Is it legal to hire a hacker in India?
Key takeaways
- The Ministry of Electronics and Information Technology has confirmed in Parliament that ethical hacking with the owner's consent attracts no liability under the IT Act, 2000.
- Sections 43 and 66 of the IT Act, 2000 create liability for accessing a system without permission or consent, which is the line between testing and offence.
- Written consent must come from someone with authority over the systems; a colleague who did not own the asset cannot give it.
- Consent is necessary but not sufficient, so scope, rules of engagement, NDA and an authority-to-test letter should all exist in writing before testing.
- An engagement without written authorisation is not a grey area, it is a criminal exposure for both the tester and the client.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What does the IT Act say, in the government's own words?
The Ministry of Electronics and Information Technology told Parliament that any act, including an act of ethical hacking, undertaken with the permission or consent of its owner does not attract liability. That is the government's own position, not a contractor's interpretation. The corresponding liability comes from section 43, which deals with unauthorised access to a computer, computer system or computer network, and section 66, which prescribes punishment for that offence. Read together: consent removes the offence, and the absence of consent creates it.
What should the written authorisation contain?
The exact systems, identified by hostname, IP range or domain, and nothing broader. The exact dates and the testing window, with a named start and end. The permitted techniques and the explicitly prohibited ones, such as no social engineering of third parties and no denial of service. The identity of the tester, whether by individual, organisation or source IP range. A confidentiality clause and a data handling clause covering what happens to any data obtained. An escalation contact for either side during the window. And a clause stating who owns the test results.
Why do NDA and rules of engagement matter?
They exist to keep the engagement defensible after it finishes, not to look professional during it. A rules-of-engagement document is the single artefact that proves what was authorised, when, and by whom. In a dispute, in a client audit, or in an internal investigation, that document is what separates an authorised test from an intrusion. It also protects you: it defines the boundary, so a test cannot drift into an area that creates an unexpected liability for your business during the very exercise meant to reduce risk.
When does hiring a hacker become a crime?
When the work is done without the owner's consent, when it exceeds the written scope even with consent, when it is used to access someone else's data for any purpose, or when it is used to facilitate a fraud, an intrusion or a takeover. Consent to test is not consent to keep what you find, and it is certainly not consent to use it. AAVETech does not assist in accessing accounts, devices or systems a person does not own or control, and does not assist in surveillance of another person without their informed consent.
| Situation | Liability under the IT Act, 2000 | What is required |
|---|---|---|
| Testing with the owner's written permission | No liability | A signed authorisation and rules-of-engagement document |
| Testing without permission | Liability under sections 43 and 66 | This is an offence, whatever the intent |
| Testing beyond the written scope | Liability, even with consent | Scope, dates and techniques must all be in writing |
| Retaining or using what was found for another purpose | Liability, even with consent | Consent to test is not consent to keep or misuse |
| Covert surveillance of another adult | Liability | AAVETech requires the device owner's informed consent |
What are the frequently asked questions?
Get a straight answer on this
Send us the systems in scope and we will return a rules-of-engagement document for signature before any testing begins.
Send us the details See pricing