Cyber Laws in India

In India, the cyber law framework is built primarily around the Information Technology (IT) Act, 2000, which serves as the bedrock for regulating digital activities, electronic commerce, and cybercrimes. The framework has evolved significantly through amendments and the introduction of specialized regulations to keep pace with rapid technological advancements — from the rise of e-commerce in the early 2000s to today’s challenges around data privacy, AI, and deepfakes. This piece walks through the primary legislation, the offences it defines, the procedural framework that governs enforcement, and the investigation powers available to Indian authorities.

Primary Legislation

The Information Technology Act, 2000

The IT Act is India’s primary law governing cybercrime and electronic commerce. It was enacted on June 9, 2000, and came into effect on October 17, 2000. Based on the 1996 UNCITRAL Model Law on Electronic Commerce, it gives legal recognition to electronic records and digital signatures, enabling secure e-commerce and e-governance. With its passage, India became the 12th country in the world to enact dedicated cyber legislation.

The Act’s original purpose was to give legal status to electronic documents and facilitate e-commerce. A significant amendment, effective 2009, introduced data protection provisions (Section 43A) and enhanced penalties for cyber offences. That same 2008 amendment added Section 66A, which criminalized sending “offensive” messages online — a provision later criticized for being vague and open to misuse. The Supreme Court struck it down as unconstitutional in Shreya Singhal v. Union of India, (2015) 5 SCC 1, for violating the right to freedom of speech under Article 19(1)(a) of the Constitution.

The Act has since been supplemented by the IT Rules, 2021, which govern intermediary accountability, and further shaped by amendments such as the IT (Intermediary Guidelines) Amendment Rules, 2026, discussed below.

The Digital Personal Data Protection (DPDP) Act, 2023

The DPDP Act is India’s principal law governing personal data privacy. It mandates informed consent for data processing, establishes the Data Protection Board of India, and imposes penalties of up to ₹250 crore for the most serious violations, such as a failure to implement reasonable security safeguards.

The Act was enacted in August 2023, the culmination of a long legislative process that began with the 2017 Puttaswamy judgment. It replaced earlier data-related provisions of the IT Rules, focusing instead on individual consent, data fiduciary duties, and the newly established Data Protection Board.

Right to Privacy

The Supreme Court’s landmark judgment in Justice K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1, recognized privacy as a fundamental right under Article 21, placing constitutional constraints on surveillance and data collection and laying the constitutional groundwork for the DPDP Act.

Historical Milestones in the DPDP Act, 2023

• 2017 — Puttaswamy Judgment: The Supreme Court declared the right to privacy a fundamental right, prompting the need for a dedicated data protection framework.
• 2018 — Srikrishna Committee Report: A government-appointed expert committee submitted its recommendations for India’s first comprehensive data protection law.
• 2019 — Personal Data Protection Bill: The government introduced the first version of the bill in Parliament for review.
• 2021 — Joint Parliamentary Committee (JPC) Report: The JPC reviewing the bill submitted its report recommending significant revisions.
• 2022 — Withdrawal of the Bill: The government withdrew the original bill to redraft it based on the JPC’s recommendations.
• November 2022 — Draft Digital Personal Data Protection Bill: A revised draft was released for public consultation.
• August 2023 — Enactment of the DPDP Act, 2023: The Act received presidential assent and became law.
• 2025–2027 — Implementation Phases: The DPDP Rules, 2025 were notified in November 2025, setting out operational requirements for consent and compliance, with phased implementation continuing through the compliance deadline in 2027.

Cyber Crimes and Offences

In India, cyber offences are governed by a dual-law framework: the Information Technology Act, 2000 (as amended in 2008, and supplemented by subordinate rules through 2026) and the Bharatiya Nyaya Sanhita (BNS), 2023, which replaced the Indian Penal Code on July 1, 2024.

Primary Offences Under the IT Act

The IT Act specifically addresses technology-driven crimes:

• Hacking and Unauthorized Access (Section 66): Intentionally gaining access to a computer system or network to cause harm or steal data.
• Dishonestly Receiving Stolen Computer Resources (Section 66B): Punishes the receipt of a stolen computer resource or communication device.
• Identity Theft (Section 66C): Fraudulent use of another person’s digital signature, password, or biometric data.
• Cheating by Personation Using a Computer Resource (Section 66D): Using a computer resource to impersonate someone else for the purpose of cheating (e.g., phishing).
• Violation of Privacy (Section 66E): Intentionally capturing or publishing private images of an individual without consent.
• Cyber Terrorism (Section 66F): Acts threatening the unity, integrity, or security of India through digital means.
• Obscene Content (Sections 67, 67A, 67B): Publishing or transmitting obscene, sexually explicit, or child-related sexually abusive material.
• Breach of Confidentiality and Privacy (Section 72): Penalizes unauthorized disclosure of information accessed under the Act.
• Nature of Offences (Sections 77A & 77B): Classify offences as compoundable or non-compoundable and specify which are cognizable.

New and Evolving Offences (2025–2026)

• Deepfakes and Synthetic Media: Under the IT (Intermediary Guidelines) Amendment Rules, 2026, intermediaries must take down harmful AI-generated content — “synthetically generated information” — within a strict three-hour window of receiving a valid takedown request.
• Organized Cybercrime (Section 111, BNS): The BNS introduces “organised crime” as a distinct category, explicitly covering cybercrimes committed by syndicates.
• Digital Data Theft (Section 303, BNS): Replaces the older theft provisions to explicitly include the dishonest taking of electronic data.
• Digital Fraud (Section 318, BNS): Covers cheating and deception carried out via digital platforms, including deepfake-based impersonation.

Procedural Framework

• Bharatiya Nagarik Suraksha Sanhita (BNSS), 2023: Replaced the Code of Criminal Procedure (CrPC) to facilitate digital-first investigation, allowing for e-FIRs and the use of audio-video evidence.
• Digital Personal Data Protection (DPDP) Act, 2023: Imposes penalties of up to ₹250 crore on companies that fail to protect personal data from breaches.

Investigation Powers in Cyber Laws

In India, investigative powers for cyber offences are governed by the Information Technology Act, 2000, and the Bharatiya Nagarik Suraksha Sanhita (BNSS), 2023, which replaced the CrPC on July 1, 2024. These laws grant law enforcement and specialized agencies broad authority to intercept data, seize devices, and mandate cooperation from individuals and companies.

Police Investigation Powers

• Authorized Officers: Under Section 78 of the IT Act, a police officer not below the rank of inspector is authorized to investigate cyber offences.
• Search and Seizure: Police can enter public places without a warrant to search for and arrest anyone suspected of committing, or about to commit, a cybercrime.
• Mandatory Recording: Under Section 105 of the BNSS, all search and seizure processes, including the preparation of the seizure list, must be recorded via audio-video electronic means (e.g., mobile phone), to ensure transparency and a clear chain of custody.
• Compelled Production: Authorities can order the production of any “electronic communication device” likely to contain digital evidence.
• Custody Rules: The BNSS allows for 15 days of police custody, which can now be spread across the initial 40 or 60 days of the total detention period, depending on the severity of the offence.

CERT-In and Emergency Powers

The Indian Computer Emergency Response Team (CERT-In) is the national nodal agency for cybersecurity incidents.

• Information Requisition: CERT-In can seek traffic logs and information from data centers, body corporates, and intermediaries to handle security incidents.
• Mandatory Reporting: Since 2022, entities have been required to report certain cyber incidents (such as data breaches or ransomware attacks) to CERT-In within six hours of noticing them.
• Penalties: Failing to provide information to CERT-In can lead to up to one year of imprisonment or a fine.

Forensic and Evidentiary Powers

The Bharatiya Sakshya Adhiniyam (BSA), 2023, which replaced the Indian Evidence Act, governs how digital evidence is handled. For offences punishable by seven years’ imprisonment or more, the BNSS mandates that a forensic expert visit the crime scene to collect evidence.

Conclusion

While India has established a strong legal foundation for cyber governance, the rapid rise of AI and deepfakes necessitates continuous updates to these laws. Future security will depend on proactive regulation, specialized law enforcement training, and public awareness.

At its core, India’s cyber law framework rests on the validation of electronic transactions and governance, built on a foundation of clear legal recognition, strengthened data protection, and empowered investigative authorities.