Information Technology Act

An "intermediary" is any person who on behalf of another person receives, stores, or transmits an electronic message or provides any service related to it. This includes telecom companies, internet service providers, search engines, social media platforms, online marketplaces, and cloud providers. The definition is broad and determines who gets S.79 safe harbour protection.

An electronic record satisfies any legal requirement for a document to be in writing. This is the foundational provision that gives legal validity to contracts formed electronically, emails, and digitally executed documents under Indian law.

Any person who without permission accesses a computer, downloads or extracts data, introduces viruses, disrupts a computer system, denies access, or assists another in any of these acts is liable to pay compensation to the affected person. The adjudicating officer can award compensation up to Rs. 5 crore; claims above that go to civil courts. This section covers civil liability — criminal liability for similar acts falls under S.66.

A corporate body that possesses, deals with, or handles sensitive personal data and is negligent in implementing reasonable security practices — resulting in wrongful loss or gain to any person — is liable to pay damages by way of compensation. This was the primary data breach liability provision before the DPDPA 2023. "Sensitive personal data" includes passwords, financial information, health data, biometric data, and sexual orientation.

Any act described in S.43 (unauthorised access, data theft, introducing viruses, etc.), when done dishonestly or fraudulently, becomes a criminal offence. The key distinction from S.43 is intent — civil liability under S.43 does not require dishonest intent, but the criminal offence under S.66 does. S.66 is the cyber equivalent of general criminal provisions and is one of the most invoked sections in cybercrime FIRs.

This section criminalised sending "grossly offensive" or "menacing" messages through electronic communication, and messages intended to cause annoyance, inconvenience, or ill will. The Supreme Court struck down S.66A entirely in Shreya Singhal v. Union of India (2015) as unconstitutional, holding it violated Article 19(1)(a) (freedom of speech) and was unreasonably vague. The section no longer exists in law.

The Central or State Government (or any officer authorised) may direct any agency of the government to intercept, monitor, or decrypt information transmitted through any computer resource for specified purposes including sovereignty, security, public order, or prevention of incitement to crime. Any subscriber or intermediary must enable interception or face up to seven years imprisonment. Widely used for lawful interception orders served on telecom and internet companies.

The Central Government (through the Designated Officer) can direct intermediaries to block public access to any information online in the interest of sovereignty, security of the State, public order, decency, or prevention of incitement. This is the statutory basis for all website and URL blocking orders in India, including app bans. Intermediaries must comply or face up to seven years imprisonment.

CERT-In is the national nodal agency for cyber security incident response in India. It operates under MeitY and issues mandatory cyber security directions to organisations. The CERT-In Directions 2022 impose mandatory reporting of cyber incidents within 6 hours, require VPN providers and cloud companies to maintain user data for 5 years, and mandate synchronisation of ICT system clocks to NTP servers.

Intermediaries are not liable for third-party information, data, or communication links hosted on their platforms if: (a) the intermediary does not initiate the transmission or select the recipient, (b) the intermediary does not modify the information, and (c) the intermediary observes due diligence and follows the IT Rules 2021. Safe harbour is lost if the intermediary has actual knowledge of unlawful content and fails to expeditiously remove it after notice.