The Information Technology Act, 2000 Explained

The Information Technology Act, 2000 (IT Act) is India’s primary cyber law, a central statute that gives legal recognition to electronic records and digital signatures and defines offences committed through computers and networks. Enacted by Parliament in 2000 and brought into force on 17 October 2000, the Information Technology Act is administered by the Ministry of Electronics and Information Technology (MeitY) and forms the legal base for e-commerce, e-governance and cybercrime law in the country.

The Information Technology Act was modelled on the UNCITRAL Model Law on Electronic Commerce, adopted by the United Nations in 1996, and was substantially rewritten by the Information Technology (Amendment) Act, 2008. This explainer covers what the Act does, which acts it makes punishable, how Section 66A was struck down, how interception and blocking powers work, and where intermediaries and CERT-In fit in. Last reviewed: 9 October 2026.

Key Takeaways

• The Information Technology Act, 2000 is India’s main law on cyber activity, covering electronic records, digital signatures, cybercrime, intermediaries and cyber security.
• The Information Technology Act was based on the UNCITRAL Model Law on Electronic Commerce (1996) and came into force on 17 October 2000.
• Section 66F of the Information Technology Act punishes cyber terrorism with imprisonment that may extend to life.
• The Supreme Court struck down Section 66A of the Information Technology Act as unconstitutional in Shreya Singhal v. Union of India, decided on 24 March 2015.
• Section 79 of the Information Technology Act gives intermediaries a safe harbour from liability for third-party content, provided they follow due diligence under the IT Rules.
• CERT-In, the national agency under Section 70B of the Information Technology Act, handles cyber incident response and issues security directions.

What is the Information Technology Act, 2000?

The Information Technology Act, 2000 is the Indian statute that regulates electronic commerce, electronic governance and offences committed through computer systems. It was India’s first comprehensive law of the digital age and remains the central cyber law, even though newer laws now cover data protection, criminal procedure and telecommunications.

The Act has several declared purposes. It grants legal recognition to transactions carried out through electronic data interchange and other electronic means of communication. It facilitates the electronic filing of documents with government agencies. It also amends older laws, including the Indian Penal Code, the Indian Evidence Act, 1872, the Bankers’ Books Evidence Act, 1891 and the Reserve Bank of India Act, 1934, so that electronic records could be accepted in banking, evidence and criminal law.

The Act extends to the whole of India and, under Section 75, also applies to an offence or contravention committed outside India by any person if the act involves a computer, computer system or network located in India.

Why was the Information Technology Act passed?

The Information Technology Act was passed because the growth of the internet and electronic commerce in the late 1990s exposed a gap: Indian law did not recognise electronic contracts, records or signatures as valid. Businesses and banks needed certainty that an electronic document could carry the same weight as paper.

In 1997 the United Nations General Assembly recommended that member states give favourable consideration to the UNCITRAL Model Law on Electronic Commerce, adopted in 1996 by the United Nations Commission on International Trade Law. India, as a signatory, drafted the Information Technology Bill on that model. The first draft emphasised e-commerce; cybercrime provisions were added as lawmakers recognised that misuse of computers needed a criminal framework.

The Act therefore rests on two pillars. The first is enabling: it makes electronic records, electronic signatures and online contracts legally valid. The second is protective: it penalises unauthorised access, data damage, fraud and the publication of unlawful content.

What does the Act say about electronic records and digital signatures?

The Information Technology Act says that a legal requirement for information to be in writing, or for a document to be signed, is satisfied if the information is in electronic form and, where relevant, carries an electronic signature. Section 4 gives legal recognition to electronic records, and Section 5 gives legal recognition to electronic signatures.

The original Act spoke of digital signatures, which use asymmetric cryptography with a public and private key pair. The 2008 amendment made the law technology-neutral by adding the broader term electronic signature, so that other reliable authentication methods could be notified in a Schedule. Electronic authentication using Aadhaar-based e-KYC was later added through the Second Schedule.

Certifying Authorities and the CCA

The Controller of Certifying Authorities (CCA), appointed under Section 17, licenses and supervises the Certifying Authorities that issue digital signature certificates. The CCA also operates the Root Certifying Authority of India, which anchors the chain of trust for these certificates.

Other enabling provisions

• Section 6A allows government service delivery through authorised service providers.
• Section 10A confirms that contracts formed through electronic means are not invalid merely because they are electronic.
• Sections 6 and 7 permit filing, issue and retention of documents in electronic form.
• Section 65B of the Indian Evidence Act, inserted through the IT Act framework, set the conditions for electronic records to be admitted as evidence; the same idea now continues in the Bharatiya Sakshya Adhiniyam, 2023.

What offences does the Information Technology Act punish?

The Information Technology Act punishes a range of computer-related acts, from unauthorised access and data theft to identity theft, cyber terrorism and publishing obscene or sexually explicit material online. Chapter IX covers civil contraventions and compensation, while Chapter XI lists criminal offences.

Section 43 deals with the civil side. Anyone who accesses a computer without permission, introduces a virus, damages data or denies access to an authorised user is liable to pay compensation to the affected person. Section 66 makes the same acts criminal when done dishonestly or fraudulently, with imprisonment of up to three years, a fine, or both.

Sections 84B and 84C additionally punish abetment of and attempts to commit these offences. Under Section 85, when a company commits an offence, those in charge of its business at the time can also be held responsible unless they prove lack of knowledge or due diligence.

What is cyber terrorism under Section 66F?

Cyber terrorism under Section 66F is the act of threatening the unity, integrity, security or sovereignty of India, or striking terror in the people, by denying access to a computer resource, attempting unauthorised access, or introducing a computer contaminant that causes or is likely to cause death, injury, damage to property or disruption of essential services.

Section 66F also covers unauthorised access to restricted information, data or a computer database that is protected for the security of the State or foreign relations, when done with the belief that the information may be used to harm India’s interests. The punishment is imprisonment that may extend to life, the harshest penalty in the Act.

Alongside Section 66F, Section 70 allows the government to declare a computer resource a protected system, and unauthorised access to such a system is punishable with imprisonment of up to ten years. Section 70A created the National Critical Information Infrastructure Protection Centre (NCIIPC) as the nodal agency for critical information infrastructure such as power, banking, telecom and transport networks.

What happened to Section 66A of the Information Technology Act?

Section 66A of the Information Technology Act, which punished sending offensive or menacing messages through a computer or communication device, was struck down by the Supreme Court of India as unconstitutional on 24 March 2015. The ruling came in Shreya Singhal v. Union of India, decided by a bench of Justices J. Chelameswar and R. F. Nariman.

Section 66A was inserted by the 2008 amendment and used terms such as “grossly offensive”, “annoyance” and “inconvenience” that were not defined. Critics argued that it allowed arrests for ordinary online comments. The petition, filed by law student Shreya Singhal, followed several widely reported arrests over social media posts.

What the Court decided

• Section 66A violated the freedom of speech and expression under Article 19(1)(a) of the Constitution and was not saved by the reasonable restrictions of Article 19(2), because it was vague and covered speech that did not amount to incitement.
• Section 69A, the blocking power, was upheld because it has procedural safeguards, including written reasons and a review committee.
• Section 79 was read down so that an intermediary needs “actual knowledge”, meaning a court order or a government notification, before it must remove content.
• The Court drew a distinction between discussion, advocacy and incitement, and held that only incitement can be restricted.

The judgment is widely regarded as a landmark in Indian free speech law. The Supreme Court has since expressed concern when police continued to cite the struck-down provision in complaints.

How do interception and blocking work under Section 69?

Under Section 69 of the Information Technology Act, the Central or a State Government may direct any agency to intercept, monitor or decrypt information in a computer resource when it is necessary in the interest of sovereignty, integrity, defence, security of the State, friendly relations with foreign states, public order, or to prevent incitement to an offence or to investigate an offence. The directions must be recorded in writing with reasons.

The procedure and safeguards are in the Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009. Orders must come from the competent authority, which is the Union Home Secretary or the State Home Secretary, and are examined by a review committee. A person who refuses to assist an authorised agency can face imprisonment.

Section 69A is a separate power to block public access to information. The Information Technology (Procedure and Safeguards for Blocking for Access of Information by Public) Rules, 2009 set up a designated officer and a committee to examine blocking requests, with a hearing for the originator or intermediary in non-emergency cases. Section 69B covers monitoring and collection of traffic data for cyber security.

What is intermediary safe harbour under Section 79?

Intermediary safe harbour under Section 79 is the protection that exempts an intermediary, such as an internet service provider, search engine, social media platform or marketplace, from liability for third-party content hosted or transmitted on its platform, provided it observes due diligence and does not initiate, select or modify the content.

This protection is conditional. The intermediary loses it if it conspires in an unlawful act, or if it fails to remove or disable access to unlawful material after receiving actual knowledge through a court order or a notification from the appropriate government. The principle lets platforms operate at scale without being treated as the publisher of every post.

The IT Rules

The due diligence conditions are set out in rules made under the Act. The Information Technology (Intermediaries Guidelines) Rules, 2011 were replaced in February 2021 by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, often called the IT Rules, 2021.

• All intermediaries must publish rules and privacy policies and tell users not to post prohibited content.
• Platforms must appoint a grievance officer and acknowledge complaints within a stipulated period.
• Significant social media intermediaries, defined by a user-number threshold, must appoint a chief compliance officer, a nodal contact person and a resident grievance officer in India.
• Messaging services that offer such features must enable identification of the first originator of certain information on lawful orders, a provision that has been challenged in court.
• Publishers of online news and curated content are covered by a three-tier grievance mechanism under the Digital Media Ethics Code.

Who adjudicates disputes and appeals under the Act?

Disputes over civil contraventions under the Information Technology Act are decided by an Adjudicating Officer appointed under Section 46, usually the secretary of the information technology department in a state, who decides claims for compensation within a specified monetary limit. Larger claims go to a civil court.

Appeals from the Adjudicating Officer originally went to the Cyber Appellate Tribunal (CAT) established under Section 48. In 2017 the CAT was merged into the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), which now hears these appeals, and further appeals lie to the High Court.

Criminal offences are investigated by police officers not below the rank of Inspector, under Section 78, and tried by regular courts. Many offences under the Act are cognizable and bailable, although the more serious ones are non-bailable.

What is CERT-In and what does it do?

CERT-In, the Indian Computer Emergency Response Team, is the national agency designated under Section 70B of the Information Technology Act to respond to cyber security incidents. It functions under MeitY, and it collects, analyses and disseminates information on cyber incidents, issues alerts and advisories, and coordinates response and recovery.

CERT-In began operating in 2004, and the 2008 amendment gave it a statutory footing. Its functions are further defined by the Information Technology (The Indian Computer Emergency Response Team and Manner of Performing Functions and Duties) Rules, 2013.

In April 2022, CERT-In issued directions under Section 70B(6) requiring service providers, intermediaries, data centres and bodies corporate to report specified categories of cyber incidents within six hours and to maintain logs of their systems for 180 days. The directions also require synchronising system clocks with government time sources.

How does the Information Technology Act relate to data protection and newer laws?

The Information Technology Act has been supplemented by newer laws, most notably the Digital Personal Data Protection Act, 2023, which now provides the dedicated framework for personal data. Before that, data protection under the IT Act rested largely on Section 43A and the Reasonable Security Practices and Procedures and Sensitive Personal Data or Information (SPDI) Rules, 2011, which required companies handling sensitive data to maintain reasonable security and pay compensation for negligence.

The Digital Personal Data Protection Act, 2023 amends the IT Act to omit Section 43A, moving personal data duties to the new law. The IT Act continues to govern cybercrime, intermediaries, electronic signatures, and interception and blocking.

Criminal law has also been renewed. The Bharatiya Nyaya Sanhita, 2023 replaced the Indian Penal Code, and many cyber-enabled offences such as cheating and defamation are now charged under it, often alongside the IT Act. The ministry has also periodically signalled plans for a new digital law to replace the 2000 Act, but the Act of 2000 remains the operative statute.

What are the main criticisms and challenges?

The main criticisms of the Information Technology Act are that some provisions are broad, that enforcement capacity is limited, and that the law has not kept pace with technology. Rights groups have questioned the breadth of interception and blocking powers, while others point to uneven police training in digital forensics.

• Broad or vague language, as in the case of Section 66A, risks chilling lawful speech.
• Blocking orders are often confidential, which limits public scrutiny.
• Cross-border crime is difficult to investigate because evidence and offenders may sit outside India.
• Emerging issues such as deepfakes, artificial intelligence and large-scale online fraud were not contemplated when the Act was drafted.
• Low conviction rates and delays make deterrence uneven.

Bottom Line

The Information Technology Act, 2000 is the foundation of India’s digital legal order: it makes electronic records and signatures valid, defines cyber offences from identity theft to cyber terrorism, and sets conditions for intermediary liability and state powers. Its most significant judicial test, Shreya Singhal, trimmed the law to protect free speech, and newer statutes now share the field while the Act remains central.

Frequently Asked Questions

What is the Information Technology Act, 2000?

The Information Technology Act, 2000 is India’s primary law on electronic commerce and cybercrime. It gives legal recognition to electronic records and digital signatures, defines offences such as hacking and identity theft, and regulates intermediaries. It came into force on 17 October 2000 and is administered by MeitY.

Why was Section 66A of the IT Act struck down?

Section 66A was struck down because the Supreme Court found it vague and an unreasonable restriction on free speech under Article 19(1)(a). The Court decided Shreya Singhal v. Union of India on 24 March 2015. Terms like “annoyance” and “inconvenience” were undefined, and the provision could punish speech that was not incitement.

What is the punishment for cyber terrorism in India?

Cyber terrorism under Section 66F of the IT Act is punishable with imprisonment that may extend to life. The offence covers acts that threaten India’s unity, integrity, security or sovereignty, or strike terror, by attacking computer resources or accessing restricted information. It is the most severe penalty in the Act.

What is the safe harbour provision in the IT Act?

Safe harbour under Section 79 protects intermediaries from liability for content posted by third parties. The protection applies only if the intermediary does not initiate or modify the content and follows due diligence under the IT Rules. It is lost if the intermediary does not act on a court order or government notification to remove unlawful content.

What does CERT-In do?

CERT-In is India’s national agency for responding to cyber security incidents, set up under Section 70B of the IT Act. It issues alerts, advisories and directions and coordinates incident response. Its 2022 directions require covered entities to report specified incidents within six hours.

Can the government intercept or block online content under the IT Act?

Yes, the government can intercept information under Section 69 and block public access to content under Section 69A, but only on specified grounds and through prescribed procedures. These include written reasons, review committees and rules framed in 2009. The Supreme Court upheld Section 69A in Shreya Singhal because of these safeguards.

{“@context”:”https://schema.org”,”@graph”:[{“@type”:”FAQPage”,”mainEntity”:[{“@type”:”Question”,”name”:”What is the Information Technology Act, 2000?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”The Information Technology Act, 2000 is India’s primary law on electronic commerce and cybercrime. It gives legal recognition to electronic records and digital signatures, defines offences such as hacking and identity theft, and regulates intermediaries. It came into force on 17 October 2000 and is administered by MeitY.”}},{“@type”:”Question”,”name”:”Why was Section 66A of the IT Act struck down?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”Section 66A was struck down because the Supreme Court found it vague and an unreasonable restriction on free speech under Article 19(1)(a). The Court decided Shreya Singhal v. Union of India on 24 March 2015. Terms like “annoyance” and “inconvenience” were undefined, and the provision could punish speech that was not incitement.”}},{“@type”:”Question”,”name”:”What is the punishment for cyber terrorism in India?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”Cyber terrorism under Section 66F of the IT Act is punishable with imprisonment that may extend to life. The offence covers acts that threaten India’s unity, integrity, security or sovereignty, or strike terror, by attacking computer resources or accessing restricted information. It is the most severe penalty in the Act.”}},{“@type”:”Question”,”name”:”What is the safe harbour provision in the IT Act?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”Safe harbour under Section 79 protects intermediaries from liability for content posted by third parties. The protection applies only if the intermediary does not initiate or modify the content and follows due diligence under the IT Rules. It is lost if the intermediary does not act on a court order or government notification to remove unlawful content.”}},{“@type”:”Question”,”name”:”What does CERT-In do?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”CERT-In is India’s national agency for responding to cyber security incidents, set up under Section 70B of the IT Act. It issues alerts, advisories and directions and coordinates incident response. Its 2022 directions require covered entities to report specified incidents within six hours.”}},{“@type”:”Question”,”name”:”Can the government intercept or block online content under the IT Act?”,”acceptedAnswer”:{“@type”:”Answer”,”text”:”Yes, the government can intercept information under Section 69 and block public access to content under Section 69A, but only on specified grounds and through prescribed procedures. These include written reasons, review committees and rules framed in 2009. The Supreme Court upheld Section 69A in Shreya Singhal because of these safeguards.”}}]}]}