Maarg Manthan · Topic 14.3

Cyber Law in India

Science & Technology › IT, Telecommunications and Computers · Topic 14.3

Cyber law is the body of legal rules that deal with the use of computers, the internet and digital data. In India the main law is the Information Technology Act, 2000, based on the UNCITRAL Model Law on Electronic Commerce of 1996, which gives legal recognition to electronic records and digital signatures and defines offences such as hacking, identity theft, cheating by impersonation, publishing obscene material and violating privacy. It was amended in 2008 to add cyber terrorism and data protection provisions. Section 66A, which punished sending offensive messages, was struck down by the Supreme Court in Shreya Singhal versus Union of India in 2015. Related laws include the Bharatiya Nyaya Sanhita, the Digital Personal Data Protection Act, 2023 and the IT Rules, 2021.

5 min read · UPSC Prelims · Science & Technology · IT, Telecommunications and Computers

At a Glance

Main Act IT Act, 2000
Amended 2008
Struck down Section 66A, in 2015
Data law DPDP Act, 2023
Tribunal TDSAT for appeals
Exam link UPSC Prelims, Science & Technology: IT, Telecommunications and Computers

Where Does It Fit?

This topic follows the account of fibre and spectrum. Once networks and devices are in place, laws are needed to govern conduct online, and this topic summarises the legal framework that the rest of the macro refers to. Previous topic: National Optical Fibre Network and Spectrum Management. Next topic: History and Generations of Computers.

What Are the Main Provisions of the IT Act?

Provision	Content
Legal recognition	Sections 4 and 5 give legal validity to electronic records and digital signatures. The Controller of Certifying Authorities licenses certifying authorities
Section 43	Penalty and compensation for unauthorised access, damage and data theft
Section 66	Computer related offences done dishonestly or fraudulently, commonly called hacking, punishable with up to three years
Section 66C and 66D	Identity theft, and cheating by personation using a computer resource
Section 66E	Violation of privacy by capturing and publishing images of private areas
Section 66F	Cyber terrorism, inserted in 2008, punishable with imprisonment up to life
Sections 67, 67A and 67B	Publishing obscene material, sexually explicit acts and child sexual abuse material electronically

Which Other Provisions and Judgments Matter?

Section 69: power of the Government to intercept, monitor or decrypt information in the interest of sovereignty, security and public order
Section 69A: power to block public access to online content on specified grounds, upheld in Shreya Singhal, with procedural safeguards
Section 70: protected systems and critical information infrastructure, with the National Critical Information Infrastructure Protection Centre
Section 79: safe harbour for intermediaries such as social media platforms, if they follow due diligence
Shreya Singhal v Union of India, 2015: the Supreme Court struck down Section 66A as vague and violating freedom of speech under Article 19(1)(a)
Puttaswamy v Union of India, 2017: a nine judge bench held that privacy is a fundamental right under Article 21
IT Rules, 2021: Intermediary Guidelines and Digital Media Ethics Code, which require grievance officers, traceability of the first originator for some messaging services and a code for digital news and streaming platforms
CERT-In directions, 2022: require organisations to report cyber incidents within six hours and to keep logs for 180 days

What Else Should You Remember?

2008 amendment: added Sections 66A to 66F, 67A, 67B, 69, 69A, 69B and 70A and made the law technology neutral by recognising electronic signatures
Cyber Appellate Tribunal: created by the Act and merged into TDSAT in 2017 under the Finance Act
Adjudicating officers: decide civil claims for damages up to Rs 5 crore, with the Secretary of IT of each state as adjudicating officer
Jurisdiction: Section 75 gives the Act extra-territorial reach for offences involving computers in India
Digital Personal Data Protection Act, 2023: gives rights to data principals, duties to data fiduciaries and creates the Data Protection Board; its rules are being phased in
Bharatiya Nyaya Sanhita, 2023: contains offences relevant to online fraud, defamation and sexual offences with technology
Digital signatures: electronic signature using Aadhaar e-sign is accepted for many services
Evidence: Section 65B of the Indian Evidence Act, now Section 63 of the Bharatiya Sakshya Adhiniyam, governs admissibility of electronic records
International: India is not a party to the Budapest Convention on Cybercrime, arguing that it was made without its participation
Cybercrime reporting: portal cybercrime.gov.in and the helpline 1930 for financial fraud
Link: institutions are in Regulatory Bodies for ICT in India (Ministry of Communications and IT)
Link with security: see Encryption and Cybersecurity (Cyber Swachhta Kendra)

Why Does It Matter for the Exam?

Sections: 66, 66A, 66F, 69A, 79
Cases: Shreya Singhal and Puttaswamy
Newer laws: DPDP Act and IT Rules 2021
Current affairs link: blocking orders and data protection rules
Common errors: saying that Section 66A is still in force or mixing up 69 and 69A

As an analytical point, cyber law must protect people from harm without limiting speech and privacy. The striking down of Section 66A shows that the courts will test online restrictions against basic rights.

Why Is This Topic Important?

Act IT Act 2000 and 2008
Cases Shreya Singhal
Newer rules DPDP and IT Rules

What Came Next?

The next topic covers the history and generations of computers. Next topic: History and Generations of Computers.

Key People and Terms

Intermediary Platform or service carrying user content
Safe harbour Protection from liability
Digital signature Electronic authentication
Cyber terrorism Attack on critical systems to threaten security
Data fiduciary Entity processing personal data
Blocking order Direction to remove content

Exam Corner

Points to Remember

IT Act: 2000; amended 2008.
Section 66A struck down in 2015.
Section 66F: cyber terrorism.
Privacy as a right: 2017.
DPDP Act: 2023.

Do Not Confuse With

Section 69 and 69A Interception versus blocking
Section 66A and Section 66 Struck down speech provision versus hacking provision
IT Act and DPDP Act General cyber law versus personal data law

Memory Hook

Two-thousand the Act, oh-eight the change, fifteen struck down Sixty-six A; seventeen made privacy a right.

Mains Angle

Questions ask for sections, cases and newer laws. These points help.

Framework IT Act and rules
Rights Speech and privacy
Gaps Enforcement

A Question You May Face

An original practice question, not a past paper question.

“Discuss the main provisions of the Information Technology Act, 2000 and the way courts have balanced cyber regulation with fundamental rights.”

How to Answer

Act Provisions.
Cases 66A, privacy.
New laws DPDP, rules.
Way Balance and capacity.

GS Relevance

Prelims: sections, amendments, Shreya Singhal, Puttaswamy, intermediaries. GS Paper 3: cyber security; GS Paper 2: laws, rights.

Frequently Asked Questions

What is the Information Technology Act, 2000?

The Information Technology Act, 2000 is India's main law on electronic commerce and cyber crime. It gives legal recognition to electronic records and digital signatures, defines offences such as hacking, identity theft, cyber terrorism and publishing obscene material, and creates authorities such as the Controller of Certifying Authorities. It was amended in 2008.

Why was Section 66A struck down?

Section 66A of the Information Technology Act punished sending information that was grossly offensive or caused annoyance online. In Shreya Singhal versus Union of India in 2015, the Supreme Court struck it down as vague and overbroad, holding that it violated the freedom of speech and expression under Article 19(1)(a) of the Constitution.

What does Section 69A allow?

Section 69A of the Information Technology Act allows the Central Government to direct the blocking of public access to online content in the interest of sovereignty, security, public order and certain other grounds, following prescribed procedures. The Supreme Court upheld it in 2015 because it has safeguards, including written reasons and review.

What is safe harbour for intermediaries?

Section 79 of the Information Technology Act protects intermediaries, such as social media platforms and internet service providers, from liability for content posted by users, if they do not initiate or modify it and follow due diligence rules. The IT Rules, 2021 set conditions such as appointing grievance officers for platforms to keep this protection.

What is the Digital Personal Data Protection Act, 2023?

The Digital Personal Data Protection Act, 2023 is a law that regulates how organisations collect and use personal data of individuals. It requires consent, gives people rights such as access and correction, lays duties on data fiduciaries, provides penalties, and sets up the Data Protection Board of India to decide complaints.

PYQ Practice — Statement Analysis

1 Section 66A of the IT Act was struck down by the Supreme Court in 2015.

True

In Shreya Singhal.

2 The IT Act, 2000 was amended in 2008.

True

Adding cyber terrorism and other provisions.

3 Section 69A deals with interception and decryption.

False

That is Section 69; 69A is blocking.

4 India is a party to the Budapest Convention on Cybercrime.