The IT Act 2000 Explained for Non-Lawyers

Almost every cyber crime FIR in India carries at least one section from the IT Act 2000, and almost nobody who receives that FIR knows what the section means. This guide explains the Information Technology Act the way a careful friend would: which sections cover which acts, what each punishes, and where the Act stops and the Bharatiya Nyaya Sanhita or the data protection law takes over.

Section numbers and punishments below are quoted for orientation. The authoritative text is the consolidated Act on indiacode.nic.in, and anything that will be argued in a police station or a court should be checked there first.

What the IT Act 2000 is, and how it got its teeth

The Act was passed in 2000 to give legal recognition to electronic records and digital signatures, so that contracts and government filings could move online. Its original criminal provisions were thin. The Information Technology (Amendment) Act, 2008, in force from October 2009, added most of what police use today: identity theft, cheating by personation, privacy violation, sexually explicit content, child sexual abuse material, cyber terrorism, and the legal basis for CERT-In. It also rewrote the safe-harbour rule for platforms.

The Act is administered by MeitY, which makes rules under it, including the IT Rules 2021 that set platform grievance and takedown duties. Offences are investigated by state police and tried in ordinary criminal courts, which is why an IT Act case starts at a cyber police station and not at a ministry. Civil claims for compensation under section 43 go to an adjudicating officer appointed under section 46, usually the state IT secretary, for claims up to ₹5 crore.

The sections that matter, in one table

The fraud sections: 66C and 66D in practice

When a caller persuades someone in Indore to read out an OTP and ₹40,000 leaves the account, the police will usually register section 66C, because the OTP is a unique identification feature used fraudulently, and section 66D, because the caller pretended to be the bank. Alongside them go BNS section 318 for cheating and, if the caller claimed to be a police officer or a court, sections 319 and 204. The IT Act sections carry three years; the BNS cheating section carries up to seven when property is delivered, which is why the BNS provision often drives the seriousness of the case. Our guide to the BNS sections used in cyber cases covers that side, and the section-wise punishment table puts both laws together.

The pairing rule. The IT Act describes the method (a computer, a password, an impersonation online). The BNS describes the harm (cheating, extortion, intimidation). Most cyber FIRs cite both, and a complaint that mentions both is harder to reject at the counter. (Orientation only; verify the sections at indiacode.nic.in.)

The content sections: 66E, 67, 67A and 67B

Section 66E is the privacy section used in sextortion and revenge-image cases: capturing or sharing an image of a person's private area without consent. Section 67 covers obscene material generally; section 67A the narrower category of sexually explicit acts, with heavier penalties; section 67B everything to do with children, including browsing and the online enticement of a child, and it is the section under which merely possessing such material is an offence. Section 67B overlaps with the POCSO Act, and cases are usually registered under both. For the pattern of sextortion and what to do in the first hour, see our page on sextortion and blackmail.

The hacking sections: 43 and 66

Section 43 is a list of things you may not do to someone else's computer without permission: access it, download from it, introduce a virus, damage it, deny access, help someone else do any of this, or tamper with it. The consequence under section 43 is civil: compensation, claimed before the adjudicating officer. Section 66 takes the same list and makes it a criminal offence when done dishonestly or fraudulently. A ransomware attack is therefore both a section 66 offence and a section 43 claim, and the ransom demand adds BNS extortion. Section 43A, on negligent handling of sensitive personal data, is being replaced by the Digital Personal Data Protection Act, 2023; our post on the DPDP Act for individuals explains the new regime.

The institutional sections: 69A, 70B and 79

Three sections create powers rather than offences. Section 69A lets the central government order the blocking of websites, apps and accounts, which is how fake trading apps vanish from the stores after a MeitY order. Section 70B establishes CERT-In and allows it to issue binding directions; the directions of 28 April 2022, with the six-hour incident-reporting rule and 180-day log retention, rest on it, and non-compliance is punishable under section 70B(7). Our CERT-In explainer covers who must comply. Section 79 is safe harbour: a platform is not liable for what users post, provided it observes the due-diligence rules and removes content on notice from a court or the government. The IT Rules 2021 set the conditions, and our guide to the content takedown process explains how to use them.

Procedure: bail, investigation and evidence

Section 77B makes offences punishable with up to three years bailable, which covers most of the fraud and content sections on a first offence. Section 78 allows an officer of inspector rank or above to investigate. Since 1 July 2024 the procedure around an IT Act case runs under the BNSS, including Zero FIRs and electronic complaints, and the evidence rules under the BSA, including the section 63 certificate for electronic records explained in our section 63 guide. Terms you will meet along the way are in the glossary.

If you are holding an FIR and trying to understand what the sections mean for your case, or a station is refusing to add the IT Act sections that fit the facts, our FIR and complaints support reviews the document and drafts the request, at a fee agreed in advance. For professionals who want the full map of the IT Act, BNS, DPDP and BSA, our cyber law programme goes section by section.