Cyber & technology
Cybercrime, the IT Act, data protection and online fraud.
Questions advocates ask about Cyber & technology
Online fraud is prosecuted under the Bharatiya Nyaya Sanhita and sections 66C and 66D of the Information Technology Act, and a complaint can be made on the National Cybercrime Reporting Portal. An electronic record is proved with the certificate that section 63 of the Bharatiya Sakshya Adhiniyam requires, and the DPDP Act obligations are coming into force in stages.
Which provisions cover common online offences?
Using another person's password or electronic signature is identity theft under section 66C of the Information Technology Act, and cheating by personation using a computer resource falls under section 66D. Each carries imprisonment up to three years and a fine up to ₹1 lakh. Publishing obscene material electronically is covered by section 67, and capturing or sharing images of a person's private area without consent by section 66E. Online cheating is also an offence under the general law of cheating in the Bharatiya Nyaya Sanhita. Section 66A, which punished offensive messages, was struck down.
Information Technology Act, 2000, ss. 66C, 66D, 66E, 67; BNS s. 318 (cheating; formerly IPC ss. 415 and 420); Shreya Singhal v. Union of India, (2015) 5 SCC 1
Where and how is a cyber fraud reported?
On the National Cybercrime Reporting Portal at cybercrime.gov.in, or on the helpline 1930 for financial fraud, which lets the bank be alerted quickly to hold the money. A complaint can also be made at a local or cyber police station, and the police must register an FIR where a cognizable offence is disclosed. Under the Information Technology Act, an offence is investigated by an officer not below the rank of Inspector.
Information Technology Act, 2000, s. 78; BNSS s. 173 (formerly CrPC s. 154)
How is an email, chat or screenshot proved in court?
By producing the electronic record with the certificate that section 63 of the Bharatiya Sakshya Adhiniyam requires, which replaces section 65B of the Evidence Act. The Supreme Court held in Arjun Panditrao Khotkar that the certificate is a condition for admitting a copy such as a printout or a disc, but is not needed where the original device itself is produced and proved. The court may permit the certificate to be produced later in the trial. Under the BSA the certificate follows the form given in its Schedule and is signed by the person in charge of the device and by an expert.
BSA s. 63 (formerly Evidence Act s. 65B); Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, (2020) 7 SCC 1
When is a platform liable for what a user posts?
An intermediary is protected from liability for third-party content under section 79 of the Information Technology Act if it only gives access, does not start the transmission or choose or change the content, and follows the due diligence the Rules require. The Supreme Court has read down the takedown provision so that an intermediary must act on actual knowledge, which means a court order or a notification from the appropriate Government agency, and not a private complaint. The 2021 Rules add duties such as a grievance officer and time limits for acting on complaints.
Information Technology Act, 2000, s. 79; Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021; Shreya Singhal v. Union of India, (2015) 5 SCC 1
When do the data protection duties under the DPDP Act apply?
The Digital Personal Data Protection Act, 2023 applies to the processing of digital personal data in India, and outside India where it relates to offering goods or services to people in India. It rests on notice and consent, and gives data principals the rights to access, correct and erase their data and to seek redress. The Rules were notified in November 2025 and bring the law into force in stages: the provisions setting up the Data Protection Board first, and most duties of data fiduciaries about 18 months after the Rules, in May 2027. The penalty for failing to take reasonable security safeguards can go up to ₹250 crore. Check the current notification for each provision.
Digital Personal Data Protection Act, 2023, ss. 4, 5, 6, 8, 11 to 14, 33 and the Schedule; Digital Personal Data Protection Rules, 2025
Prepared by The EduLaw Editorial Team on 5 November 2026. It has not yet been reviewed by a named advocate. Educational content, not legal advice; check the current text of each provision before relying on it.
Judgments and analysis
- How Senior Advocates Kill a 498A Trial in Cross-Examination | EduLaw
- MP High Court Landmark Guidelines on Bank Account Freezing in Cyber Fraud Cases Archana v. State of M.P. (2026)
- BCI Social Media Code of Conduct for Advocates 2026 Circular No. BCID-4657/2026 Explained Complete Analysis
- How to Read a Chargesheet and Find Weak Points: Advocate's Practical Guide 2026
- MP High Court Slams Cyber Crime Cells: Banks Cannot Freeze Entire Account Over Suspected Fraud Dekain Perfect Tech v IDFC First Bank (2026)
- Mental Harassment & Legal Remedies in India: Rights, Evidence & Procedure for Men, Women & Families | EduLaw
- Can A Fake Video Send Someone To Jail? India's Deepfake Evidence Crisis in India
Ready-to-file drafts
2,100+ editable Indian legal drafts across 40+ practice areas — applications, petitions, notices, replies and agreements. See the drafts bundle.