Background
- Enacted in 2000 to provide a legal framework for electronic governance and cyber activities in India.
- Based on the UNCITRAL Model Law on Electronic Commerce (1996).
- Extended to the whole of India and applies to offences or contraventions committed outside India if the computer system is located in India.
Objectives
- Grant legal recognition to electronic records and digital signatures.
- Facilitate e-commerce and e-governance.
- Define and punish cybercrimes.
- Establish a regulatory framework for intermediaries and cybersecurity.
- Build trust and security in the digital ecosystem.
Scope of the Act
- Applies to electronic records, digital signatures, and electronic transactions.
- Covers individuals, companies, intermediaries, and government agencies.
- Excludes certain documents like:
- Negotiable instruments (except cheques)
- Powers of attorney
- Trust deeds
- Wills
- Sale or transfer of immovable property
Key Definitions
- Electronic Record: Data, record, or information generated, sent, received, or stored in electronic form.
- Digital Signature: Authentication of electronic records using asymmetric cryptosystem and hash function.
- Intermediary: Any person who receives, stores, or transmits electronic records on behalf of others (e.g., ISPs, social media platforms).
- Computer Resource: Includes computers, networks, data, databases, and software.
Major Provisions
1. Legal Recognition
- Electronic records and digital signatures are legally valid (Sections 4 & 5).
2. Cyber Offences and Penalties
- Section 43: Unauthorised access, data damage, virus attacks (civil liability).
- Section 66: Computer-related offences (criminal liability).
- Section 66C: Identity theft.
- Section 66D: Cheating by personation using computer resources.
- Section 66F: Cyber terrorism.
3. Intermediary Liability
- Section 79:
- Provides conditional “safe harbour” to intermediaries.
- Immunity applies only if intermediaries observe due diligence and comply with lawful government directions.
4. Government Powers
- Section 69: Interception, monitoring, or decryption of information for national security and public order.
- Section 69A: Blocking public access to online information under prescribed safeguards.
- Section 70: Protection of Critical Information Infrastructure.
- Section 70B: Establishment of CERT-In for cybersecurity incident response.
Institutional Mechanisms
- Controller of Certifying Authorities (CCA): Regulates digital signature certifying authorities.
- Adjudicating Officers: Handle civil contraventions.
- Cyber Appellate Tribunal (later merged with TDSAT).
- CERT-In: National nodal agency for cyber incident response.
Amendments
- IT (Amendment) Act, 2008:
- Expanded cybercrime definitions.
- Introduced data protection principles.
- Strengthened intermediary liability provisions.
- Subsequent rules notified under the Act to address social media regulation, data retention, and cybersecurity.
Significance
- Backbone of India’s digital legal framework.
- Enabled growth of e-commerce, digital payments, and online services.
- Provides legal tools to address cyber threats, misinformation, and digital fraud.
- Forms the base for later laws such as Digital Personal Data Protection Act, 2023.
Limitations
- Does not comprehensively address personal data protection (handled separately now).
- Rapid technological evolution often outpaces statutory provisions.
- Enforcement challenges due to jurisdictional and capacity constraints
The IT Act, 2000 remains the foundational statute governing cyberspace in India, balancing digital innovation, national security, and user protection within a legal framework.
