Background

• Enacted in 2000 to provide a legal framework for electronic governance and cyber activities in India.
• Based on the UNCITRAL Model Law on Electronic Commerce (1996).
• Extended to the whole of India and applies to offences or contraventions committed outside India if the computer system is located in India.

Objectives

• Grant legal recognition to electronic records and digital signatures.
• Facilitate e-commerce and e-governance.
• Define and punish cybercrimes.
• Establish a regulatory framework for intermediaries and cybersecurity.
• Build trust and security in the digital ecosystem.

Scope of the Act

• Applies to electronic records, digital signatures, and electronic transactions.
• Covers individuals, companies, intermediaries, and government agencies.
• Excludes certain documents like:
  • Negotiable instruments (except cheques)
  • Powers of attorney
  • Trust deeds
  • Wills
  • Sale or transfer of immovable property

Key Definitions

• Electronic Record: Data, record, or information generated, sent, received, or stored in electronic form.
• Digital Signature: Authentication of electronic records using asymmetric cryptosystem and hash function.
• Intermediary: Any person who receives, stores, or transmits electronic records on behalf of others (e.g., ISPs, social media platforms).
• Computer Resource: Includes computers, networks, data, databases, and software.

Major Provisions

1. Legal Recognition

• Electronic records and digital signatures are legally valid (Sections 4 & 5).

2. Cyber Offences and Penalties

• Section 43: Unauthorised access, data damage, virus attacks (civil liability).
• Section 66: Computer-related offences (criminal liability).
• Section 66C: Identity theft.
• Section 66D: Cheating by personation using computer resources.
• Section 66F: Cyber terrorism.

3. Intermediary Liability

• Section 79:
  • Provides conditional “safe harbour” to intermediaries.
  • Immunity applies only if intermediaries observe due diligence and comply with lawful government directions.

4. Government Powers

• Section 69: Interception, monitoring, or decryption of information for national security and public order.
• Section 69A: Blocking public access to online information under prescribed safeguards.
• Section 70: Protection of Critical Information Infrastructure.
• Section 70B: Establishment of CERT-In for cybersecurity incident response.

Institutional Mechanisms

• Controller of Certifying Authorities (CCA): Regulates digital signature certifying authorities.
• Adjudicating Officers: Handle civil contraventions.
• Cyber Appellate Tribunal (later merged with TDSAT).
• CERT-In: National nodal agency for cyber incident response.

Amendments

• IT (Amendment) Act, 2008:
  • Expanded cybercrime definitions.
  • Introduced data protection principles.
  • Strengthened intermediary liability provisions.
• Subsequent rules notified under the Act to address social media regulation, data retention, and cybersecurity.

Significance

• Backbone of India’s digital legal framework.
• Enabled growth of e-commerce, digital payments, and online services.
• Provides legal tools to address cyber threats, misinformation, and digital fraud.
• Forms the base for later laws such as Digital Personal Data Protection Act, 2023.

Limitations

• Does not comprehensively address personal data protection (handled separately now).
• Rapid technological evolution often outpaces statutory provisions.
• Enforcement challenges due to jurisdictional and capacity constraints

The IT Act, 2000 remains the foundational statute governing cyberspace in India, balancing digital innovation, national security, and user protection within a legal framework.