What Is Section 43 of the IT Act?
Key takeaways
- Section 43 is a civil compensation provision, so a company can sue for loss caused by an intrusion without waiting for a criminal case to end, and the standard of proof is civil rather than criminal.
- The liability lies with the person who compromised the security or tampered with the contents, which means the defendant is the intruder, the negligent vendor or the insider, depending on the facts.
- Documentary loss is the strongest claim: forensic and containment invoices, notification and credit-monitoring costs, downtime, and the cost of restoring or rebuilding a compromised system.
- A section 43 claim can be pursued alongside a section 66 criminal complaint, and the two do not block each other, so a business with both a loss and a perpetrator can run both tracks.
- If the intrusion involved the claimant's own negligence, the defendant's liability may be reduced, so an internal control review is a standard part of the defence in these cases.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
Who can sue under section 43, and against whom?
Any person who suffers loss from a compromised computer, system or network can sue under section 43, and that includes a company. The defendant is the person who caused the loss by compromising security or tampering with computer contents. In most Indian cases that is one of three: the external attacker, an insider with access, or a service provider whose negligence allowed the intrusion through. The third is the one businesses underestimate. If a vendor left a default credential, skipped a patch or exposed an admin panel to the internet, the contractual chain runs back to the vendor, and a good claim pleads the vendor, the contract and the technical failure together.
What losses can you actually claim under section 43?
The law says loss or damage suffered by reason of the compromise, and courts read that as compensatory. The realistic heads in an Indian breach are: forensic investigation and containment costs, the cost of restoring or rebuilding affected systems, business interruption loss during the outage, the cost of the breach notification and of the call centre handling customer queries, credit monitoring offered to affected individuals, legal and advisory costs, and in a well-evidenced case the cost of regulatory remediation. Pure lost profit is harder, and the courts want it proved rather than estimated. Keep every invoice and an internal note of the disruption timeline.
What evidence makes a section 43 claim succeed?
Four things, in this order. First, proof of the compromise itself: forensic reports, logs, and the intrusion timeline. Second, proof of the causal link between the compromise and the loss, which is why you need downtime and containment records rather than a general statement that business was affected. Third, proof of the quantum, which is the invoices and financial records itemised by head. Fourth, proof of who the defendant is, the hardest part in an anonymous intrusion, and it is where cooperation from a telecom, a bank or a law enforcement investigation often decides the case. Preserved tamper-evident logs are the evidence base, not just a compliance requirement.
How does a section 43 claim run alongside a criminal case?
They run in parallel, and most serious intrusions produce both. The criminal track, usually section 66, is run by the state and delivers a conviction and an order. The civil track delivers money, and filing a criminal complaint does not stop a civil suit, and a private investigator's report, an internal forensic report and even a complainant's statement can be tendered as evidence, subject to the rules on hearsay. Two practical warnings: keep the two narratives identical, because a mismatch on dates or the intrusion vector is the cheapest way to lose credibility. And remember that an award is not the only recovery route; an insurer's claim and a claim against a negligent vendor can each be pursued.
| Head of claim | What it covers | Evidence that supports it |
|---|---|---|
| Forensic and containment | Incident response, malware removal, forensic analysis | Engagement letter, invoices, forensic report with findings |
| System restoration | Rebuilding, restoring from backup, replacing hardware | Asset list, restore logs, purchase and repair invoices |
| Business interruption | Lost revenue and idle capacity during the outage | Downtime timeline, payment gateway and billing records |
| Notification and support | Breach notice costs, call centre, customer helpline | Notification copy, vendor invoice, ticket volumes |
| Identity protection | Credit monitoring or identity protection for affected customers | Offer documentation, enrolment counts, invoice |
| Advisory costs | Legal, forensic and notification advisory fees | Engagement letters and itemised bills |
What are the frequently asked questions?
Get a straight answer on this
Send us your incident timeline and invoices, and we will return an assessment of which section 43 heads of claim are realistically recoverable.
Send us the details See pricing