What Is Hacking in India, and When Does It Become a Crime?

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

What is the legal line between ethical hacking and an offence in India?

It is consent, and it must be real. The Ministry of Electronics and Information Technology told Parliament that any act, including ethical hacking, undertaken with the permission or consent of its owner does not attract liability, and that consent removes the offence created by section 43 of the Information Technology Act, 2000, with section 66 setting out the punishment. The 2023 amendment and the Bharatiya Nyaya Sanhita widened the perimeter: identity fraud and impersonation of a business or a financial institution are now separately criminalised, which is why a deepfake boss impersonation is not merely a scam. Consent obtained from a colleague who did not own the asset is not consent, and an engagement with no written authorisation is not a grey area, it is exposure for both the client and the tester.

What kinds of activity are treated as criminal rather than as testing?

A short and unglamorous list: accessing a system without authorisation even to look; using credentials obtained by deception and then using them; continuing to access after access has been withdrawn; installing a persistent backdoor even with a general instruction to test; exfiltrating real personal data beyond what the test required; and impersonation, which the 2023 amendment treats as an offence in its own right. A useful discipline is to treat every piece of data touched during a test as if it will end up in a courtroom, because in a disputed engagement it sometimes does. The 21,900 digital-arrest complaints involving over Rs 647 crore recorded in the first eight months of 2026 are a reminder that the criminal process in India is now comfortable with cyber cases and does not need a technical specialist to understand the timeline.

What should written authorisation actually contain?

Nine things, and each of them has prevented a dispute somewhere. The exact systems, by hostname and IP range. The exact dates and the test window, including hours. A named client contact who is authorised to stop the test and a technical contact who can be reached during it. The permitted techniques, written as a list rather than as a general permission. The explicitly prohibited actions, which is the clause that protects the client. The testing source IP addresses or the tester's identity. A confidentiality clause. A data handling clause stating what will be collected, how it will be stored and when it will be destroyed. And a clause stating that findings will be reported to the owner first and to no third party without written permission, unless a legal obligation requires otherwise.

How do I choose between a penetration test, a red team and a vulnerability assessment?

By the question you need answered. A vulnerability assessment answers what is wrong, prioritised by severity, largely automated. A penetration test answers whether an attacker can get in and how far they can get, with human judgement and a working attack path. A red team answers whether your people and your monitoring would detect and stop a realistic adversary who is already inside, and it deliberately avoids checking anything that would break a system. Most Indian engagements should start with a penetration test, because it establishes whether the obvious paths work, and a red team is only meaningful once the obvious paths are closed. AAVETech runs all three as fixed-price engagements at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, with a 5 to 10 working day turnaround and a retest included.

What are the common questions about H?