cybercrime. The Act defines offences such as hacking, identity theft and online cheating, and it sets the punishment for each.
Beyond these two purposes, the Act sets rules for online platforms, gives the government certain powers to block content or intercept information for reasons such as national security, and provides for the Indian Computer Emergency Response Team (CERT-In), the national agency that handles cyber security incidents.
How did the IT Act come about?
Before 2000, Indian law did not clearly recognise electronic documents. An agreement made over email was hard to enforce, and there was no specific law against offences committed using computers. As businesses and government services started moving online, this became a real problem.
The IT Act was passed to solve it. It received the President’s assent on 9 June 2000 and came into force on 17 October 2000. It was based on the Model Law on Electronic Commerce prepared by the United Nations Commission on International Trade Law (UNCITRAL), which helped India’s rules match international practice.
The 2008 amendment in the IT act
By 2008, the internet in India had changed a great deal. Social media, online shopping and online fraud had all grown, and the original Act did not cover many of these situations. Parliament passed the Information Technology (Amendment) Act, 2008, which came into force in October 2009. It is the largest change the Act has had so far. The main changes were:
- “Digital signature” was replaced with the wider term “electronic signature”, which allowed newer methods such as Aadhaar-based eSign.
- New offences were added, including identity theft, cheating by impersonation, violation of privacy and cyber terrorism.
- Section 79 was revised to protect intermediaries, meaning platforms that carry other people’s content, from liability for what their users post, as long as they follow due diligence rules and act on lawful orders to remove content.
- Section 43A was added, making companies liable to pay compensation if poor security leads to a leak of sensitive personal data.
- CERT-In was given a legal role as the national agency for responding to cyber security incidents.
Section 66A and the Shreya Singhal case
One part of the 2008 amendment, Section 66A, made it an offence to send online messages that were “grossly offensive” or caused “annoyance” or “inconvenience”. Because these words were so broad, people were arrested for ordinary social media posts.
In March 2015, in the case of Shreya Singhal v. Union of India, the Supreme Court struck down Section 66A, holding that it violated the right to freedom of speech. In the same judgment, the court made it clear that a platform has to remove content only when it receives a court order or a lawful government notice, not simply because a user complains.
Common cybercrimes under the IT Act
The table below lists situations people commonly face online, the section of the IT Act that applies and the maximum punishment.
| Situation | Offence under the IT Act | Maximum punishment |
|---|---|---|
| Someone logs into your email or social media account and misuses it | Identity theft (Section 66C) | 3 years in prison and a fine of ₹1 lakh |
| A caller pretends to be from your bank and gets you to share an OTP | Cheating by impersonation (Section 66D) | 3 years in prison and a fine of ₹1 lakh |
| Someone dishonestly breaks into a system and steals or destroys data | Computer-related offences (Sections 43 and 66) | Compensation to the victim, plus 3 years in prison, a fine of ₹5 lakh, or both |
| A private photo of a person is captured or shared without consent | Violation of privacy (Section 66E) | 3 years in prison, a fine of ₹2 lakh, or both |
| An employee or service provider leaks your personal details in breach of a contract | Disclosure in breach of a lawful contract (Section 72A) | 3 years in prison, a fine of ₹5 lakh, or both |
| Obscene material is published or shared online (first conviction) | Section 67 | 3 years in prison and a fine of ₹5 lakh |
| An attack on computer systems threatens the security of the country | Cyber terrorism (Section 66F) | Life imprisonment |
The Act also applies to offences committed from outside India, as long as they involve a computer or network located in India.
If you are a victim of cybercrime, call the national cybercrime helpline at 1930 or file a complaint on the National Cyber Crime Reporting Portal. In cases of financial fraud, report it as early as possible, because quick reporting improves the chance of the money being frozen before it is withdrawn.
What the IT Act means for businesses and app builders
If you run a business online, three parts of the Act are the most relevant.
- Online agreements and records: Terms of service, click-to-accept agreements and digital invoices are legally valid under the IT Act. Keep proper records of who accepted what and when, because you may need them as evidence later.
- Hosting user content: If users can post reviews, comments, messages or listings on your platform, you are an intermediary under the Act. To stay protected under Section 79, you must follow the due diligence rules in the IT Rules, 2021. These include publishing clear user terms, appointing a grievance officer and acting on lawful takedown orders. We cover these rules in detail in our next article.
- Security and incident reporting: Directions issued by CERT-In in 2022 require organisations to report certain cyber security incidents within 6 hours of noticing them and to keep system logs for 180 days. Section 43A also requires reasonable security practices for sensitive personal data, such as passwords, financial details and health records, until the DPDP Act fully takes over this area.
For a small team, this mostly comes down to keeping proper logs, writing clear terms and having a plan for what to do if a security incident happens.
IT Act vs DPDP Act
The IT Act and the DPDP Act are separate laws with different purposes, and both apply at the same time.
| Basis | IT Act, 2000 | DPDP Act, 2023 |
|---|---|---|
| Main focus | Digital transactions, cybercrime and online platforms | Personal data of individuals |
| What it covers | Electronic records and signatures, cyber offences, intermediaries, cyber security | Consent, rights of individuals over their data, duties of organisations that handle personal data |
| Who enforces it | Police, courts, adjudicating officers and CERT-In | The Data Protection Board of India |
The two laws overlap only on data protection. For many years, Section 43A of the IT Act and a set of rules from 2011 were the only data protection rules India had, and they were limited in scope. Once the DPDP Act is fully in force, Section 43A will be removed from the IT Act, and personal data protection will be handled entirely under the DPDP Act. You can read more about it in our article on the DPDP Act.
Is the IT Act being replaced?
In 2023, the Ministry of Electronics and Information Technology (MeitY) announced plans for a new law, the Digital India Act, to replace the IT Act with rules suited to today’s internet, including Artificial Intelligence (AI), social media and online safety. At the time of writing, the Digital India Act has not been passed, and the IT Act remains fully in force.
In the meantime, the government keeps the IT Act up to date by amending the rules made under it. For example, an amendment to the IT Rules notified in early 2026 introduced requirements for labelling AI-generated content. For the latest changes, check the notifications on the MeitY website.
Frequently asked questions about the IT Act
Can I be arrested for a social media post under the IT Act?
Not under Section 66A, because the Supreme Court struck it down in 2015. However, some content is still illegal, such as obscene material, child sexual abuse material and threats, and posting it can lead to prosecution under the IT Act and other criminal laws.
Is a WhatsApp message or an email valid evidence in court?
Yes. Electronic records can be used as evidence, as long as they are preserved properly and submitted with the certificate required under the law of evidence.
Does the IT Act apply if the offender is in another country?
Yes, if the offence involves a computer or network located in India. Taking action against someone abroad is harder in practice, so it is important to report the matter quickly.
Does the IT Act still matter now that we have the DPDP Act?
Yes. The DPDP Act deals only with personal data. Electronic signatures, cybercrime, the duties of online platforms and cyber security are all still governed by the IT Act.
Our view
The IT Act is more than 25 years old, and parts of it have not kept pace with technology. Even so, it is still the legal base for digital transactions and cybercrime in India, and it applies to almost every business that operates online.
For people who use the internet, the two most useful things to know are that your digital agreements are legally valid and that you can report cybercrime in 1930. For businesses, the Act asks for clear terms, secure systems and quick action on security incidents and lawful requests. In our experience, these are things every good product should have anyway, so I would treat the IT Act as a baseline for building well rather than a burden.
Official sources
- India Code, the official repository of central laws, for the full text of the Information Technology Act, 2000 and its amendments
- Ministry of Electronics and Information Technology, for the rules made under the Act and the latest notifications
- Indian Computer Emergency Response Team, for security advisories, directions and incident reporting
- National Cyber Crime Reporting Portal, to report online fraud and other cybercrime
- Coverage of the IT Amendment Rules, 2026 on AI-generated content, Hogan Lovells
Please note: this article explains the IT Act in simple terms for general understanding. It is not legal advice. For decisions about your business, please consult a qualified legal professional.