Is it legal to hire a hacker in India for authorised penetration testing?
Key takeaways
- MeitY has confirmed in Parliament that ethical hacking done with the owner's permission attracts no liability under the IT Act, 2000.
- Sections 43 and 66 of the IT Act, 2000 make unauthorised access to a computer, computer system or computer network an offence, punishable with up to 3 years imprisonment and a fine.
- Written consent must come from someone with authority over the systems; consent from a colleague who did not own the asset is not consent under sections 43 and 66 of the IT Act, 2000.
- A rules-of-engagement document naming exact systems, dates and prohibited techniques is the artefact that keeps the engagement defensible after it ends, and it is the single document a regulator, an insurer or a court will ask to see.
- Testing a third party's system without that third party's written permission remains an offence under section 43 of the IT Act, 2000, even if your own employee asked for it.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What does the IT Act, 2000 say about hiring hackers?
The government's own position, not a contractor's interpretation. The Ministry of Electronics and Information Technology told Parliament that any act, including an act of ethical hacking, undertaken with the permission or consent of its owner does not attract liability. The corresponding liability comes from section 43, which deals with unauthorised access to a computer, computer system or computer network, and section 66, which prescribes punishment for that offence, with imprisonment of up to 3 years and a fine of up to Rs 5 lakh. Read together, the position is clean: consent removes the offence, and the absence of consent creates it. That is also why consent has to be in writing and specific, because a court or a regulator will look for evidence of it.
What should the written authorisation contain?
The exact systems, identified by hostname, IP range or domain, and nothing broader. The exact dates, with a named start and end for the testing window. The permitted techniques and the explicitly prohibited ones, such as no social engineering of third parties and no denial of service. The identity of the tester, whether by individual, organisation or source IP range. A confidentiality clause and a data handling clause covering what happens to any data obtained during the test. An escalation contact for either side during the window, reachable outside business hours, because incidents during a test are usually discovered at 2am. And a clause stating who owns the test results. Consent to test is not consent to keep what you find, and it is certainly not consent to use it.
Why do the NDA and the rules of engagement matter after the work ends?
Because they exist to keep the engagement defensible later, not to look professional during it. A signed rules-of-engagement document is the single artefact that proves what was authorised, when, by whom and within which boundaries. In a client audit, an internal investigation, an insurance claim or a dispute with a third party, that document is what separates an authorised test from an intrusion. It also protects you during the test itself, because it defines the boundary, so a test cannot drift into an area that creates an unexpected liability for your business in the very exercise meant to reduce risk. Get it signed before the first packet, not after the first uncomfortable finding.
When does hiring a hacker become a crime in India?
Four situations. When the work is done without the owner's consent. When it exceeds the written scope even with consent, because consent to test is not consent to go further. When it accesses someone else's data for any purpose, including curiosity, proof of skill or commercial leverage. And when it facilitates a fraud, an intrusion or an account takeover. AAVETech does not assist in accessing accounts, devices or systems a person does not own or control, and does not assist in surveillance of another person without their informed consent. If a request falls into any of these four, the correct answer is no, and a legitimate vendor will say the same thing before the price is discussed.
| Situation | Status under the IT Act, 2000 | What to do |
|---|---|---|
| Testing your own system with a signed scope | Lawful, no liability | Keep the signed rules of engagement on file |
| Testing with verbal or implied consent | Grey, and indefensible later | Get written authorisation before the first packet |
| Testing beyond the written scope | Unauthorised access, section 43 | Stop, restore, and record the deviation |
| Testing a third party's system on your own authority | Offence, section 43 and section 66 | Obtain that party's written authorisation first |
| Keeping or selling what a test found | Separate offence, misuse of data | Encrypt, hand over, destroy on instruction |
What are the frequently asked questions?
Get a straight answer on this
Send us the systems you want tested and who owns them, and we will send a rules-of-engagement document naming the scope, dates and prohibited actions for signature.
Send us the details See pricing