Hacking in India explained: the difference between ethical hacking, grey-hat activity and offence under sections 43 and 66 of the IT Act 2000.
In India, hacking is unauthorised access to a computer, computer system or computer network without permission, and the outer boundary is written consent. The Ministry of Electronics and Information Technology has stated in Parliament that any act, including ethical hacking, undertaken with the permission or consent of the owner attracts no liability under the Information Technology Act, 2000. Liability arises under section 43 and section 66, with the Bharatiya Nyaya Sanhita and the 2023 amendment extending liability to impersonation and identity fraud. The practical test is whether written authorisation exists before the first packet is sent.
It is consent, and it must be real. The Ministry of Electronics and Information Technology told Parliament that any act, including ethical hacking, undertaken with the permission or consent of its owner does not attract liability, and that consent removes the offence created by section 43 of the Information Technology Act, 2000, with section 66 setting out the punishment. The 2023 amendment and the Bharatiya Nyaya Sanhita widened the perimeter: identity fraud and impersonation of a business or a financial institution are now separately criminalised, which is why a deepfake boss impersonation is not merely a scam. Consent obtained from a colleague who did not own the asset is not consent, and an engagement with no written authorisation is not a grey area, it is exposure for both the client and the tester.
A short and unglamorous list: accessing a system without authorisation even to look; using credentials obtained by deception and then using them; continuing to access after access has been withdrawn; installing a persistent backdoor even with a general instruction to test; exfiltrating real personal data beyond what the test required; and impersonation, which the 2023 amendment treats as an offence in its own right. A useful discipline is to treat every piece of data touched during a test as if it will end up in a courtroom, because in a disputed engagement it sometimes does. The 21,900 digital-arrest complaints involving over Rs 647 crore recorded in the first eight months of 2026 are a reminder that the criminal process in India is now comfortable with cyber cases and does not need a technical specialist to understand the timeline.
Nine things, and each of them has prevented a dispute somewhere. The exact systems, by hostname and IP range. The exact dates and the test window, including hours. A named client contact who is authorised to stop the test and a technical contact who can be reached during it. The permitted techniques, written as a list rather than as a general permission. The explicitly prohibited actions, which is the clause that protects the client. The testing source IP addresses or the tester's identity. A confidentiality clause. A data handling clause stating what will be collected, how it will be stored and when it will be destroyed. And a clause stating that findings will be reported to the owner first and to no third party without written permission, unless a legal obligation requires otherwise.
By the question you need answered. A vulnerability assessment answers what is wrong, prioritised by severity, largely automated. A penetration test answers whether an attacker can get in and how far they can get, with human judgement and a working attack path. A red team answers whether your people and your monitoring would detect and stop a realistic adversary who is already inside, and it deliberately avoids checking anything that would break a system. Most Indian engagements should start with a penetration test, because it establishes whether the obvious paths work, and a red team is only meaningful once the obvious paths are closed. AAVETech runs all three as fixed-price engagements at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, with a 5 to 10 working day turnaround and a retest included.
| Activity | Legal position | Statutory reference |
|---|---|---|
| Authorised penetration testing | No liability with owner consent | IT Act 2000, s.43 and s.66 read with MeitY statement |
| Access without authorisation | Offence | IT Act 2000, s.43 and s.66 |
| Impersonating a business or bank | Offence | IT Act 2003 amendment, 2023 |
| Identity fraud and document misuse | Offence | Bharatiya Nyaya Sanhita, 2023 |
| Testing with a verbal go-ahead | Unenforceable and risky | Consent must be written and from the asset owner |
In India, hacking is unauthorised access to a computer, computer system or computer network without permission, and the outer boundary is written consent. The Ministry of Electronics and Information Technology has stated in Parliament that any act, including ethical hacking, undertaken with the permission or consent of the owner attracts no liability under the Information Technology Act, 2000. Liability arises under section 43 and section 66, with the Bharatiya Nyaya Sanhita and the 2023 amendment extending liability to impersonation and identity fraud. The practical test is whether written authorisation exists before the first packet is sent.
Yes, provided you have the owner's permission. The Ministry of Electronics and Information Technology has stated in Parliament that any act, including ethical hacking, undertaken with the permission or consent of the owner does not attract liability under the Information Technology Act, 2000. Written authorisation and a signed rules-of-engagement document are still required before testing begins.
No. A scan matches known weaknesses against known versions and produces a list. A penetration test uses human judgement to prove exploitability and reports a working attack path. A red team goes further and tests whether your people and monitoring would detect an adversary who is already inside.
Personal systems still need care. Testing a device you own is generally lawful, but the moment you touch a shared account, a third-party service or a network you do not administer, you are back to the section 43 question, and a landlord's router or a shared office Wi-Fi is a shared system in law as well as in practice.
Stop, do not log in again, do not copy anything further, and take advice on disclosure. In India, self-reporting is a relevant mitigating factor in several cyber cases, and CERT-In's 6-hour reporting window means that if the system is a listed one, the reporting obligation applies to the organisation regardless of who did it.
Roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, so a single web application typically lands between Rs 60,000 and Rs 3,50,000 depending on depth. At AAVETech engagements are fixed-price with a written scope and a rules-of-engagement document, and the retest after remediation is included.
Read the full guide on AAVETech: What Is Hacking in India, and When Does It Become a Crime?.
Send us the systems in scope and we will return an authority-to-test letter and a rules-of-engagement document for signature before any testing begins.
Talk to an analyst about this.