India's Information Technology Act, 2000 is still the statute that decides when a security failure becomes a civil claim, a regulatory penalty or a criminal offence, even as the Digital Personal Data Protection Act takes over privacy. Security teams meet it through Section 43A and the 2011 SPDI Rules on reasonable security practices, Section 70B and the CERT-In directions, the intermediary duties in Sections 67C, 69, 69B and 79, and the cyber offences in Section 66 onwards. Many penalties changed on 30 November 2023 when the Jan Vishwas (Amendment of Provisions) Act, 2023 took effect, and many summaries online still quote the old figures. This guide is for security leads, compliance officers and engineers at companies that operate systems in India or process data of people in India. Privacy duties under the new law are covered in the India DPDP Act Guide; this page covers the security and cybercrime side of the IT Act and how it sits beside DPDP.
Key takeaways
- Section 43A is a compensation duty, not a fine. A body corporate handling sensitive personal data that is negligent in maintaining reasonable security practices, and so causes wrongful loss or gain, must compensate the person affected; the Act sets no cap.
- The SPDI Rules define "reasonable". Rule 8 of the 2011 Rules accepts IS/ISO/IEC 27001 or an approved industry code, a documented security programme and an independent audit at least once a year or after significant upgrades.
- Passwords are sensitive data by definition. Rule 3 lists passwords alongside financial, health and biometric data, so credential stores, including those holding machine credentials, sit squarely inside the Section 43A duty.
- Penalties were rewritten in 2023. Section 72A is now a civil penalty of up to Rs 25 lakh, Section 67C up to Rs 25 lakh, and the Section 70B CERT-In fine up to Rs 1 crore, effective 30 November 2023.
- Section 43A is scheduled to give way to DPDP. The DPDP Act repeals Section 43A; law firm summaries of the November 2025 commencement notification place that repeal in the 18-month phase, around 14 May 2027. The offences, CERT-In powers and intermediary duties stay.
Scope: who and what is covered
The IT Act applies across India and, under Section 75, to offences or contraventions committed outside India by any person where the conduct involves a computer, computer system or computer network located in India. That makes a foreign attacker, or a foreign service provider, reachable in principle when Indian systems are involved.
| Who | Provisions that bite | Practical meaning |
|---|---|---|
| Body corporate (any company, firm, sole proprietorship or association in commercial or professional activity) | Section 43A, SPDI Rules 2011, Section 85 | Reasonable security for sensitive personal data; officers can share liability for company contraventions |
| Intermediary (platforms, hosting, telecom, cloud, marketplaces) | Sections 67C, 69, 69B, 70B, 79 | Preserve information, assist lawful interception and traffic data collection, follow CERT-In directions, observe due diligence for safe harbour |
| Service providers, data centres and others named in Section 70B(6) | Section 70B and the CERT-In Directions of 28 April 2022 | Supply information and comply with CERT-In directions, including incident reporting |
| Owners of critical information infrastructure | Sections 70 and 70A | Systems can be notified as protected systems; unauthorised access attracts up to ten years |
| Any person, including insiders and contractors | Sections 43, 66 to 66F, 72, 72A | Civil compensation and criminal offences for unauthorised access, data theft, identity theft and disclosure |
The SPDI Rules apply to personal information and to a narrower class of sensitive personal data or information (SPDI). Rule 3 lists passwords; financial information such as bank account, card or other payment instrument details; physical, physiological and mental health condition; sexual orientation; medical records and history; and biometric information. Information that is freely available in the public domain, or furnished under the Right to Information Act, 2005, is excluded. The Government's press note of 24 August 2011 clarified that the Rules apply to bodies corporate or persons located in India, and that a company handling SPDI under a contract with another legal entity, in India or abroad, is exempt from Rules 5 and 6 (collection and disclosure). That clarification matters for Indian outsourcing and shared service centres.
Key obligations
Reasonable security under Section 43A and Rule 8
Section 43A's explanation says reasonable security practices and procedures are those designed to protect information from unauthorised access, damage, use, modification, disclosure or impairment, as agreed between the parties, as specified by law, or, failing both, as prescribed by the Central Government. Rule 8 is that prescription. A body corporate is treated as compliant if it has implemented recognised security practices and standards and keeps a comprehensive documented information security programme and policies, with managerial, technical, operational and physical controls matched to its information assets. After a breach it must be able to show the authorised agency that those controls were implemented. IS/ISO/IEC 27001 is named as one qualifying standard; industry associations using other codes need them approved and notified by the Central Government. Compliance is deemed where the standard or code is certified or audited by an independent auditor approved by the Government, at least once a year or on a significant upgrade of processes or computer resources.
Collection, disclosure and transfer under Rules 4 to 7
- Rule 4, privacy policy: publish a policy covering the types of personal data and SPDI collected, purposes, disclosures and Rule 8 security practices.
- Rule 5, collection: written consent (letter, fax or email, and per the 2011 clarification any electronic mode) on purpose before collecting SPDI; collect only what is necessary; keep it no longer than required; allow review, correction and withdrawal; appoint a Grievance Officer and resolve grievances within one month.
- Rule 6, disclosure: prior permission before disclosing SPDI to a third party unless contract or legal obligation allows it; legally empowered agencies may obtain it on a written request stating purpose; the body corporate must not publish SPDI.
- Rule 7, transfer: transfer in India or abroad only to a recipient that ensures the same level of protection, and only where needed for a lawful contract or with consent.
Intermediary and service provider duties
| Section | Duty | Consequence of failure (as amended) |
|---|---|---|
| 67C | Preserve and retain information for the duration, manner and format the Central Government prescribes | Penalty up to Rs 25 lakh (replaced imprisonment from 30 November 2023) |
| 69 | Provide facilities and technical assistance for authorised interception, monitoring or decryption | Imprisonment up to seven years and fine |
| 69B | Provide assistance for authorised monitoring and collection of traffic data for cyber security | Imprisonment up to one year, or fine up to Rs 1 crore, or both |
| 70B(6) | Provide information and comply with CERT-In directions | Imprisonment up to one year, or fine up to Rs 1 crore, or both; prosecution only on complaint by an authorised CERT-In officer |
| 79 | Observe due diligence and Government guidelines; remove or disable unlawful material promptly on actual knowledge or Government notification | Loss of safe harbour from liability for third-party information |
The most operational of these is Section 70B. Under it, CERT-In issued directions on 28 April 2022 that require reporting of listed cyber incidents within six hours of noticing them, synchronisation to Indian time sources, and log retention in India for 180 days. The detail is in the CERT-In Directions 2022 Guide. Telecom entities have additional duties under the India Telecommunications (Telecom Cyber Security) Rules 2024.
Timeline and current status
| Date | Event | Status as checked 8 November 2026 |
|---|---|---|
| 2000 | Information Technology Act, 2000 (21 of 2000) enacted | In force, as amended |
| 2009 amendment | Information Technology (Amendment) Act inserted Section 43A among other provisions | In force |
| 11 April 2011 | SPDI Rules notified, G.S.R. 313(E), under Section 87(2)(ob) read with Section 43A | In force until Section 43A is repealed |
| 24 August 2011 | Government clarification on scope, outsourcing and consent | Current guidance |
| 28 April 2022 | CERT-In Directions under Section 70B(6) | In force |
| 30 November 2023 | Jan Vishwas Act, 2023 Schedule item 32 amendments to the IT Act in force (MeitY S.O. 4745(E) of 31 October 2023) | In force; Section 66A omitted; many offences converted to penalties |
| 14 November 2025 | DPDP Rules 2025 notified and DPDP Act commencement begun in phases | Phased |
| Around 14 May 2027 (reported) | Repeal of Section 43A by the DPDP Act takes effect, per law firm summaries of the commencement notification | Pending; confirm the date in the Gazette notification |
Until the repeal takes effect, Section 43A and the SPDI Rules continue to apply alongside the parts of DPDP already in force. After it, the security safeguard duty for personal data moves to DPDP, enforced by the Data Protection Board, while everything else on this page remains in the IT Act. Plan for both: keep Rule 8 evidence current now and map it to DPDP's reasonable security safeguards so the transition is a relabelling exercise, not a rebuild.
Enforcement and penalties
Enforcement is split between civil compensation decided by adjudicating officers under Section 46, CERT-In's direction powers, and criminal prosecution by police. Under Section 77B, offences punishable with three years or more are cognizable, and offences punishable with three years are bailable. Section 77A allows courts to compound offences other than those punishable with life imprisonment or more than three years. Under Section 85, where a company commits a contravention, every person in charge of and responsible for its business is also liable unless they prove lack of knowledge or due diligence, and directors or officers whose consent, connivance or neglect contributed are deemed guilty.
| Provision | Conduct | Sanction |
|---|---|---|
| Section 43 | Unauthorised access, download, malware, damage, disruption or denial of access | Compensation to the person affected |
| Section 43A | Negligent failure to maintain reasonable security for SPDI causing wrongful loss or gain | Compensation to the person affected, no statutory cap |
| Section 45 (as amended) | Contravening rules, regulations, directions or orders where no separate penalty exists | Penalty up to Rs 1 lakh plus compensation up to Rs 10 lakh for an intermediary, company or body corporate |
| Section 66 | Doing a Section 43 act dishonestly or fraudulently | Up to three years, or fine up to Rs 5 lakh, or both |
| Section 66B | Dishonestly receiving a stolen computer resource or device | Up to three years, or fine up to Rs 1 lakh, or both |
| Section 66C | Fraudulent use of another person's electronic signature, password or other unique identification feature | Up to three years and fine up to Rs 1 lakh |
| Section 66D | Cheating by personation using a computer resource | Up to three years and fine up to Rs 1 lakh |
| Section 66F | Cyber terrorism | Imprisonment which may extend to life |
| Section 70(3) | Accessing a notified protected system | Up to ten years and fine |
| Section 72 (as amended) | Disclosure of material accessed under powers in the Act without consent | Penalty up to Rs 5 lakh |
| Section 72A (as amended) | Disclosure of personal information obtained under a lawful contract, without consent or in breach of contract, intending or knowing wrongful loss or gain | Penalty up to Rs 25 lakh |
Section 84C makes an attempt punishable with up to half the longest term for the offence. Older guidance quoting imprisonment for Sections 67C, 72 or 72A, or a Rs 1 lakh fine under Section 70B(7), predates the 2023 amendments; update policies and training material that still carry those figures.
What it means for AI agents and non-human identities
The IT Act was not written with service accounts or AI agents in mind, but several provisions apply directly to them.
- Credential stores are SPDI stores: passwords are SPDI under Rule 3, so a vault, CI/CD variable store or configuration repository holding passwords for customer accounts falls within Section 43A. Treat machine credentials that can unlock customer SPDI with the same Rule 8 rigour. See the Secrets Management Guide.
- Section 66C covers stolen machine secrets: fraudulent use of a password or "other unique identification feature" belonging to another person is identity theft. Whether an API key or token counts has not been settled in any source checked, so record misuse of machine credentials precisely for investigators and let counsel decide the charge.
- Agents act for the body corporate: an AI agent that collects or discloses SPDI on the company's behalf does so under Rules 5 to 7, so consent, purpose limits and transfer conditions apply to agent tools and data flows as much as to staff.
- Evidence must trace to an identity: after a breach Rule 8 requires the company to demonstrate implemented controls, and CERT-In expects logs. Every non-human identity needs an owner, a purpose and attributable logs. See the Audit Readiness for AI Agents and NHIs.
- Contract disclosure risk: Section 72A applies to any person, including an intermediary, providing services under a lawful contract. A vendor's integration identity that exfiltrates personal data exposes both parties; scope third-party tokens tightly and log their use.
Compliance steps
- Classify the data. Inventory where SPDI categories from Rule 3 live, including password and credential stores, payment data and biometrics, and tag systems that are subject to Section 43A and later DPDP.
- Choose and document the Rule 8 baseline. Most organisations use ISO/IEC 27001; keep the information security programme, policies and Statement of Applicability current. See the ISO 27001 Certification Guide.
- Audit annually and on change. Book the independent audit at least once a year and trigger an extra review on any significant upgrade of processes or computer resources; record the trigger decision.
- Fix the privacy plumbing. Publish the Rule 4 policy, implement written or electronic consent for SPDI, appoint the Grievance Officer with a one-month resolution clock, and write Rule 7 transfer clauses into processor contracts.
- Wire in CERT-In reporting. Build the six-hour reporting path, Indian time synchronisation and 180-day log retention into incident response; test with a tabletop.
- Prepare intermediary procedures. If you are an intermediary, set up handling for Section 69 and 69B requests, Section 67C retention and Section 79 takedown, with legal review and an access-restricted request register.
- Govern machine identities. Assign owners, rotate and vault credentials, and remove standing access to SPDI for agents and service accounts.
- Refresh penalty references and plan the DPDP move. Update policies to the 2023 figures and map each Rule 8 control to DPDP safeguards before the Section 43A repeal date is confirmed.
| IT Act or SPDI duty | ISO/IEC 27001:2022 Annex A | NIST SP 800-53 Rev 5 | NIST CSF 2.0 |
|---|---|---|---|
| Know legal duties (whole Act) | 5.31 Legal, statutory, regulatory and contractual requirements | IR-6 | GV.OC-03 |
| Rule 3 data inventory | 5.12 Classification of information | AC-2 | ID.AM-07 |
| Rule 8 credentials and access | 5.17 Authentication information; 8.2 Privileged access rights | IA-5, AC-6 | PR.AA-01 |
| Section 70B incident reporting | 5.24 to 5.26 Incident management | IR-4, IR-6 | RS.CO-02 |
| CERT-In logs and Section 67C retention | 8.15 Logging | AU-2, AU-9, AU-11 | DE.CM-01 |
| Rule 7 transfers and Section 72A contracts | 5.19 to 5.20 Supplier relationships | SA-9 | GV.SC-05 |
Common failure patterns
- Quoting pre-2023 penalties: board papers and training still describe Section 72A as imprisonment and Section 70B fines as Rs 1 lakh.
- Certificate without audit trail: an ISO/IEC 27001 certificate exists but the scope excludes the systems that hold SPDI, so it does not demonstrate Rule 8 for the breached system.
- Credentials left out of SPDI scope: the team classifies customer passwords as SPDI but not the repositories and build systems holding the secrets that unlock them. The Indian Government Breach shows how exposed .git and .env files leaked credential pairs.
- Treating DPDP as already replacing everything: teams drop Section 43A controls early, although the repeal is phased and the offences and CERT-In duties never move.
- Six-hour clock unrehearsed: the CERT-In report depends on one person and fails outside office hours.
Practitioner checklist
- Map every system holding Rule 3 SPDI, including password and secret stores.
- Confirm the ISO/IEC 27001 or approved code scope covers those systems and that the annual independent audit is booked.
- Publish the Rule 4 privacy policy and name the Grievance Officer with a one-month resolution target.
- Put Rule 7 transfer and Section 72A disclosure clauses in every processor and vendor contract.
- Test the CERT-In six-hour reporting path and 180-day log retention in India.
- Maintain a restricted register for Section 69, 69B and 70B requests and directions.
- Give every service account, API key and AI agent an owner, purpose and attributable logs.
- Replace pre-30 November 2023 penalty figures in policies and training.
- Track the Gazette for the confirmed Section 43A repeal date and map controls to DPDP safeguards.
Standards and references
- India Code: The Information Technology Act, 2000
- Government of India: The Jan Vishwas (Amendment of Provisions) Act, 2023
- Gazette of India: MeitY S.O. 4745(E), commencement of IT Act amendments
- WIPO Lex: Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
- Press Information Bureau: Clarification on the SPDI Rules, 24 August 2011
- CERT-In: Directions under Section 70B(6) of the IT Act
Related NHI Mgmt Group resources: India DPDP Act Guide · CERT-In Directions 2022 Guide · India Telecommunications (Telecom Cyber Security) Rules 2024 · Global Cybersecurity Regulatory Map. This guide summarises the Information Technology Act, 2000 and the SPDI Rules 2011 and is not legal advice.