What Is the IT Act 2000 and What Does It Cover?
Key takeaways
- The Act's reach is defined by the words computer, computer system, computer network and electronic record, so a phone, a server and a cloud account are all covered by the same sections.
- Section 66 punishes hacking, section 66C identity theft, section 66D cheating by personation, and section 43 gives you civil compensation for unauthorised access.
- The 2008 amendment inserted the cyber appellate tribunal structure, and the IT Act also lets the government block content under section 69A.
- The Act is technology-neutral, so the same sections cover a SIM swap, an OTP fraud, a ransomware demand and a leaked database, provided the act is committed through an ICT system.
- An FIR under the IT Act and the Bharatiya Nyaya Sanhita can be filed together, and cyber complaints are also accepted on the National Cyber Crime Reporting Portal at cybercrime.gov.in.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What does the IT Act 2000 cover in practical terms?
It covers three broad families of thing. First, the legal recognition of electronic records and electronic signatures, so a digitally signed contract or a board resolution passed by email has legal standing, and it created the Controller of Certifying Authorities to run the public key infrastructure. Second, it gives the government machinery for cyber governance: the power to intercept, to issue blocking directions under section 69A, and to frame CERT-In's directions. Third, it creates the offences and civil remedies: hacking under section 66, identity theft under section 66C, cheating by personation under section 66D, and compensation in section 43.
How do the Act's offences and remedies fit together?
The Act works as a pair of tracks you can use in parallel. The criminal track is the Bharatiya Nyaya Sanhita read with the IT Act sections, and it usually starts as a complaint on cybercrime.gov.in or an FIR, with the 1930 helpline for financial fraud. The civil track is section 43, which allows the victim of unauthorised access to claim compensation for loss, and it is often faster because it does not depend on proving intent beyond reasonable doubt. Section 72 covers the penalty for a breach of confidentiality, and section 70A lets the government specify binding security practice. For a business, the Act is not only about prosecution; it is a usable basis for a claim.
Does the IT Act apply to offences committed outside India?
Yes, and the extraterritorial clause is one of the Act's most useful features for Indian victims. If a person outside India commits an offence under the Act, or if the computer, computer system or computer network used is located in India, the Act applies as if the offence were committed in India. That covers the common Indian case of a fake call centre, a credential-stuffing host abroad, or a leak from an overseas SaaS vendor holding Indian customer records. It also means a complaint in India is a legitimate route even where the accused, the servers and the money trail are all elsewhere.
What has replaced or amended the IT Act?
The Act has been amended and supplemented rather than replaced. The most significant amendment is the 2008 one, which inserted the cyber offences, the appellate tribunal, the interception provisions and the recognition of electronic signatures. The Bharatiya Nyaya Sanhita, in force since July 2024, replaced the Indian Penal Code, so hacking or cheating now also has a general penal provision to sit alongside section 66. The Digital Personal Data Protection Act, 2023 governs a separate layer, the processing of personal data, without repealing the IT Act. Read the position today as layered: the IT Act for the offence, the DPDP Act for the data, the Rules for the procedure.
| Section | Subject | Why it matters to a business |
|---|---|---|
| Section 43 | Compensation for unauthorised access | The civil route to recover loss after an intrusion, without needing a criminal conviction |
| Section 66 | Hacking and related offences | The standard charge in a breach, an intrusion or a ransomware case |
| Section 66C | Identity theft | Applies where someone steals another person's electronic identity, such as KYC or account documents |
| Section 66D | Cheating by personation | Covers OTP fraud and impersonation done through a computer resource |
| Section 70A | Security practices | Lets the government specify binding security standards, which is the legal root of CERT-In's directions |
| Section 72 | Breach of confidentiality | Covers the obligation to protect information entrusted in a professional capacity |
What are the frequently asked questions?
Get a straight answer on this
Send us a one-page description of your systems and data, and we will return a section-by-section mapping of the IT Act obligations that apply to you.
Send us the details See pricing