Cyber Law in India: IT Act, BNS, Data Protection and Online Harms

What does cyber law cover in India?

Cyber law covers offences committed using computers, phones and networks, civil liability for damage to data and systems, the duties of online platforms, the protection of personal data, and the rules for proving electronic records in court. There is no single cyber code. The IT Act 2000 is the core statute, but most cyber fraud cases are also charged under the general offences in the Bharatiya Nyaya Sanhita 2023 (BNS), which replaced the Indian Penal Code from 1 July 2024. Cases registered before that date generally continue under the old law.

Around these sit a set of rules and directions. The IT Intermediary Rules 2021 govern social media and other platforms. CERT-In, the national computer emergency response team, issues binding directions on reporting cyber incidents. The Digital Personal Data Protection Act 2023 creates duties for anyone handling personal data digitally. Sector regulators such as the RBI add their own requirements for banks and payment companies. Knowing which of these applies is usually the first piece of advice a client needs.

IT Act sections that come up most often

These are the provisions we see in most cyber complaints, FIRs and civil claims.

Which law applies to which cyber offence?

Police often register cyber FIRs under both the IT Act and the BNS. The table shows the usual pairings. Punishments are maximums; actual sentences depend on the facts.

Under section 77B of the IT Act, offences punishable with three years or more are cognizable, and offences punishable with three years are bailable. That is why the BNS section added to an FIR, rather than the IT Act section, often decides whether arrest and custody are likely. The bail position for any specific FIR is worth checking with a lawyer; our bail page explains the process.

Can you claim compensation for hacking or data misuse?

Yes. Section 43 of the IT Act gives a civil right to compensation against a person who accesses or damages your computer system or data without permission. Claims up to ₹5 crore are decided by an adjudicating officer appointed under section 46, usually the Secretary of the state government's IT department. Claims above that go to the competent civil court. Appeals against the adjudicating officer's orders lie to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), which took over the work of the old Cyber Appellate Tribunal in 2017.

Section 43A separately makes a company that handles sensitive personal data liable to pay compensation if it is negligent in maintaining reasonable security practices and that causes wrongful loss. Once the relevant provisions of the DPDP Act are in force, section 43A is set to be omitted and data protection complaints shift to the Data Protection Board, so check the current position before filing. In practice, compensation claims under these provisions are less common than criminal complaints, partly because people do not know they exist. For a business that has lost money or customer data to a former employee or vendor, a civil claim combined with an injunction can be more useful than an FIR alone.

Online defamation: criminal complaint, civil suit or takedown?

Defamation on social media, review sites, WhatsApp groups or YouTube can be pursued in three ways, and they can be combined. A criminal complaint for defamation under section 356 of the BNS is filed before a magistrate, not through the police, because the offence is non-cognizable; punishment can include simple imprisonment up to two years, fine or community service. A civil suit for injunction and damages is filed in the district court or, for claims above ₹2 crore, on the original side of the Delhi High Court. A takedown request goes to the platform's grievance officer.

For most clients the civil suit with an interim injunction is the most effective step, because it can order the content removed quickly and bind unknown persons, with the platform directed to disclose the account holder's details. A criminal complaint takes longer and is often met with a quashing petition. Truth, fair comment and public good are defences, and courts protect genuine reviews and criticism, so a business annoyed by a bad but honest review will usually not succeed.

Section 66A of the IT Act, which punished offensive messages, was struck down by the Supreme Court in 2015. Any FIR or notice still citing it should be challenged at once.

How do you get content removed from a platform?

Under the IT Intermediary Rules 2021, every significant social media platform must have a grievance officer in India, whose details are on its website or app. A complaint must be acknowledged within 24 hours and disposed of within 7 days (15 days before the February 2026 amendment). Where the content shows a person in a state of nudity or sexual act, is a morphed or impersonated image, or is otherwise intimate imagery shared without consent, the platform must act within two hours of the complaint (cut from 24 hours by an amendment in force from 20 February 2026). The victim or anyone on their behalf can complain.

If the grievance officer refuses or does not respond, an appeal lies to the Grievance Appellate Committee set up by the Central Government, within 30 days. Courts remain available throughout, and the Delhi High Court has regularly passed orders directing platforms and search engines to remove intimate images and morphed content, including copies uploaded later. Rules on synthetically generated content, such as deepfakes, have been the subject of further amendments, so check the current requirements when the content is AI-generated.

Keep a record before asking for removal: the URL, screenshots showing the account name and date, and if possible a screen recording that shows the content loading. Once it is taken down, it is much harder to prove it existed.

Sextortion and intimate images: the legal position

Sextortion, where someone threatens to share intimate images or videos unless paid, is extortion under section 308 of the BNS, and usually also an offence under sections 66E, 67 or 67A of the IT Act. It affects men as often as women, frequently through a video call that is recorded and then used for threats. The law treats the person threatened as a victim, whatever the circumstances in which the images were made.

Do not pay. Payment almost never ends the demands. Preserve the chats, numbers, payment IDs and profile links, report on cybercrime.gov.in or at the cyber police station, and ask the platforms to remove any content under the 24-hour rule. Where the victim is a woman, her identity is protected by law, and statements are recorded by a woman officer. Where the victim is a child, the POCSO Act applies and reporting is mandatory. Our pages on cyber crime cases and sexual offence cases cover the practical steps.

What the Digital Personal Data Protection Act 2023 requires

The DPDP Act applies to anyone who decides why and how personal data is processed in digital form, called a data fiduciary. It requires a clear notice and free, specific consent for processing, or one of the limited legitimate uses the Act allows, such as employment purposes. Data must be used only for the purpose collected, kept accurate, protected with reasonable security safeguards and erased when no longer needed. Children's data needs verifiable parental consent, and tracking or targeted advertising aimed at children is restricted.

Individuals, called data principals, have rights to information about processing, correction and erasure, grievance redressal and nomination. Complaints go first to the data fiduciary and then to the Data Protection Board of India, with appeals to TDSAT. The Board can impose penalties that run up to ₹250 crore for a failure to take reasonable security safeguards. The DPDP Rules were notified in November 2025 with a phased start, so different obligations apply from different dates.

For a small business, the practical work is a data map (what personal data you hold, where and why), a privacy notice in plain language, a consent record, contracts with vendors who process data for you, and a breach response plan. Our contracts and documentation page covers drafting of privacy policies and data processing agreements.

Data breach at your company: what has to happen and when

A company that suffers a cyber incident may have reporting duties within hours. CERT-In's directions of April 2022 require specified incidents, including data breaches, ransomware, unauthorised access and attacks on servers, to be reported to CERT-In within six hours of noticing them. Service providers and companies must also keep logs of their systems for a rolling 180 days within India. Under the DPDP Act, a personal data breach must be intimated to the Data Protection Board and to each affected person in the manner the rules prescribe.

Separately, the company should preserve evidence before systems are restored, decide whether a police complaint is needed, notify its insurer if it has cyber cover, and check its contracts with customers and vendors for notice obligations. Regulated entities such as banks, NBFCs and payment operators have additional reporting to their regulators. Each of these runs on a different clock, which is why a written response plan, agreed in advance, saves a great deal of confusion on the day.

How we work through a data breach or cyber incident for a business

This is the order in which we usually advise a company after a breach or a serious internal data theft. The technical containment is done by your IT team or forensic firm; our role is the legal side.

1. Fix the facts and the clock

   We note when the incident was detected, what systems and data are involved and who knows. The detection time starts the CERT-In six-hour window and fixes other deadlines. We ask the IT team for a short written summary, not a guess.

2. Preserve evidence

   Before systems are wiped or restored, images of affected machines, server logs, access logs and email headers are preserved with hash values. A forensic firm should document the chain of custody so the material can be proved later under section 63 of the BSA.

3. Make the mandatory reports

   We prepare the CERT-In report, the intimation to the Data Protection Board and affected persons where the DPDP Act applies, and any regulator notice. Wording matters, because these reports may later be read in litigation.

4. Decide on police and civil action

   If an employee, vendor or outsider is identified, we decide between a police complaint, a civil suit for injunction and damages, or both. Where data has been taken to a competitor, an urgent injunction is often the priority.

5. Deal with customers, insurers and contracts

   We review customer contracts, vendor agreements and cyber insurance for notice duties and liability caps, and draft communications that are accurate without admitting more than the facts show.

Electronic evidence: why the section 63 certificate matters

Electronic records such as emails, chats, call records, CCTV footage and server logs are admissible, but a copy has to be supported by a certificate under section 63 of the Bharatiya Sakshya Adhiniyam 2023, which replaced section 65B of the Evidence Act. The BSA prescribes a two-part certificate in its schedule, one part signed by the person in charge of the device or system and one by an expert, and it asks for hash values identifying the record.

Screenshots alone are weak evidence if the other side disputes them. A better record is the original device, an export of the chat with metadata, or a forensic image. Where you rely on someone else's system, such as a bank's transaction log or a platform's account data, ask the court or the investigating officer to obtain it with a proper certificate. Many cyber cases fail at trial not because the offence did not happen, but because the electronic evidence was collected carelessly in the first week.

Hacking, account takeover and data taken by employees

When an email account, social media page or business system is taken over, the immediate steps are technical: regain control, change credentials, turn on two-factor authentication and inform the platform. The legal steps follow. A police complaint under sections 43 and 66 of the IT Act, with the access logs and recovery emails, is appropriate where the intruder is unknown or the damage is serious.

Data taken by a departing employee is a different problem. The employee usually had authorised access, so the question is whether copying or sending client lists, source code or pricing files to a personal account breached the employment contract, confidentiality obligations and section 72A of the IT Act on disclosure in breach of a lawful contract. A civil suit for injunction, filed quickly with evidence of the downloads, can stop use of the data. Criminal breach of trust under section 316 of the BNS may also apply. Clear contracts and access controls at the start of employment make all of this far easier to prove.

Cyber stalking, trolling and fake profiles

Repeated unwanted contact online, monitoring a woman's internet or email use, or creating accounts to follow and harass someone can amount to stalking under section 78 of the BNS. Threats sent online are criminal intimidation under section 351, and anonymous threats are punished more heavily. Fake profiles using someone's name and photographs to cheat others fall under sections 66C and 66D of the IT Act and cheating by personation under the BNS.

Report the profile to the platform first, using its impersonation form, and keep the evidence. If the harassment continues or includes threats, a complaint to the cyber police station or on the national portal is the next step. Where the person is known, such as a former partner or colleague, a civil injunction restraining contact can sometimes be obtained faster than a criminal case progresses. If the stalking is linked to a workplace, the POSH Act route may also be available.

Technology contracts and compliance work

Much cyber law work is preventive. Software development agreements, SaaS terms, data processing agreements, website terms of use and privacy policies, IT outsourcing contracts and employee confidentiality and IP assignment clauses all decide who bears the loss when something goes wrong. A badly drafted contract often leaves a company with no clear claim against a vendor whose negligence caused a breach.

We draft and review these documents with the technical facts in view: where data is stored, who has administrative access, what the service levels actually measure, and what happens to data at the end of the contract. Startups and small businesses in Delhi NCR often come to us at incorporation stage, and our corporate law page covers that side. Ownership of software and content is also an intellectual property question, explained on our trademark and copyright page.

How to preserve digital evidence before you complain

• Take screenshots that show the account name, profile link, date and time.
• Record the screen while scrolling through the content, so it shows the content loading live.
• Copy the URL of each post, profile and message.
• Export chats with media from WhatsApp or other apps, and keep the original phone.
• Note transaction IDs, UPI IDs, bank account numbers and amounts.
• Save emails with full headers, not just a forwarded copy.
• Do not confront the person or delete your own messages.
• Keep a written timeline of what happened and when.

Where cyber cases are heard in Delhi NCR

Criminal cyber cases start at the police. Delhi Police has a cyber police station in each district, and its Special Cell unit known as IFSO deals with larger and inter-state cyber crimes. In Noida and Ghaziabad, the police commissionerates have cyber crime police stations and cyber cells at the local stations. Trials of IT Act and BNS cyber offences usually take place before the magistrate's courts in the relevant district court complex, such as Saket, Dwarka or Rohini in Delhi, the Gautam Buddh Nagar courts at Surajpur, or the Ghaziabad district court.

Civil defamation and takedown suits above ₹2 crore go to the original side of the Delhi High Court; smaller suits go to the district courts. Writ petitions for blocking of intimate images, challenges to account freezes and quashing petitions under section 528 of the BNSS go to the High Court. Compensation claims under section 43 go to the state's adjudicating officer. Data protection complaints, once the relevant provisions are in force, go to the Data Protection Board. For criminal procedure more generally, see our criminal law practice page.

Mistakes people make with cyber problems

The commonest mistake is waiting. In fraud cases the money moves through several accounts within hours, and in takedown cases the content is copied. The second is deleting things in embarrassment or anger, including one's own messages, which removes the evidence that would have proved the case. The third is paying a blackmailer, which leads to further demands.

Businesses make different mistakes: restoring systems before preserving logs, emailing customers before the facts are known, and having no contract term that obliges the vendor to cooperate. Accused persons make their own: making statements to the police or the complainant without advice, handing over devices without a seizure memo, and assuming an IT Act case is minor when a BNS cheating section has also been added.

Costs, time and how we take on cyber law matters

Fees are discussed at the first meeting and agreed in writing, stage by stage, whether the work is a complaint and follow-up with the police, a takedown and civil suit, a quashing petition or compliance drafting. Court fees, forensic charges and other out-of-pocket costs are separate. A takedown through a platform can take days; a civil injunction can come within weeks; a criminal trial can take years.

Advocate Sadhna Singh usually takes the first call and organises the evidence. Advocate B.K. Singh reviews the technical material, drafts the complaint or petition and appears in court. To share your papers or screenshots, use the enquiry page. For the full criminal side of our work, including other agencies and offences, see the criminal law practice hub.