A curated selection of the IT Act's most-cited provisions — electronic governance, digital signatures, cybercrime offences, and intermediary liability. Not the complete text; verify against India Code before citing.
Provided for study purposes. Cross-check against the official source (India Code / the relevant government gazette) before citing or relying on this text — amendments and corrections may not be reflected here.
"Computer" means any electronic, magnetic, optical or other high-speed data processing device or system which performs logical, arithmetic and memory functions, and includes all input, output, processing, storage and communication facilities connected to it. "Computer network" means the interconnection of one or more computers or communication devices through satellite, microwave, terrestrial line, wire, wireless or other communication media, and terminals or a complex of terminals. "Electronic record" means data, record or data generated, image or sound stored, received or sent in an electronic form or micro film or computer generated micro fiche. "Intermediary", with respect to any electronic record, means any person who on behalf of another person receives, stores or transmits that record or provides any service with respect to that record, and includes telecom service providers, network service providers, internet service providers, web-hosting service providers, search engines, online payment sites, online auction sites, online market places and cyber cafes.
Subject to the provisions of this section, any subscriber may authenticate an electronic record by affixing their digital signature. The authentication of the electronic record shall be effected by the use of an asymmetric crypto system and hash function which envelop and transform the initial electronic record into another electronic record.
Where any law provides that information or any other matter shall be in writing or in the typewritten or printed form, then, notwithstanding anything contained in such law, such requirement shall be deemed to have been satisfied if such information or matter is rendered or made available in an electronic form and accessible so as to be usable for a subsequent reference.
Where any law provides that information or any other matter shall be authenticated by affixing the signature of any person, then, notwithstanding anything contained in such law, such requirement shall be deemed to have been satisfied if such information or matter is authenticated by means of an electronic signature affixed in such manner as may be prescribed by the Central Government.
Where in a contract formation, the communication of proposals, the acceptance of proposals, the revocation of proposals and acceptances, as the case may be, are expressed in electronic form or by means of an electronic record, such contract shall not be deemed to be unenforceable solely on the ground that such electronic form or means was used for that purpose.
If any person without permission of the owner or any other person who is in charge of a computer, computer system or computer network — accesses or secures access to it; downloads, copies or extracts any data; introduces or causes to be introduced any computer contaminant or virus; damages or disrupts it; or denies access to any person authorised to access it — such person shall be liable to pay damages by way of compensation to the person so affected.
Where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate shall be liable to pay damages by way of compensation to the person so affected.
Whoever knowingly or intentionally conceals, destroys or alters, or intentionally or knowingly causes another to conceal, destroy or alter, any computer source code used for a computer, computer programme, computer system or computer network, when the computer source code is required to be kept or maintained by law for the time being in force, shall be punishable with imprisonment up to three years, or with fine which may extend up to two lakh rupees, or with both.
If any person, dishonestly or fraudulently, does any act referred to in Section 43, they shall be punishable with imprisonment for a term which may extend to three years or with fine which may extend to five lakh rupees or with both.
Whoever dishonestly receives or retains any stolen computer resource or communication device, knowing or having reason to believe it to be stolen, is punishable with imprisonment of up to three years, or with a fine of up to one lakh rupees, or with both.
Whoever, fraudulently or dishonestly makes use of the electronic signature, password or any other unique identification feature of any other person, shall be punished with imprisonment of either description for a term which may extend to three years and shall also be liable to fine which may extend to rupees one lakh.
Whoever, by means of any communication device or computer resource, cheats by personation, shall be punished with imprisonment of either description for a term which may extend to three years and shall also be liable to fine which may extend to one lakh rupees.
Whoever, intentionally or knowingly captures, publishes or transmits the image of a private area of any person without their consent, under circumstances violating the privacy of that person, shall be punished with imprisonment which may extend to three years or with fine not exceeding two lakh rupees, or with both.
Whoever, with intent to threaten the unity, integrity, security or sovereignty of India or to strike terror in the people, denies access to a computer resource to an authorised person, attempts to penetrate a computer resource without authorisation, or introduces a contaminant, and by doing so causes or is likely to cause death or injuries to persons, damage to property, or disruption of supplies or services essential to the life of the community, commits cyber terrorism. Whoever commits or conspires to commit cyber terrorism is punishable with imprisonment which may extend to imprisonment for life.
Whoever publishes or transmits or causes to be published or transmitted in electronic form any material which is lascivious or appeals to the prurient interest, or if its effect is such as to tend to deprave and corrupt persons, shall be punished on first conviction with imprisonment for a term which may extend to three years and with fine which may extend to five lakh rupees, and on a second or subsequent conviction with imprisonment for a term which may extend to five years and with fine which may extend to ten lakh rupees.
Whoever publishes or transmits, or causes to be published or transmitted, in electronic form any material containing a sexually explicit act or conduct is punishable on first conviction with imprisonment of up to five years and a fine of up to ten lakh rupees, and on a subsequent conviction with imprisonment of up to seven years and a fine of up to ten lakh rupees.
Whoever publishes or transmits material depicting children in a sexually explicit act, creates text or digital images or advertises such material, cultivates or induces children into an online relationship for a sexually explicit act, or facilitates abusing children online, is punishable on first conviction with imprisonment of up to five years and a fine of up to ten lakh rupees, and on a subsequent conviction with imprisonment of up to seven years and a fine of up to ten lakh rupees.
An intermediary shall preserve and retain such information as may be specified, for such duration and in such manner and format as the Central Government may prescribe. An intermediary who intentionally or knowingly contravenes this requirement is punishable with imprisonment of up to three years and a fine.
Where the Central Government or a State Government or any officer specially authorised is satisfied that it is necessary or expedient in the interest of the sovereignty or integrity of India, defence of India, security of the State, friendly relations with foreign States, public order, or for preventing incitement to the commission of any cognizable offence, or for investigation of any offence, it may direct any agency of the appropriate Government to intercept, monitor or decrypt any information generated, transmitted, received or stored in any computer resource.
Where the Central Government is satisfied that it is necessary in the interest of the sovereignty and integrity of India, defence, security of the State, friendly relations with foreign States, public order, or for preventing incitement to the commission of a cognisable offence, it may direct any agency or intermediary to block public access to any information generated, transmitted, received, stored or hosted in any computer resource. Reasons must be recorded in writing, and an intermediary who fails to comply is punishable with imprisonment of up to seven years and a fine.
The appropriate Government may declare any computer resource which directly or indirectly affects the facility of Critical Information Infrastructure to be a protected system, and may authorise the persons who are entitled to access it. Whoever secures access or attempts to secure access to a protected system in contravention of this section is punishable with imprisonment of up to ten years and a fine.
Any person who, in pursuance of any powers conferred under this Act, has secured access to any electronic record, book, register, correspondence, information, document or other material without the consent of the person concerned, and discloses such material to any other person, shall be punished with imprisonment for a term which may extend to two years, or with fine which may extend to one lakh rupees, or with both.
Notwithstanding anything contained in any law for the time being in force, an intermediary shall not be liable for any third-party information, data or communication link made available or hosted by them, where the intermediary's function is limited to providing access to a communication system, the intermediary does not initiate the transmission, select the receiver, or select or modify the information contained in the transmission, and observes due diligence in discharge of its duties under this Act.
Where a person committing a contravention of this Act is a company, every person who at the time of the contravention was in charge of, and responsible to, the company for the conduct of its business, as well as the company itself, is deemed guilty and liable to be proceeded against. A person is not liable if they prove that the contravention took place without their knowledge or that they exercised all due diligence to prevent it.
What do you need help with? Pick the closest one — you can explain in your own words next.