Information Technology Cyber Laws Notes | LL.M. Semester 3 | Mumbai University | munotes

A smartphone is a computer under this definition, and so is the electronic control unit in a modern car, a smart television, and the card reader at a shop counter. Anything that processes data at high speed by manipulating impulses qualifies. Section 2(1)(ha) separately defines a communication device to mean cell phones, personal digital assistance or a combination of both or any other device used to communicate, send or transmit any text, video, audio or image, so a phone is both.

Hardware

Hardware is the physical part: the machine you could drop on your foot. Four pieces matter for law.

The processor, often called the CPU or central processing unit, is the part that actually performs the arithmetic and logic. It holds no data of its own for more than an instant. Nothing useful for an investigation survives in it once the power goes off.

Memory, usually called RAM or random access memory, is the working space. It is fast, it is where a running program and its current data sit, and it is volatile: switch the machine off and its contents are gone. That single fact drives a rule of digital forensics, that a live machine at a crime scene should be imaged before it is switched off, because what is in memory at that moment includes decryption keys and open network connections that will never be recovered afterwards.

Storage, the hard disk or solid state drive, is where data survives a power cut. It is what is seized, imaged and examined. It matters legally that deleting a file usually does not erase the data: it marks the space as reusable, so the content remains until it is overwritten, which is why a deleted file is often recoverable and why an accused cannot assume that pressing delete has ended the matter.

Input and output devices are the keyboard, the mouse, the camera, the screen, the printer and the network card. Section 2(1)(l) expressly includes input and output support devices in the definition of a computer system.

Software

Software is the set of instructions that tells the hardware what to do. It is not a physical thing. It is a sequence of instructions, written by a human being in a language a human being can read and then translated into a form the machine executes.

Source code is the human-readable version. A programmer writes lines that another programmer can read and change. Object code, or machine code, is the version the processor executes, and it is unreadable to a person. The translation from one to the other is done by a program called a compiler.

That distinction carries a whole section of the Act. Section 65 makes it an offence to knowingly or intentionally conceal, destroy or alter computer source code, and its Explanation defines computer source code to mean the listing of programmes, computer commands, design and layout and programme analysis of computer resource in any form. Source code is what a business actually owns and what a departing employee can take. Chapter 1170 works section 65 in full.

Software divides into two kinds. System software runs the machine itself: the operating system, such as Windows, Android, macOS or a Linux distribution, and the drivers that let it speak to hardware. Application software does a job for the user: a browser, a spreadsheet, a banking app. Malware is application software written to do harm, and chapter 210 works its varieties.

Data, and the difference between data and information

Data is raw. Information is data that means something. The number 9820044556 is data. The statement that it is Meera's mobile number is information.

The Act keeps the two apart and defines each separately, which is unusual and deliberate. Section 2(1)(o) defines data as a representation of information, knowledge, facts, concepts or instructions which are being prepared or have been prepared in a formalised manner, and is intended to be processed, is being processed or has been processed in a computer system or computer network, and may be in any form, including computer printouts and magnetic or optical storage media, or stored internally in the memory of the computer.

Section 2(1)(v) defines information to include data, message, text, images, sound, voice, codes, computer programmes, software and data bases or micro film or computer generated micro fiche.

So under the Act, information is the wider word and data is inside it. A printout is data, because the definition says so in terms. That matters: a person who steals a printed report has taken data within the meaning of section 43(b), even though nothing electronic was touched at the moment of taking.

Networks

A network is two or more computers connected so that they can exchange data. Section 2(1)(j) defines a computer network as the inter-connection of one or more computers or computer systems or communication devices through the use of satellite, microwave, terrestrial line, wire, wireless or other communication media, and terminals or a complex consisting of two or more interconnected computers or communication devices, whether or not the inter-connection is continuously maintained.

The last nine words carry weight. "Whether or not the inter-connection is continuously maintained" means a network exists even when the connection is intermittent. A phone that connects to a server only when the user opens an app is still part of a computer network for the purposes of the Act.

Chapter 30 works out how the internet, the largest network there is, actually moves data, because every jurisdictional question in Module III depends on it.

The four words the Act uses, side by side

Computer resource is the widest of the four and the one to watch. It is the only one that includes data, a database and software, so an offence framed in terms of a computer resource reaches things that are not machines at all. Sections 66F, 69, 69A, 69B and 79 are all drafted using it.

A worked example

Meera runs a small logistics business in Vashi. She keeps her consignment records in a spreadsheet on a desktop computer in her office. The desktop is connected by cable to a printer and to a second machine used by her accountant, and both connect through a router to the internet, where she uses a cloud service to back the spreadsheet up each night.

Rohit, a former employee, uses a password he still knows to log in from home and delete three months of records.

Now apply the vocabulary. The desktop is a computer under section 2(1)(i). The desktop together with its keyboard, monitor and printer is a computer system under section 2(1)(l). The desktop, the accountant's machine, the router and the cloud server are together a computer network under section 2(1)(j), and the interconnection is not continuous, which the definition says does not matter. The spreadsheet file is data under section 2(1)(o) and also information under section 2(1)(v). All of it is a computer resource under section 2(1)(k).

Rohit has gained entry into the memory function resources of a computer, which is access as defined in section 2(1)(a), and he has done so without Meera's permission. That engages section 43. Because he did it dishonestly, it also engages section 66. Chapters 1100 and 1180 work those two sections in full; the point here is that not one of those conclusions can be reached without the vocabulary.

What this does NOT mean

It does not mean the Act only applies to the internet. Nothing in the definitions requires a network at all. A standalone machine with no connection is a computer, and altering data on it is caught by section 43(i) exactly as if it were online.

It does not mean a calculator is a computer system. Section 2(1)(l) expressly excludes calculators which are not programmable and capable of being used in conjunction with external files. A programmable one is not excluded.

It does not mean information technology law is only the IT Act. The Act is the centre of it, but copyright in software is in the Copyright Act 1957, the general offences that a cyber crime also discloses are in the Bharatiya Nyaya Sanhita 2023, the proof of an electronic record is in the Bharatiya Sakshya Adhiniyam 2023, and personal data will be governed by the Digital Personal Data Protection Act 2023. Chapter 120 maps the whole field.

Quick revision

• Information technology: capturing, representing, storing, transmitting and presenting information by machine, with the hardware and software that do it.
• Four functions: input, processing, storage, output. The Act's definition of a computer follows exactly that shape.
• Section 2(1)(i) computer: high-speed data processing device performing logic, arithmetic and memory functions, including its input, output, storage, software and communication facilities.
• Section 2(1)(l) computer system: device or collection of devices, excluding a non-programmable calculator.
• Section 2(1)(j) computer network: interconnection by any medium, whether or not continuously maintained.
• Section 2(1)(k) computer resource: the widest term. Computer, computer system, computer network, data, database or software.
• Section 2(1)(o) data against section 2(1)(v) information: information is the wider word and includes data.
• Source code is human-readable; object code is what the machine runs. Section 65 protects source code.
• RAM is volatile; storage is not. Deleting a file usually does not erase it.

Test yourself

1. Give the statutory definition of a computer and say what three features it has. Section 2(1)(i): any electronic, magnetic, optical or other high-speed data processing device or system which performs logical, arithmetic and memory functions by manipulations of impulses, including its input, output, processing, storage, software and communication facilities. It is technology neutral, functional rather than descriptive, and inclusive of the peripherals and the software.

2. Ravi photographs a printed customer list belonging to his employer and sells it. Has he taken "data"? Yes. Section 2(1)(o) says data may be in any form "including computer printouts", so a printout of processed data is data. Whether an offence under the Act is made out depends on the other sections, but the object taken is data.

3. Which of the four terms is the widest, and why does it matter? Computer resource, in section 2(1)(k), because it alone includes data, a computer database and software as well as the machines. It matters because the sections dealing with cyber terrorism, interception, blocking and intermediary liability are all drafted around it, so their reach is not limited to hardware.

4. Is an unconnected laptop outside the Act? No. The definitions do not require connectivity. A standalone machine is a computer and a computer system, and offences such as those in section 43 and section 66 apply to it.

5. Why does the distinction between source code and object code matter in law? Because section 65 makes it an offence to conceal, destroy or alter computer source code required to be kept by law, and because copyright litigation over software usually turns on access to and comparison of source code, which the object code does not reveal.

Files, folders and file systems

A file is a named block of data that the operating system keeps track of. The file system is the index: it records where on the disk each file's data physically sits, what it is called, when it was created, when it was last modified, and who may read it.

Deleting a file usually removes the index entry, not the data. The operating system marks the space as available for reuse and stops showing the file. Until something else is written over that space, the content is still there, and forensic software recovers it by reading the disk directly instead of asking the file system. This is why an investigator images a disk rather than browsing it, and why an accused who deleted a file has not necessarily destroyed the evidence.

Overwriting is different from deleting. Software that writes random data over the space repeatedly does destroy the content. Deliberate overwriting after an investigation begins is the electronic equivalent of destroying a document, and section 65 of the Act makes the destruction of source code required to be maintained by law an offence in its own right.

Metadata

Metadata is data about the data. A photograph taken on a phone carries, inside the same file, the date and time it was taken, the make and model of the phone, the camera settings and, if location services were on, the latitude and longitude. A word processing document carries the author's name, the times of creation and last modification, and often a record of earlier edits.

Metadata is frequently the most useful evidence in the file, and it is also the least considered. A defence that a photograph was taken in one place is answered by the coordinates inside it. A claim that a document was drafted before a certain date is answered by its creation timestamp.

It is also fragile. Sending a photograph through some messaging applications strips the metadata, uploading it to some websites strips it, and opening and saving a document changes the modification time. That is why the rule in forensics is to work on an image of the original medium, and why a copy forwarded by WhatsApp is a much weaker exhibit than the file taken off the device.

The hash: a fingerprint for data

A hash function takes any amount of data and produces a short fixed-length number from it. Feed it a one-page letter or a two-hour film and you get, in the widely used SHA-256 function, the same 256 bits out.

Three properties make it useful in law. It is deterministic: the same input always gives the same output. It is one way: from the output you cannot work back to the input. And it is collision resistant: it is not practically possible to find two different inputs that produce the same output.

So the hash behaves as a fingerprint for a body of data. Change one character anywhere in a ten thousand page file and the hash changes completely. Two files with the same hash are, for practical purposes, the same file.

This is used at three points in this subject. It is how a digital signature works, because what is actually signed is the hash rather than the document, and chapter 280 works that in detail. It is how a forensic image is proved to be a true copy: the examiner records the hash of the original medium and of the image, and if the two match, the image is unaltered. And it is how a court can be shown that an exhibit produced at trial is the same file that was seized months earlier.

The University set a short note on "the importance of Hash Value" on the 2024-25 paper, and the three properties above are the answer.

Logs

A log is a file in which a system records what happened, with times. A web server logs each request with the requesting address and the time. An operating system logs each login. A bank logs each transaction. A router may log which internal device used which external address.

Logs are the ordinary evidence of a cyber offence, because the offence usually leaves no other trace. They are also the reason the law imposes retention duties on people who did nothing wrong: rule 3(1)(g) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 requires an intermediary to preserve information for one hundred and eighty days, section 67C of the Act requires intermediaries to preserve and retain information as prescribed, and the CERT-In directions of 28 April 2022 require logs to be maintained for one hundred and eighty days within India. Chapter 1240 owns section 67C and the retention rules, and chapter 770 owns the CERT-In directions.

Logs are also easy to lose. Many systems overwrite them after days. That is the practical reason a complaint made a week after an incident often cannot be investigated at all, and it is the reason the Budapest Convention has an article devoted to expedited preservation.

Encoding, encryption and compression, which are three different things

Students routinely call an encoded file encrypted. They are not the same and the legal consequences differ sharply. Section 69 of the Act gives a power to require decryption assistance and section 84A empowers the Central Government to prescribe modes and methods of encryption. Neither has anything to say about encoding. Chapters 800 and 830 own those two.

A worked example

Arjun, an auditor, is asked to prove that a spreadsheet produced by a company in 2026 is the same one it produced to him in 2024.

He compares hashes. In 2024 he recorded the SHA-256 hash of the file he received. In 2026 he computes the hash of the file produced. If the two are identical, the file is byte for byte the same and nothing has been altered. If they differ, something changed, though the hash does not tell him what.

He looks at metadata. The 2026 file shows a modification timestamp in March 2025, which is after the 2024 delivery. That alone suggests alteration, although a timestamp can be changed by someone who sets out to change it, so it corroborates the hash comparison rather than replacing it.

He asks for the logs. The company's document management system logs each save with the user account. Those entries, if kept, name the person and the time.

None of the three is a legal conclusion, but between them they turn "the file looks different" into evidence that a court can act on. Chapter 1270 works how such evidence is actually admitted.

What this does NOT mean

It does not mean a hash proves who made a change. It proves only that a change was made. Attributing it to a person needs logs, metadata or a signature.

It does not mean deleted data is always recoverable. Solid state drives reorganise themselves and may erase deleted blocks quickly, encrypted storage becomes unreadable once the key is gone, and deliberate overwriting destroys content. Recoverability is a question of fact for the examiner, not a rule of law.

It does not mean metadata is conclusive. It can be edited, and a court treats it as evidence to be weighed and not as an incontrovertible fact.

Quick revision

• Bit is one binary digit; eight bits are a byte. Text, images and sound are all numbers by convention.
• A copy is exact, and an alteration leaves no visible trace. Chapter II of the Act exists because of that.
• Deleting removes the pointer, not the data. Overwriting removes the data.
• Metadata is data about the data: author, timestamps, device, location. Powerful and fragile.
• A hash is a short fixed-length fingerprint. Deterministic, one way, collision resistant. Used for digital signatures, forensic imaging, and proving an exhibit is unchanged. Asked as a short note in 2024-25.
• Logs record what happened and when, are the ordinary evidence of a cyber offence, and are subject to retention duties under section 67C, rule 3(1)(g) and the CERT-In directions.
• Encoding, compression and encryption are three different things. Only encryption is meant to keep a secret.

Test yourself

1. Why does the law need a special rule for proving an electronic record when it has no such rule for a letter? Because an electronic copy is identical to its source and an alteration leaves no physical trace, so the ordinary reasons for trusting a document, its handwriting, its paper and its wear, do not exist. Section 63 of the Bharatiya Sakshya Adhiniyam supplies a substitute assurance.

2. State the three properties of a hash function and give one legal use of each. Deterministic, so the same file always yields the same value and an exhibit can be matched to a seized original. One way, so publishing the hash of a document does not disclose the document. Collision resistant, so a party cannot produce a different document with the same value, which is what makes a digital signature meaningful.

3. A witness says he deleted the file, so nothing can be recovered. Is he right? Not necessarily. Deletion normally removes the file system's index entry while leaving the content on the medium until it is overwritten, so the data is often recoverable by imaging the disk. Whether it is recoverable in the particular case is a question for the examiner.

4. Distinguish encoding from encryption. Encoding represents data in an agreed format and is undone by anyone who knows the format; it keeps no secret. Encryption transforms data so that it can be read only with a key. Section 69 of the Act deals with decryption; encoding is not addressed at all.

5. Why do retention obligations exist for intermediaries who have done nothing wrong? Because the evidence of an offence exists only in logs and records that systems overwrite in the ordinary course, and by the time a complaint is investigated it would otherwise be gone. Hence section 67C, rule 3(1)(g) of the 2021 Rules and the CERT-In direction on one hundred and eighty day log retention.

Protocols and the layers

A protocol is an agreed set of rules for how machines talk. The internet works because everybody uses the same ones. Four matter for law.

The Internet Protocol, IP, does addressing and routing. It gives each machine an address and gets packets from one address to another. It makes no promise that they will arrive.

The Transmission Control Protocol, TCP, makes the connection reliable. It numbers the packets, notices which did not arrive, asks for them again, and puts them in order. Together these two are usually written TCP/IP.

The HyperText Transfer Protocol, HTTP, is what browsers and websites speak. Its secure form, HTTPS, wraps the conversation in encryption so that the intermediaries carrying it can see who is talking to whom but not what is said. That single fact is the reason a great deal of modern interception is about metadata rather than content.

The Domain Name System, DNS, translates names into addresses, and it is dealt with below.

IP addresses

Every machine on the internet has a numerical address. In the older and still dominant version, IPv4, it is four numbers from 0 to 255, written as 203.0.113.45. There are about four billion such addresses, which ran out, so a newer version, IPv6, provides a vastly larger space and is written as eight groups of hexadecimal digits.

An address usually identifies a connection, not a person, and often not even a device. Three mechanisms break the link that students assume.

Addresses are usually shared. A home or office router holds one public address and uses network address translation to let every device behind it share that address. So an address identifies the household, not the person at the keyboard.

Addresses are usually temporary. An internet service provider allocates an address to a subscriber for a period and reallocates it afterwards. To connect an address to a subscriber you need the address and the exact time, and you need the provider's logs, which is why the retention obligations in chapter 1230 matter and why a complaint made too late cannot be investigated.

Addresses can be deliberately hidden. A virtual private network, or VPN, routes the traffic through an intermediate server so that the destination sees the VPN's address; a proxy does the same; the Tor network chains several such hops with layered encryption so that no single machine knows both ends.

So an IP address is a starting point for an investigation and never a conclusion. Courts have had to be told this repeatedly, and it is the honest answer to an examination problem that supplies an address and asks who is liable.

The Domain Name System

People use names and machines use numbers, and the DNS is the translation. When a browser is given munotes.in it asks a DNS resolver for the corresponding address and then connects to that address.

The name space is hierarchical and it is administered. At the top are the root servers. Below them are the top level domains: generic ones such as .com and .org, and country code ones such as .in for India. Under each, a registry keeps the register and accredited registrars sell registrations to the public. The global coordination of names and numbers is done by the Internet Corporation for Assigned Names and Numbers, ICANN, and .in is administered by the National Internet Exchange of India, NIXI.

That administration is why domain names, alone among internet resources, have a working dispute resolution system. ICANN's Uniform Domain-Name Dispute-Resolution Policy and NIXI's .IN Domain Name Dispute Resolution Policy are contractual conditions of registration, and they allow a trade mark owner to have a name transferred without going to court. Chapter 1070 owns domain names and cybersquatting.

Who does what: the roles in section 2(1)(w)

Nothing in that list is about ownership of content. Every one of them is a description of a service performed on somebody else's message, which is precisely why the safe harbour in section 79 is available to all of them and why chapter 1360 has to work out its conditions carefully.

Client, server and the cloud

A server is a machine that waits for requests and answers them; a client is the machine that asks. Your phone is the client, the machine holding the website is the server.

Cloud computing means renting somebody else's servers, so the data of an Indian business may sit on machines in Singapore owned by a company in the United States and operated by staff in Ireland. That single arrangement produces most of the hard questions in chapter 1030 and in chapter 880 on getting evidence from abroad.

A worked example: what happens when Priya opens a website

Priya, in Thane, types munotes.in into her browser.

Her computer asks a DNS resolver, usually run by her internet service provider, for the address matching that name. The resolver answers with an IP address.

Her computer opens a TCP connection to that address and sends an HTTPS request for the page. The request leaves her laptop, goes to her router, which replaces her private address with the household's public address, then to her internet service provider, then across one or more networks, possibly through a submarine cable and a different country, to the machine that hosts the site.

The server answers with the page, cut into packets, which return by whatever route is available and are reassembled by her machine.

Now ask the legal questions. Whose computer resource was used? Hers, her provider's, several carriers' and the host's. Where did the transaction happen? In at least two countries. Who is an intermediary here? Her internet service provider, every carrier in between, and the web host. What could each of them see? Her provider saw that she connected to that address at that time; because the connection was encrypted, it did not see what she read. Which of them could be ordered to block the page? Her provider, under section 69A, and the host, under the same power or under rule 3(1)(d) of the 2021 Rules.

Every one of those answers is worked in a later chapter. The point here is that all of them are questions about the mechanics.

What this does NOT mean

It does not mean nobody governs the internet. ICANN administers names and numbers, the Internet Engineering Task Force sets the protocols, the regional registries allocate addresses, and every national government regulates the providers within its territory. There is no single owner, which is a different thing.

It does not mean traffic between two Indian users stays in India. It often does not, because routing follows commercial and technical convenience, and because the service may be hosted abroad.

It does not mean an IP address identifies a person. It identifies a connection at a time, and only the provider's logs link that to a subscriber, who may not be the user.

It does not mean encryption defeats all investigation. Encryption of the content leaves the metadata visible: who connected to whom, when, and how much passed. Section 69B and the traffic data rules exist for exactly that layer, and chapter 820 owns them.

Quick revision

• Packet switching: the message is cut into numbered packets, routed independently and reassembled. Hence no single path, routine crossing of borders, and no central switch.
• TCP/IP: IP addresses and routes, TCP makes it reliable. HTTPS encrypts the content but not the fact of the connection. DNS turns names into numbers.
• An IP address is shared, temporary and maskable. It needs the provider's log plus the exact time to reach a subscriber, and the subscriber is not necessarily the user.
• DNS is administered, by ICANN globally and NIXI for .in, which is why domain names have the UDRP and INDRP.
• Section 2(1)(w) lists intermediaries by the role they play in moving or holding somebody else's message. Section 2(1)(na) separately defines a cyber cafe.
• Cloud computing means the data is on rented servers, often abroad, which produces the jurisdiction and evidence problems of Module III.

Test yourself

1. Explain packet switching and give two legal consequences. The message is divided into packets, each carrying source, destination and sequence number, and each routed independently to be reassembled at the far end. Consequences: there is no single path to intercept, so interception is done at the service provider under section 69 rather than on the wire; and packets routinely cross States neither party chose, which is the root of the jurisdiction problem in topic 3.4.

2. A complainant gives the police an IP address. What else does an investigator need before anybody can be identified? The exact date and time of the connection, because addresses are reallocated; the internet service provider's subscriber logs for that period, which are retained only for a limited time; and evidence connecting the subscriber's connection to the individual, because a household address is shared and may be behind a VPN or proxy.

3. What is DNS and why does it matter legally? It is the hierarchical system translating domain names into IP addresses. It matters because it is administered rather than anarchic, which is what makes the UDRP and INDRP dispute policies possible and what makes DNS-level blocking technically feasible.

4. Why does the definition of intermediary in section 2(1)(w) list so many different businesses? Because each is a different role performed on somebody else's electronic record: carrying it, storing it, indexing it, or providing a place for it. The safe harbour in section 79 turns on the service performed rather than on the kind of company, so the list describes functions.

5. If a page is served over HTTPS, what can the internet service provider see? That the subscriber's connection contacted a particular address at a particular time and how much data passed, which is traffic data. It cannot ordinarily read the content. This is why section 69B and the Monitoring and Collecting Traffic Data Rules 2009 address the metadata layer separately from section 69.

Everything happens through an intermediary. In the physical world most wrongs are done directly by the wrongdoer. Online, the message reaches its audience only because a series of businesses carried, stored, indexed or displayed it. That single fact is why a whole branch of this subject is about the liability of people who did not write the words.

The four answers legal systems have tried

The first answer was that cyberspace is a separate place that ordinary law should leave alone. This was argued seriously in the 1990s: that the network is a jurisdiction of its own, governed by its own norms, and that a State claiming to regulate it is over-reaching. It has not survived, for the reason that the people using the network live in territories, own property in territories, and can be reached there. It is worth knowing because examination questions still describe cyberspace as a borderless realm, and the honest answer is that it is borderless technically and thoroughly bordered legally.

The second answer is to extend the territory. A State says that its law reaches conduct abroad which affects it. Section 1(2) of the Act does this in terms: the Act applies also to any offence or contravention committed outside India by any person. Section 75 then supplies the limit, that the act must involve a computer, computer system or computer network located in India. Chapter 850 works both. The difficulty is that if every State does this, the same conduct is lawful and unlawful at once, and the person concerned cannot comply with everything.

The third answer is to regulate the intermediary. A State cannot reach a person abroad but can reach the business that serves its market, and can require that business to remove material, to block access, to retain records or to identify a user. This is the dominant answer everywhere, and it is what sections 69A and 79 of the Act, the 2021 Rules, the European Digital Services Act and section 230 of the American Communications Decency Act are all about. Its difficulty is that it makes private companies the decision makers about lawfulness.

The fourth answer is to co-operate. States agree on common offences and on procedures for helping each other, as in the Budapest Convention of 2001. Chapters 590 and 600 work it. Its difficulty is that co-operation is slow, and chapter 880 shows how slow.

The three questions that recur

Prescriptive jurisdiction: whose law applies? May India apply its law to a website hosted abroad which Indian users read?

Adjudicative jurisdiction: which court may decide? May a court in Mumbai entertain a suit against a company with no presence in Maharashtra whose site is accessible there?

Enforcement jurisdiction: can the order be given effect? A decree against a foreign defendant with no assets in India is a piece of paper unless a foreign court will enforce it or an intermediary will act on it.

Keep those three apart. Students routinely answer the first when asked the second. A court can have the power to apply Indian law and still lack territorial jurisdiction over the defendant, and it can have both and still be unable to enforce. Chapters 840 to 900 take them in turn.

A worked example

Karan, in Nashik, runs a blog. He writes that a Bengaluru company's product is dangerous. The blog is hosted on a platform incorporated in Delaware, whose servers for the region are in Singapore. A reader in Dubai forwards the post; a distributor in Nagpur cancels its order.

Ask the three questions.

Whose law? India's, because the writer, the company and the loss are in India, and because the material was published to readers in India. But Singapore's law applies to the copy on the machines there, and the platform's contract with Karan probably applies Californian law.

Which court? The company will sue in Bengaluru or Nagpur, where it carries on business and where the loss was felt. Whether the platform can be joined depends on whether it carries on business in India, which is the question chapter 860 works with Banyan Tree and World Wrestling Entertainment.

Enforcement? A decree against Karan is straightforward. An order against the platform is worth what the platform's willingness or its Indian presence makes it worth, which is why litigants now ask for orders against intermediaries under the 2021 Rules rather than only for damages.

Nothing in that example is unusual. It is the ordinary shape of an internet dispute, and the point is that the mismatch between law and network is not an exotic problem at the edge of the subject. It is the subject.

What this does NOT mean

It does not mean cyberspace is a legal vacuum. Every act done online is done by a person somewhere and touches property and reputation somewhere. The problem is an excess of applicable laws, not an absence.

It does not mean the location of a server settles anything. It is one connecting factor among several, and both Indian and foreign courts have refused to make it decisive, because it would let a party choose its law by choosing a data centre.

It does not mean that "the internet is borderless" is an answer to an examination question. It is the beginning of one. The marks are in showing which of the four responses the law has adopted for the particular problem and what the response costs.

Quick revision

• Cyberspace: the notional space constituted by interconnected networks, in which conduct is connected to many territories and located in none.
• Law is territorial; section 1(2) of the Act extends to the whole of India and then reaches conduct abroad, with section 75 supplying the limit.
• Four causes: no natural borders, contingent and unknown location, identity not fixed to a body, and everything mediated.
• Four responses: leave it alone (abandoned), extend the territory, regulate the intermediary (dominant), co-operate between States.
• Three questions, kept apart: whose law (prescriptive), which court (adjudicative), can it be enforced (enforcement).
• Regulating the intermediary is dominant because it is the only response a single State can make effective on its own, and its cost is that private companies decide what is lawful.

Test yourself

1. Why does the territorial basis of law fit the network badly? Because a State's authority comes from territory, while a single network transaction is simultaneously connected to several territories through the sender, the recipient, the servers and the carriers, and is not located in any of them in the way a physical act is. Neither the participants nor the network treat a border as an event.

2. Distinguish prescriptive, adjudicative and enforcement jurisdiction with one internet example each. Prescriptive: whether Indian law governs a foreign-hosted site read in India. Adjudicative: whether a court in Mumbai may entertain the suit against the foreign host. Enforcement: whether a decree obtained against that host can be given effect, which usually depends on its Indian presence or on a foreign court recognising the decree.

3. Name the four responses legal systems have made and give one instrument for each. Leave it alone, now abandoned. Extend the territory: section 1(2) with section 75 of the IT Act. Regulate the intermediary: section 79 and the Intermediary Guidelines Rules 2021, and the European Digital Services Act. Co-operate: the Budapest Convention on Cybercrime, 2001.

4. What is the cost of the intermediary-regulation response? It puts the decision whether material is unlawful into the hands of private companies acting on notice and under threat of losing an immunity, which produces over-removal, and it makes the extent of a State's reach depend on whether the company has assets or staff in that State.

5. Why is the physical location of a server not decisive? Because it is a commercial decision unknown to the parties, it may be split or changed at will, and making it decisive would let a service choose the law applying to it by choosing a data centre, which would defeat the regulation of every market it serves.

The Model Law's method is worked in chapters 60 to 90, and its central idea, the functional equivalent approach, is the single most useful thing in Module I.

What India did

The Bill was introduced in 1999 and the Act received the President's assent on 9 June 2000. It was brought into force on 17 October 2000.

The Statement of Objects and Reasons sets out four purposes, and they map on to the Act's structure exactly.

To give legal recognition to transactions carried out by electronic data interchange and other means of electronic communication, commonly referred to as electronic commerce, which involve the use of alternatives to paper-based methods of communication and storage of information. That is Chapters II to IV of the Act, sections 3 to 13.

To facilitate electronic filing of documents with Government agencies. That is Chapter III, sections 6 to 9.

To amend the Indian Penal Code, the Indian Evidence Act 1872, the Bankers' Books Evidence Act 1891 and the Reserve Bank of India Act 1934. That was done by sections 91 to 94 and the four Schedules, all since omitted as spent, and it is how section 65B came into the Evidence Act.

And, added by the Act itself rather than by the Model Law, to create offences and a regulatory machinery. That is Chapters VI to XI.

Two of those four purposes have no counterpart in the Model Law at all. The Model Law is about commerce. It says nothing about licensing certifying authorities, nothing about hacking, and nothing about obscenity. India built a regulatory and penal statute on a commercial foundation, and a good deal of the criticism of the Act is that the two halves do not sit comfortably together.

The three phases of the Act's life

Phase one, 2000 to 2009: the commerce statute. The Act as passed recognised electronic records and digital signatures, set up the Controller of Certifying Authorities and a licensing regime, created a Cyber Regulations Appellate Tribunal, and provided a short list of offences of which the best known was section 66, then headed "hacking with computer system".

Phase two, 2009 onwards: the amended Act. The Information Technology (Amendment) Act, 2008 came into force on 27 October 2009 and rewrote the statute. It replaced digital signature with the wider electronic signature, inserted sections 43A, 66A to 66F, 67A to 67C, 69A, 69B, 70A, 70B, 72A, 79 in its present form, 84A to 84C, and much else. Chapter 180 works it in full. Almost everything a student meets in Modules III and IV was put there in 2008.

Phase three, 2017 onwards: the Act as amended by other Acts and filled out by rules. The Finance Act 2017 abolished the Cyber Appellate Tribunal and made the Telecom Disputes Settlement and Appellate Tribunal the appellate forum. The Intermediary Guidelines and Digital Media Ethics Code Rules, 2021 replaced the 2011 intermediary rules and added a code for digital media. The Digital Personal Data Protection Act, 2023 will remove section 43A when its section 44(2) comes into force. The amendment of 10 February 2026 brought synthetically generated information into the Rules. Chapter 190 works this phase.

A short chronology

A worked example

Take one dispute and ask what a court could have done with it in 1998, in 2002, in 2012 and today. Nalini Sridhar orders goods by email from Vipul Shah, he denies the order and she produces a printout.

In 1998, before the Act. The printout is a document only if the Evidence Act, 1872, treats it as one, and section 3 as it then stood spoke of matter recorded upon a substance by letters, figures or marks. There is no provision making an electronic record admissible, no rule attributing it to a sender, and no way to satisfy a statute that requires a signature. Nalini's difficulty is not that she will lose; it is that nobody knows what the answer is.

In 2002, under the Act as enacted. Section 4 gives legal recognition to an electronic record where a law requires writing. Section 5 gives legal recognition to a digital signature where a law requires a signature. Section 11 attributes the record to the originator. Section 13 fixes when and where it was sent and received. And section 92 of this Act with the Second Schedule has inserted sections 65A and 65B into the Evidence Act, so the printout is admissible with a certificate. Everything Nalini needed has arrived at once, and that is what the Act was for.

In 2012, after the amendment of 2008. The same answers, plus section 10A, which puts beyond argument that a contract is not unenforceable merely because it was made electronically, and section 3A, which widens signature recognition beyond digital signatures to any technique in the Second Schedule. If Vipul now says his account was compromised, section 11 still does not help him or her, because it attributes only in three cases and none of them is the stolen password.

Today. The Evidence Act is repealed; section 61 of the Bharatiya Sakshya Adhiniyam, 2023, forbids denial of admissibility on the ground that the record is electronic, section 57 may make the file itself primary evidence, and section 63 carries the old section 65B certificate with the added requirement of an expert's signature. Chapter 1270.

And the shape the example shows. The Act's first phase, from 2000, was about recognition; the second, from 2008, added crime, security and intermediaries; and the third, from 2021, is rules rather than statute. The chronology below is that story with dates on it.

What this does NOT mean

It does not mean India copied the Model Law. India enacted its substance for electronic records and signatures and then added a licensing regime, an offence chapter and a State powers chapter that the Model Law never contemplated. Chapter 110 compares the two clause by clause, which is a question the University has set three times.

It does not mean the Act repealed the older statutes. It amended four of them and otherwise left the general law standing, which is why section 81 was needed to say which prevails and why chapter 1280 has to work out how the Act and the Bharatiya Nyaya Sanhita apply together.

It does not mean the Act was drafted for the internet we have. It was drafted for electronic data interchange between businesses. Social media, cloud computing, smartphones and machine-generated content all arrived afterwards, and the strain shows.

Quick revision

• Before 2000: writing and signature were defined physically in the General Clauses Act 1897; the Evidence Act 1872 had no rule for records inside a machine; the Penal Code 1860 reached none of the new conduct.
• UNCITRAL is the United Nations Commission on International Trade Law. A Model Law binds nobody until enacted.
• Resolution A/RES/51/162, 16 December 1996, adopted the Model Law on Electronic Commerce and is recited in the Act's own preamble.
• Assent 9 June 2000, Act 21 of 2000, in force 17 October 2000.
• Four objects: recognise electronic transactions; facilitate electronic filing with Government; amend four statutes; and, added by India, create offences and a regulator.
• Three phases: the commerce statute to 2009; the amended Act from 27 October 2009; and the Act as reshaped by the Finance Act 2017, the 2021 Rules, the DPDP Act 2023 and the amendment of February 2026.

Test yourself

1. State three obstacles in Indian law before 2000 to doing business electronically. The definitions of writing and of signature in the General Clauses Act, 1897 assumed marks on a physical surface. The Indian Evidence Act, 1872 had no rule for admitting a record held inside a computer and required primary evidence of a document. The Indian Penal Code, 1860 did not reach copying data without removing it, corrupting data, or fabricating an electronic record.

2. What is a Model Law, and which one does the Act's preamble recite? A text prepared for legislatures to enact with or without modification, binding on nobody until enacted. The preamble recites the UNCITRAL Model Law on Electronic Commerce, adopted by General Assembly resolution A/RES/51/162 dated 30 January 1997 as the Act prints it, and recommends favourable consideration in the interests of uniformity.

3. Which two of the Act's purposes have no counterpart in the Model Law? The regulatory purpose, meaning the licensing and supervision of Certifying Authorities in Chapters VI and VII, and the penal purpose, meaning the offences in Chapter XI. The Model Law is a commercial instrument and contains neither.

4. Give the date the Act came into force and the date the 2008 amendment came into force, and say why the second matters more. The Act came into force on 17 October 2000; the 2008 amendment on 27 October 2009. The second matters more because almost every provision a student meets in Modules III and IV, sections 43A, 66A to 66F, 67A to 67C, 69A, 69B, 70A, 70B, 72A, the present section 79 and sections 84A to 84C, was inserted by it.

5. Why is it wrong to say the Act is simply the Model Law in Indian form? Because the Model Law supplied only the recognition provisions on electronic records, signatures, attribution, acknowledgment and the time and place of despatch and receipt. The Certifying Authority regime, the offences, the State powers of interception and blocking, and the intermediary provisions are Indian additions with no Model Law counterpart.

India enacted its substance. Chapter 110 compares the two clause by clause, which is a comparison the University has set three times, in 2015, 2016 and 2025-26. The short point is that sections 4, 5, 7, 11, 12 and 13 of the Information Technology Act are recognisably articles 6, 7, 10, 13, 14 and 15 of the Model Law.

The structure of the Model Law

It has two parts and seventeen articles.

Part one, electronic commerce in general, contains articles 1 to 15 in three chapters. Chapter I is general provisions, articles 1 to 4. Chapter II applies legal requirements to data messages, articles 5 to 10, and includes article 5 bis, which was added by the Commission in June 1998. Chapter III deals with the communication of data messages, articles 11 to 15.

Part two, electronic commerce in specific areas, contains articles 16 and 17 on the carriage of goods. Chapter 90 owns those.

Article 1: the sphere of application

"This Law applies to any kind of information in the form of a data message used in the context of commercial activities."

Three things about that sentence matter.

It applies to information, not to documents or transactions. The unit is the data message, which article 2 defines.

It is limited to commercial activities, and a footnote directs that the term commercial be given a wide interpretation covering all relationships of a commercial nature, whether contractual or not, and lists supply and exchange of goods or services, distribution, agency, factoring, leasing, construction, consulting, engineering, licensing, investment, financing, banking, insurance, concession, joint venture and carriage of goods or passengers by any mode.

A footnote records that the Law does not override any rule of law intended for the protection of consumers. UNCITRAL was writing for business to business trade, and left consumer protection to each State.

The Commission offers two alternative texts in footnotes, one for a State that wishes to limit the Law to international data messages, and one for a State that wishes to extend it beyond commerce by listing exceptions instead. India took the second route: the Act applies generally and section 1(4) with the First Schedule lists what it does not touch. Chapter 140 owns the First Schedule.

Article 2: the five definitions that carry the whole subject

Article 2(a): a data message means information generated, sent, received or stored by electronic, optical or similar means including, but not limited to, electronic data interchange, electronic mail, telegram, telex or telecopy.

Notice that the definition includes a telegram, a telex and a telecopy, which is a fax. The Model Law is not about the internet. It is about any means of communication that is not paper, and that deliberate width is what has let it survive thirty years of new technology.

Article 2(b): electronic data interchange means the electronic transfer from computer to computer of information using an agreed standard to structure the information. This was the dominant commercial technology of the time.

Article 2(c): the originator of a data message means a person by whom, or on whose behalf, the data message purports to have been sent or generated prior to storage, if any, but does not include a person acting as an intermediary with respect to that data message.

Article 2(d): the addressee means a person who is intended by the originator to receive the data message, but does not include a person acting as an intermediary.

Article 2(e): an intermediary, with respect to a particular data message, means a person who, on behalf of another person, sends, receives or stores that data message or provides other services with respect to it.

Compare those three with sections 2(1)(za), 2(1)(b) and 2(1)(w) of the Indian Act. The originator and the addressee are taken over almost word for word, each carrying the same express exclusion of an intermediary. The Indian definition of intermediary keeps the same core, "on behalf of another person receives, stores or transmits that record or provides any service with respect to that record", and then adds the long list of businesses that chapter 30 sets out. Chapter 160 owns the Indian definitions.

Article 2(f) defines an information system as a system for generating, sending, receiving, storing or otherwise processing data messages. India did not enact this one, which is why section 13 of the Act speaks of a computer resource where article 15 speaks of an information system.

Article 3: interpretation

Article 3(1) requires that in interpreting the Law regard is to be had to its international origin and to the need to promote uniformity in its application and the observance of good faith.

Article 3(2) provides that questions concerning matters governed by the Law which are not expressly settled in it are to be settled in conformity with the general principles on which the Law is based.

This is a standard UNCITRAL article and it does real work. It tells a court not to read the enacted text as though it were purely domestic, and it supplies a method for a gap: reason from the principles of the instrument rather than from local doctrine. India did not enact article 3, and that omission has a cost, because an Indian court construing section 13 has no direction to consult the Model Law or the decisions of other enacting States.

Article 4: variation by agreement

Article 4(1) provides that as between parties involved in generating, sending, receiving, storing or otherwise processing data messages, and except as otherwise provided, the provisions of chapter III may be varied by agreement.

Article 4(2) provides that this does not affect any right that may exist to modify by agreement any rule of law referred to in chapter II.

So the Model Law divides itself in two. Chapter III, the communication rules on attribution, acknowledgment and the time and place of despatch and receipt, is default law: it applies unless the parties have agreed otherwise, exactly as much of the law of contract does. Chapter II, the rules about writing, signature and originality, is not in the parties' gift in the same way, because those are requirements imposed by other law for reasons of their own, and two parties cannot agree that a statutory requirement of writing is satisfied.

India enacted this distinction in substance without enacting article 4 as a section. Sections 11, 12 and 13 all open with words that give way to a contrary agreement: section 11 attributes a record in the circumstances stated, section 12 applies "where the originator has not agreed with the addressee", and section 13 applies "unless otherwise agreed between the originator and the addressee". Chapters 940, 950 and 870 own those three.

A worked example

Sunrise Textiles in Bhiwandi sells cotton to Meridian Trading in Colombo. They exchange purchase orders and confirmations by email, using a standard message format, and never sign anything on paper.

Under article 1, this is information in the form of a data message used in the context of a commercial activity, so the Model Law applies to it in any State that has enacted it. The exchange is a trade transaction for the supply of goods, which is the first item in the footnote's list.

Under article 2(a), each email is a data message. Under article 2(c), Sunrise is the originator of the purchase confirmation. Under article 2(d), Meridian is the addressee. Under article 2(e), the mail service that carried the message is an intermediary, and it is neither originator nor addressee, which is what stops the carrier being treated as a party to the exchange.

Under article 4, if the two companies have a trading agreement providing that no message is effective until acknowledged, that agreement displaces article 14. If they have agreed that email will do instead of a signed order, that agreement is good between them but does not by itself satisfy a statutory requirement of signature imposed by Sri Lankan or Indian law, because article 4(2) keeps chapter II out of their hands.

The rest of the exchange is worked in the next three chapters, which take chapter II and chapter III in turn.

What this does NOT mean

It does not mean the Model Law is in force anywhere as the Model Law. It is in force as the enacting State's own statute, in whatever form that State passed it. When an Indian court applies section 13 it applies section 13, not article 15.

It does not mean every State enacted the same text. More than eighty jurisdictions have legislation based on it, and they differ. Comparing those differences is what topic 3.1 asks for.

It does not mean the Model Law settles what a contract is. It removes obstacles arising from the electronic form and does nothing else. Whether there was an offer, an acceptance and consideration remains a question for the ordinary law of contract, which is why chapter 920 has to work offer and acceptance separately.

Quick revision

• UNCITRAL: the United Nations Commission on International Trade Law, created 1966 to harmonise the law of international trade.
• A model law binds nobody until a legislature enacts it. It comes with a Guide to Enactment, which is the Commission's own commentary.
• Adopted 16 December 1996; article 5 bis added June 1998. Seventeen articles in two parts.
• Article 1: any kind of information in the form of a data message used in the context of commercial activities; "commercial" to be read widely; the Law does not override consumer protection law.
• Article 2: data message, electronic data interchange, originator, addressee, intermediary, information system. The originator and the addressee both exclude an intermediary.
• Article 3: interpret with regard to the international origin, the need for uniformity and good faith; fill gaps from the Law's own principles. India did not enact it.
• Article 4: chapter III may be varied by agreement; chapter II may not be varied in the same way. India enacted the distinction inside sections 11, 12 and 13 instead.

Test yourself

1. What is a model law, and how does it differ from a convention? A model law is a draft statute prepared for legislatures to enact with or without modification; it has no legal force until enacted, and each State may adapt it. A convention is a treaty binding the States that ratify it, in the terms ratified, and cannot be adapted unilaterally. UNCITRAL chose a model law here because the technology was moving too fast for a treaty.

2. Define a data message and say why the definition mentions telegrams. Article 2(a): information generated, sent, received or stored by electronic, optical or similar means, including but not limited to electronic data interchange, electronic mail, telegram, telex or telecopy. It mentions telegrams because the Law is about non-paper communication generally rather than about any one technology, and that width is why it has survived the arrival of technologies nobody had in 1996.

3. Why do the definitions of originator and addressee both exclude an intermediary? Because the intermediary handles the message on somebody else's behalf and has no interest in its content, so treating it as a party would attach to it the consequences of a communication it did not make. The same exclusion appears in sections 2(1)(za) and 2(1)(b) of the Indian Act and is the foundation of the intermediary liability chapters.

4. Explain the difference article 4 draws between chapter II and chapter III. Chapter III, the communication rules, is default law that parties may vary by agreement. Chapter II, the rules on writing, signature, original, admissibility and retention, addresses requirements imposed by other law for public reasons, so article 4(2) preserves whatever right to modify those rules exists independently and does not itself confer one.

5. India did not enact article 3. What is the consequence? An Indian court construing the enacted provisions has no statutory direction to have regard to the Model Law's international origin, to uniformity of application, or to the general principles of the instrument when filling a gap. The result is that Indian interpretation of these provisions is not formally tied to the interpretation given in other enacting States.

Section 4 of the Indian Act enacts the same idea in positive form for the writing requirement, and section 5 does it for signature. Chapter 300 owns both.

Article 5 bis: incorporation by reference

"Information shall not be denied legal effect, validity or enforceability solely on the grounds that it is not contained in the data message purporting to give rise to such legal effect, but is merely referred to in that data message."

This article was added by the Commission in June 1998, two years after the rest, and it addresses the ordinary web practice of putting the terms behind a link rather than in the message.

It is drafted in exactly the same negative form as article 5, and for the same reason. It does not say that a linked term is incorporated. It says that the mere fact of being linked rather than included is not a ground for denying effect, leaving the ordinary law of incorporation, and questions of notice and assent, to do the rest.

India did not enact article 5 bis, and the point is not academic: the enforceability of a browse-wrap term behind a link is decided in India by ordinary contract principles of notice, without any statutory starting point. Chapter 960 works that out.

Article 6: writing

Article 6(1): where the law requires information to be in writing, that requirement is met by a data message if the information contained therein is accessible so as to be usable for subsequent reference.

Article 6(2): paragraph (1) applies whether the requirement is in the form of an obligation or whether the law simply provides consequences for the information not being in writing.

Work through the method. What is writing for? Chiefly, that the information can be read again later. Paper does that by lasting and staying legible. So the criterion is accessibility for subsequent reference, and that is the whole test. It says nothing about permanence, nothing about format, and nothing about who can read it.

Article 6(2) covers both kinds of statute: those that say a thing must be in writing, and those that merely attach a consequence to its not being, such as unenforceability.

Section 4 of the Indian Act is article 6, and its wording is close: where any law provides that information or any other matter shall be in writing or in the typewritten or printed form, then that requirement shall be deemed to have been satisfied if such information or matter is rendered or made available in an electronic form and accessible so as to be usable for a subsequent reference.

Article 7: signature

Article 7(1): where the law requires a signature of a person, that requirement is met in relation to a data message if (a) a method is used to identify that person and to indicate that person's approval of the information contained in the data message, and (b) that method is as reliable as was appropriate for the purpose for which the data message was generated or communicated, in the light of all the circumstances, including any relevant agreement.

Ask the same question. What is a signature for? Two things: it identifies the signer, and it shows that the signer approved the content. Those are the two limbs of article 7(1)(a), and they are the functional part.

Article 7(1)(b) adds a reliability standard, and it is deliberately relative. The method must be as reliable as was appropriate for the purpose, in the light of all the circumstances. A typed name at the foot of an email may be appropriate for confirming a delivery date and plainly inappropriate for executing a mortgage. That relativity is the difference between article 7 and the Indian provision.

Section 5 of the Indian Act is narrower. It provides that where any law requires a signature, that requirement is satisfied if the information is authenticated by means of an electronic signature affixed in the manner prescribed by the Central Government. India chose a prescribed method rather than a reliability standard, so an Indian statutory signature requirement is met by the techniques in the Second Schedule and not by any method that happens to be appropriate. Chapters 300 and 310 work the difference, which is the most important single divergence between the Model Law and the Act.

Article 8: original

Article 8(1): where the law requires information to be presented or retained in its original form, that requirement is met by a data message if (a) there exists a reliable assurance as to the integrity of the information from the time when it was first generated in its final form, and (b) where presentation is required, the information is capable of being displayed to the person to whom it is to be presented.

Article 8(3)(a) supplies the test of integrity: whether the information has remained complete and unaltered, apart from the addition of any endorsement and any change which arises in the normal course of communication, storage and display.

Article 8(3)(b) makes the standard of reliability relative to the purpose for which the information was generated and to all the relevant circumstances.

This is the hardest of the three and the most instructive. What is an original for? Not that it is the first copy, because for a data message that is a meaningless idea; every copy is identical. An original is required because it is the version that has not been tampered with. So the criterion is integrity, and the exceptions in article 8(3)(a) are exactly the changes that do not touch integrity: an endorsement added on the way, and the format changes that happen in transmission and display.

India enacted this in section 7A and, more importantly, in the electronic evidence provisions, and the integrity idea is what section 63 of the Bharatiya Sakshya Adhiniyam is testing when it requires a certificate. Chapter 1270 owns that.

Article 9: admissibility and evidential weight

Article 9(1): nothing in the application of the rules of evidence shall apply so as to deny the admissibility of a data message in evidence on the sole ground that it is a data message, or, if it is the best evidence that the person adducing it could reasonably be expected to obtain, on the ground that it is not in its original form.

Article 9(2): information in the form of a data message shall be given due evidential weight, and in assessing that weight regard shall be had to the reliability of the manner in which the data message was generated, stored or communicated, to the reliability of the manner in which the integrity of the information was maintained, to the manner in which its originator was identified, and to any other relevant factor.

Two ideas are kept apart here, and they are the two ideas Indian courts have struggled with. Admissibility is a threshold: the record comes in. Weight is what the court makes of it afterwards. Article 9 says the electronic form is no answer to admissibility, and lists the factors that go to weight.

India took a different route, requiring a certificate as a condition of admissibility rather than treating reliability purely as a matter of weight. That choice is why Anvar P.V. and Arjun Panditrao were needed at all, and chapter 1270 works both.

Article 10: retention

Article 10(1): where the law requires that documents, records or information be retained, that requirement is met by retaining data messages provided that (a) the information is accessible so as to be usable for subsequent reference; (b) the data message is retained in the format in which it was generated, sent or received, or in a format which can be demonstrated to represent accurately the information generated, sent or received; and (c) such information, if any, is retained as enables the identification of the origin and destination of a data message and the date and time when it was sent or received.

Condition (c) is the one students miss. It is not enough to keep the message. You must keep enough to say who sent it, to whom, and when. That is the metadata, and chapter 20 explains why it is fragile.

Section 7 of the Indian Act is article 10 almost word for word, with the same three conditions, and section 7(2) adds that the section does not apply to information automatically generated solely for the purpose of enabling a message to be sent or received. Chapter 360 owns it.

The five requirements and their criteria, side by side

A worked example

Nandini sells industrial valves. Her customer sends a purchase order by email; she replies "Confirmed, Nandini Rao" and ships. The customer refuses to pay and says there was no contract in writing signed by the seller.

Writing, article 6. The emails are stored in both mailboxes and can be opened and read. They are accessible so as to be usable for subsequent reference. The writing requirement is met.

Signature, article 7 as the Model Law has it. The typed name at the foot, together with the fact that the message came from her business account, is a method that identifies her and indicates approval. Is it as reliable as appropriate? For a routine order of this size, between parties who have traded this way for two years, plainly yes. So the signature requirement is met.

Signature, section 5 as India has it. The typed name is not an electronic signature affixed in the prescribed manner, so section 5 is not satisfied. That does not end the matter, because section 5 is engaged only where a law requires a signature, and the general law of contract does not require one for a sale of goods. Chapter 930 works out what section 10A then does.

Original, article 8. If the customer produces a version of the confirmation with different terms, the question is integrity: which version has a reliable assurance that it has not been altered since it was first generated in final form. That is the practical reason the mail server logs and the message headers matter more than the printout.

Retention, article 10. Nandini keeps the emails with their headers, which show sender, recipient and time. Had she copied the text into a word processing file and deleted the mail, she would have kept the content and lost condition (c).

What this does NOT mean

It does not mean electronic always equals paper. The approach is requirement by requirement. A record can satisfy the writing requirement and fail the signature requirement, as the worked example shows.

It does not mean the Model Law makes anything valid. Article 5 removes one reason for refusal. Everything else that could make the transaction bad still can.

It does not mean India adopted the approach wholesale. It adopted it for writing and retention, narrowed it sharply for signature, and departed from it for evidence. Those three divergences are the substance of chapter 110.

Quick revision

• The method: identify the function the paper requirement serves, then set criteria an electronic record must meet to serve it. Not redefinition, not imitation.
• Article 5: information is not to be denied legal effect solely because it is a data message. Article 5 bis, added 1998, does the same for information merely referred to. India did not enact 5 bis.
• Article 6, writing: accessible so as to be usable for subsequent reference. Indian section 4.
• Article 7, signature: a method that identifies and indicates approval, and is as reliable as appropriate in the circumstances. Indian section 5 requires a prescribed method instead. This is the main divergence.
• Article 8, original: reliable assurance of integrity from the time it was first generated in final form, plus capability of display. Integrity means complete and unaltered apart from endorsements and normal changes in communication, storage and display.
• Article 9, evidence: no denial of admissibility for electronic form; the reliability factors go to weight. India made reliability a condition of admissibility.
• Article 10, retention: accessible, accurate format, and origin, destination, date and time. Indian section 7.

Test yourself

1. State the functional equivalent approach and say what two alternatives it rejects. Identify the functions a paper-based requirement serves, then treat a data message as satisfying the requirement if it performs those functions to an appropriate standard of reliability. It rejects redefining paper words to include electronic ones, which either over-includes or under-includes across hundreds of statutes, and it rejects requiring the electronic record to imitate paper, which discards the advantages of the medium.

2. Why is the criterion for writing different from the criterion for original? Because the two requirements exist for different reasons. Writing exists so the information can be read again, so the criterion is accessibility for subsequent reference. An original is required because it is the untampered version, so the criterion is a reliable assurance of integrity. Applying one criterion to the other requirement would satisfy neither.

3. How does section 5 of the Indian Act differ from article 7, and what turns on it? Article 7 accepts any method that identifies the person and indicates approval and is as reliable as appropriate in the circumstances. Section 5 requires an electronic signature affixed in the manner prescribed by the Central Government. India therefore has a closed list of acceptable techniques where the Model Law has an open reliability standard, so a typed name or a scanned signature can never satisfy an Indian statutory signature requirement however appropriate it is.

4. What are the three conditions in article 10 and which is most often overlooked? Accessibility for subsequent reference; retention in the format generated, sent or received or one demonstrably accurate; and retention of information enabling identification of origin, destination, date and time. The third is the one overlooked, because it requires keeping the metadata and not only the content.

5. Why is article 5 drafted as a prohibition rather than as a grant of validity? Because it is not trying to make electronic communications valid; validity depends on the ordinary law. It removes one specific ground of objection, that the communication is electronic, and the word "solely" preserves every other ground. Drafting it as a grant would have made electronic records effective in circumstances where a paper record would not have been.

Article 12: recognition by parties of data messages

Article 12(1): as between the originator and the addressee of a data message, a declaration of will or other statement shall not be denied legal effect, validity or enforceability solely on the grounds that it is in the form of a data message.

This is article 5 applied to a declaration of will rather than to information generally, and it exists because a great deal of legally significant conduct is not the making of a contract at all. A notice terminating a lease, an election under a policy, a waiver, a consent, a revocation of an offer: each is a declaration of will and none of them is a contract.

India did not enact article 12 as a separate section, relying on the width of sections 4 and 10A. In practice the gap is small, but it is a real one for a unilateral notice where no contract is being formed.

Article 13: attribution of data messages

This is the longest article in the chapter and it has five paragraphs.

Article 13(1): a data message is that of the originator if it was sent by the originator itself.

Article 13(2): as between the originator and the addressee, a data message is deemed to be that of the originator if it was sent (a) by a person who had the authority to act on behalf of the originator in respect of that data message; or (b) by an information system programmed by or on behalf of the originator to operate automatically.

Article 13(2)(b) is the article that keeps the Model Law modern. A message sent automatically by a machine set up by the originator is the originator's message, which is what makes automated ordering systems, and today's automated agents, work at all.

Article 13(3): as between the originator and the addressee, the addressee is entitled to regard a data message as being that of the originator and to act on that assumption if (a) in order to ascertain whether the data message was that of the originator, the addressee properly applied a procedure previously agreed to by the originator for that purpose; or (b) the data message as received by the addressee resulted from the actions of a person whose relationship with the originator or with any agent of the originator enabled that person to gain access to a method used by the originator to identify data messages as its own.

Article 13(3)(b) puts the risk of a leaked credential on the originator, and it does so on the ground of relationship rather than fault: if the person who misused the method got access through a relationship with the originator or its agent, the addressee may still act on the message. The employee who takes the password is the paradigm case.

Article 13(4) takes that entitlement away in two situations: where the addressee had received notice from the originator that the data message was not the originator's and had reasonable time to act accordingly, and, in a case falling within 13(3)(b), at any time when the addressee knew or should have known, had it exercised reasonable care or used any agreed procedure, that the data message was not that of the originator.

Article 13(5) deals with the content: where a data message is that of the originator or is deemed to be so, the addressee is entitled to regard it as what the originator intended to send and to act on that assumption, except where the addressee knew or should have known that transmission resulted in an error.

Section 11 of the Indian Act enacts article 13(1) and (2) and stops. It provides that an electronic record shall be attributed to the originator if it was sent by the originator himself, by a person who had the authority to act on behalf of the originator, or by an information system programmed by or on behalf of the originator to operate automatically. India left out paragraphs (3), (4) and (5) altogether, which is the largest single omission from the Model Law and the one with the most practical consequence: the Indian Act says nothing about when an addressee may rely on a message that turns out not to be the originator's. Chapter 940 works out what fills the gap.

Article 14: acknowledgement of receipt

Article 14(1): where the originator has requested or agreed with the addressee that receipt be acknowledged, paragraphs (2) to (4) apply.

Article 14(2): where the originator has not agreed with the addressee that the acknowledgement be given in a particular form or by a particular method, an acknowledgement may be given by any communication by the addressee, automated or otherwise, or any conduct of the addressee, sufficient to indicate to the originator that the data message has been received.

Article 14(3): where the originator has stated that the data message is conditional on receipt of the acknowledgement, the data message is treated as though it has never been sent until the acknowledgement is received.

Article 14(4): where the originator has not so stated, and the acknowledgement has not been received within the time specified or agreed or, if none, within a reasonable time, the originator may give notice to the addressee stating that no acknowledgement has been received and specifying a reasonable time by which it must be received; and if it is not received within that time the originator may, on notice to the addressee, treat the data message as though it had never been sent, or exercise any other rights it may have.

Article 14(5) and (6) keep two things apart. Receipt of an acknowledgement is not, of itself, evidence that the message as received corresponds to the message as sent; and, except to the extent that it establishes receipt, article 14 is not concerned with the legal consequences that may flow either from the data message or from the acknowledgement.

Section 12 of the Indian Act is article 14(1) to (4) in almost the same words, and India did enact the equivalent of 14(3) and 14(4), including the two-stage notice procedure. Chapter 950 owns it.

Article 15: time and place of despatch and receipt

This is the article with the greatest practical importance in the whole Model Law, and section 13 of the Indian Act follows it closely.

Article 15(1): unless otherwise agreed, the despatch of a data message occurs when it enters an information system outside the control of the originator or of the person who sent the data message on behalf of the originator.

The test is loss of control. Not when the sender pressed send, and not when it arrived: when it passed out of the sender's hands. That is the electronic equivalent of putting the letter in the post box.

Article 15(2) deals with receipt and distinguishes two cases. If the addressee has designated an information system for the purpose, receipt occurs when the data message enters that designated system, or, if the message is sent to a different system of the addressee, when it is retrieved by the addressee. If the addressee has not designated a system, receipt occurs when the data message enters an information system of the addressee.

So a designated address gets a delivery rule and an undesignated one gets a retrieval rule, which is fair: a person who publishes an address for a purpose can be taken to look at it, and a person who is written to at some other address cannot.

Article 15(3): the data message is deemed to be despatched at the place where the originator has its place of business and to be received at the place where the addressee has its place of business.

That is the crucial deeming, and its purpose is to keep the location of hardware out of the question. Article 15(4) supplies the rules for a party with more than one place of business, the place with the closest relationship to the underlying transaction, or failing that the principal place of business, and for a party with none, its habitual residence. Article 15(5) states that paragraph (3) applies notwithstanding that the place where the information system is located may be different from the place where the data message is deemed to be received.

Section 13 of the Indian Act is article 15, and chapter 870 works it in full with P.R. Transport Agency, the Indian case that decided a writ petition's territorial jurisdiction on it.

The five articles and their Indian counterparts

A worked example

Deepak Enterprises in Surat and Ganesh Chemicals in Pune trade by email. Deepak's purchasing manager, Farid, has authority to place orders. Deepak publishes orders@deepak.example as the address for confirmations.

Farid places an order. Under article 13(2)(a) the order is Deepak's, because Farid had authority in respect of it.

Ganesh's order-processing system sends an automated confirmation. Under article 13(2)(b) the confirmation is Ganesh's, because the system was programmed by Ganesh to operate automatically.

The confirmation is despatched under article 15(1) when it leaves Ganesh's control and enters a system outside it, and it is received under article 15(2)(a) when it enters orders@deepak.example, because that address was designated. Had Ganesh sent it to Farid's personal address instead, receipt would have occurred only when Farid actually retrieved it.

It is deemed despatched in Pune and received in Surat under article 15(3), whichever data centres the two mail systems actually use.

Now change the facts. A former employee of Deepak, who still has Farid's password, sends an order for goods Deepak does not want. Under article 13(3)(b) Ganesh is entitled to regard the order as Deepak's, because the sender's relationship with Deepak enabled him to gain access to the method Deepak used to identify its own messages. Under article 13(4)(a) that entitlement stops if Deepak had already notified Ganesh, with time to act.

Under Indian law, section 11 answers the first part and nothing answers the second. That is the practical shape of the omission, and chapter 940 works it.

What this does NOT mean

It does not mean article 15 decides jurisdiction. It decides where a message is deemed despatched and received. Whether that gives a particular court territorial jurisdiction is a question under the local procedural law, and chapter 860 keeps the two apart.

It does not mean an acknowledgement proves the content. Article 14(5) says so in terms: acknowledgement establishes receipt and nothing about correspondence between what was sent and what arrived.

It does not mean attribution decides liability. Article 13 says whose message it is as between originator and addressee. Whether the originator is bound by it is a question of contract and agency.

Quick revision

• Chapter III is default law, variable by agreement under article 4.
• Article 11: offer and acceptance may be expressed by data message; a contract is not invalid solely because one was used. Indian section 10A, inserted 2008.
• Article 12: a declaration of will is not denied effect for being a data message. Not enacted in India.
• Article 13: attribution. (1) sent by the originator; (2) sent by an authorised person or by an automated system of the originator; (3) when the addressee may rely, including where a relationship gave access to the originator's method; (4) when it may not; (5) errors in transmission. India enacted only (1) and (2), in section 11.
• Article 14: acknowledgement. Any sufficient communication or conduct; if the originator made the message conditional, it is treated as never sent until acknowledgement; otherwise the two-stage notice procedure. Indian section 12.
• Article 15: despatch when it leaves the originator's control; receipt when it enters a designated system, or on retrieval if sent elsewhere, or when it enters any system of the addressee if none was designated; deemed despatched and received at the parties' places of business regardless of where the hardware is. Indian section 13.

Test yourself

1. State the test for despatch and the two tests for receipt under article 15. Despatch occurs when the message enters an information system outside the control of the originator or of the person who sent it on the originator's behalf. If the addressee designated a system, receipt occurs when the message enters that system, or on retrieval if it was sent to a different system of the addressee. If no system was designated, receipt occurs when the message enters any information system of the addressee.

2. Why does article 15(3) deem the place of receipt to be the addressee's place of business? Because the location of the server is a commercial and technical accident, unknown to the parties and changeable at will, and making it decisive would let a party choose the applicable rules by choosing a data centre. Article 15(5) says the deeming applies notwithstanding that the system is elsewhere.

3. Which parts of article 13 did India not enact, and why does it matter? Paragraphs (3), (4) and (5). It matters because they are the parts that say when an addressee is entitled to rely on a message that was not in fact the originator's, when that entitlement is lost, and what happens where transmission produced an error. Section 11 attributes messages actually sent or authorised, and leaves the compromised-credential case to the general law.

4. A supplier stipulates that its quotation is conditional on acknowledgement of receipt, and no acknowledgement comes. What is the position under article 14? Under article 14(3) the data message is treated as though it had never been sent until the acknowledgement is received. The supplier does not need to give notice or wait; the condition does the work. Article 14(4)'s two-stage notice procedure applies only where the originator did not make the message conditional.

5. Does an acknowledgement of receipt prove that what arrived is what was sent? No. Article 14(5) provides that receipt of an acknowledgement is not of itself evidence that the data message received corresponds to the message sent. Correspondence is a question of integrity, addressed by article 8 and by the evidence provisions.

Group (b) is about the contract and the carrier: notifying a person of terms and conditions of the contract, and giving instructions to a carrier.

Group (c) is about delivery: claiming delivery of goods, authorising release of goods, and giving notice of loss of or damage to goods.

Group (d) is any other notice or statement in connection with the performance of the contract.

Group (e) is undertaking to deliver goods to a named person or a person authorised to claim delivery.

Group (f) is granting, acquiring, renouncing, surrendering, transferring or negotiating rights in goods.

Group (g) is acquiring or transferring rights and obligations under the contract.

Groups (e), (f) and (g) are the ones that matter, because they are the ones a document of title performs. The first four groups could have been handled by article 6 alone.

Article 17: transport documents

Article 17(1): subject to paragraph (3), where the law requires that any action referred to in article 16 be carried out in writing or by using a paper document, that requirement is met if the action is carried out by using one or more data messages.

Article 17(2) makes it apply whether the requirement is an obligation or merely attracts a consequence, in the same terms as articles 6(2), 7(2) and 8(2).

Article 17(3) is the provision worth learning by heart. If a right is to be granted to, or an obligation is to be acquired by, one person and no other person, and if the law requires that, in order to effect this, the right or obligation must be conveyed to that person by the transfer, or use of, a paper document, that requirement is met if the right or obligation is conveyed by using one or more data messages, provided that a reliable method is used to render such data message or messages unique.

Article 17(4) makes the standard of reliability relative, assessed in the light of the purpose for which the right or obligation was conveyed and all the circumstances including any relevant agreement, exactly as articles 7(1)(b) and 8(3)(b) do.

Articles 17(5) to (7) deal with the consequences. Where a right is conveyed by data messages instead of by a paper document, no paper document used to effect any such action is valid unless the use of data messages has been terminated and replaced by paper documents; a paper document issued in those circumstances must contain a statement of the termination; and the rules of law applicable to a contract of carriage evidenced by a paper document are not to be denied application merely because the contract is evidenced by data messages instead.

The uniqueness requirement, and why nobody could deliver it for twenty years

Article 17(3) states a criterion and deliberately does not say how to meet it. The Model Law is a framework text and leaves technique to technical regulation and to contract, which is what the Guide to Enactment says of the whole instrument.

Meeting it in practice proved very hard. The commercial answer for two decades was a closed system: a registry, run by a service provider, which recorded who held the electronic bill and transferred it on instruction. It works, but only for members of the registry who have contracted into its rules, and it is not the same thing as a negotiable instrument good against the world.

The problem was eventually addressed by a different UNCITRAL instrument. The Model Law on Electronic Transferable Records, adopted in 2017, is built around the idea of control of an electronic record standing in place of possession of a paper one, with singularity, integrity and identifiability as its requirements. That is beyond this syllabus, but a student who mentions it in an answer on part two has shown where the story went.

What India did with part two

India did not enact part two, and it did not have to.

Section 1(4) of the Act, with the First Schedule, excludes from the Act's application a bill of exchange, a power of attorney, a trust, a will, and any contract for the sale or conveyance of immovable property. Chapter 140 owns that Schedule in full.

A bill of lading is not in the First Schedule, so the Act's general provisions can apply to it. What India did not enact is any equivalent of article 17(3), so Indian law has no statutory criterion for making an electronic transferable record unique.

The practical consequence is that an electronic bill of lading in India works by contract. Parties adopt a registry's rulebook and bind themselves to treat the registry's record as determinative. That is enforceable between them and says nothing about a third party who never joined.

A worked example

Konkan Exports ships a container of cashew from Mangaluru to Rotterdam on a vessel operated by Baltic Line.

Under article 16(a)(iii) and (iv), the receipt for the goods and the confirmation that they have been loaded are actions in connection with a contract of carriage, so under article 17(1) they may be done by data message wherever the law required paper.

Under article 16(f) and (g), the transfer of rights in the goods and of rights under the contract while the vessel is at sea is also within the chapter. But that is a transfer of a right to one person and no other, so article 17(3), not 17(1), is the provision that governs it, and it is satisfied only if a reliable method renders the message unique.

Konkan sells the cargo to a trader in Antwerp, who sells it on to a refiner in Hamburg. Each transfer must leave exactly one person entitled to demand the container. If the electronic record can be duplicated, two buyers can present it and the carrier cannot know which to obey.

Under a registry system, all four parties and the carrier are members. The registry records Konkan as holder, then the trader, then the refiner, and the carrier delivers to whoever the registry names. Under article 17(5), no paper bill may be used unless the electronic system is terminated and replaced, and under 17(6) any paper bill then issued must say so, which is what stops the same cargo being claimed twice, once on paper and once electronically.

Under Indian law the same commercial result is reached by contract, and only as against the people who agreed to it.

What this does NOT mean

It does not mean part two is unimportant because India did not enact it. The syllabus prints "UNCITRAL Model Law" without qualification, and a comparative question about what India took and what it left is precisely where part two belongs.

It does not mean article 17(1) is the same rule as article 6. Article 6 makes a data message satisfy a requirement of writing. Article 17(1) makes it satisfy a requirement of writing or of using a paper document, which is wider, and it does so for the actions article 16 lists rather than generally.

It does not mean a bill of lading is excluded from the Indian Act. The First Schedule excludes a negotiable instrument as defined in section 13 of the Negotiable Instruments Act, 1881, which means a promissory note, a bill of exchange or a cheque. A bill of lading is a document of title to goods and is not a negotiable instrument in that sense.

Quick revision

• Part two is articles 16 and 17, and it exists for one reason: a document of title must be unique, and a data message is trivially copyable.
• Article 16 lists seven groups of actions in connection with a contract of carriage, expressly without limitation. Groups (e), (f) and (g), undertaking to deliver, transferring rights in goods, and transferring rights under the contract, are the ones that need special treatment.
• Article 17(1): a requirement of writing or of a paper document for an article 16 action is met by one or more data messages.
• Article 17(3): where a right must be conveyed to one person and no other by transfer of a paper document, data messages will do provided a reliable method is used to render them unique. Article 17(4) makes reliability relative.
• Articles 17(5) to (7): once the electronic route is used, no paper document is valid until the electronic use is terminated and replaced, and the replacement paper must say so.
• India enacted none of part two. A bill of lading is not in the First Schedule, so the Act's general provisions can reach it, but there is no Indian statutory criterion of uniqueness, and electronic bills of lading operate by contract through registry rulebooks.
• The UNCITRAL Model Law on Electronic Transferable Records, 2017, is where the uniqueness problem was eventually addressed, through control, singularity, integrity and identifiability.

Test yourself

1. Why did carriage of goods need a chapter of its own? Because a bill of lading is a document of title whose function is to be the only one in existence, so that the holder is entitled to the goods. Every other paper requirement addressed by the Model Law is about recording, signing or preserving, and can be satisfied by a data message; uniqueness cannot, because a data message can be copied perfectly and without limit.

2. State article 17(3) and identify its criterion. Where a right is to be granted to, or an obligation acquired by, one person and no other, and the law requires it to be conveyed by the transfer or use of a paper document, that requirement is met by one or more data messages provided a reliable method is used to render the data message or messages unique. The criterion is uniqueness, assessed by a standard of reliability that article 17(4) makes relative to the purpose and the circumstances.

3. What do articles 17(5) and 17(6) prevent? The same cargo being claimed twice, once electronically and once on paper. Once rights are conveyed by data messages, no paper document used for the same action is valid unless the electronic use has been terminated and replaced, and any paper document then issued must contain a statement of that termination.

4. Is a bill of lading excluded from the Indian Act by the First Schedule? No. The Schedule excludes a negotiable instrument as defined in section 13 of the Negotiable Instruments Act, 1881, namely a promissory note, bill of exchange or cheque, together with a power of attorney, a trust, a will and a contract for the sale or conveyance of immovable property. A bill of lading is a document of title to goods and is not within that list.

5. How does an electronic bill of lading work in India in the absence of an enacted article 17(3)? By contract. The parties and the carrier join a registry whose rulebook they agree to be bound by, and the registry's record of who holds the electronic bill is treated as determinative between them. It binds only those who joined, which is the difference between a contractual arrangement and a document of title good against the world.

Article 4, interpretation, and it is the article that keeps the Law uniform. In interpreting the Law regard is to be had to its international origin and to the need to promote uniformity in its application and the observance of good faith. Questions the Law governs but does not expressly settle are to be settled in conformity with the general principles on which the Law is based.

Why an article about interpretation is worth an examination paragraph. A model law that each State reads through its own doctrines produces forty different laws with one text. Article 4(1) tells a national court not to do that, and article 4(2) fills gaps from the instrument's own principles rather than from domestic law. It is the same technique as article 7 of the Vienna Sales Convention, and the Indian Act has no equivalent provision at all.

The solution: a general rule with a presumptive list

Article 6(1) restates article 7 of the 1996 Law. Where the law requires a signature of a person, that requirement is met in relation to a data message if an electronic signature is used that is as reliable as was appropriate for the purpose for which the data message was generated or communicated, in the light of all the circumstances, including any relevant agreement. Article 6(2) applies it to both kinds of statute, as before.

Article 6(3) is the innovation. An electronic signature is considered to be reliable for the purpose of satisfying that requirement if four conditions are met.

(a) The signature creation data are, within the context in which they are used, linked to the signatory and to no other person.

(b) The signature creation data were, at the time of signing, under the control of the signatory and of no other person.

(c) Any alteration to the electronic signature, made after the time of signing, is detectable.

(d) Where a purpose of the legal requirement for a signature is to provide assurance as to the integrity of the information to which it relates, any alteration made to that information after the time of signing is detectable.

Read those four again and notice what they do not say. They do not name public key cryptography, or a hash function, or a certificate. They describe what a technology must achieve: unique linkage, sole control, tamper-evidence of the signature, and tamper-evidence of the document. A digital signature satisfies all four, which is why digital signatures were the technology of the day, but so would anything else that achieved the same results.

Article 6(4) keeps the list from becoming a closed one. Paragraph 3 does not limit the ability of any person to establish the reliability of an electronic signature in any other way, or to adduce evidence of non-reliability. So the four conditions are a safe harbour, not a definition: meet them and reliability is established, fail them and you may still prove it another way.

Article 3 states the same principle as a prohibition: nothing in the Law, except article 5, is to be applied so as to exclude, restrict or deprive of legal effect any method of creating an electronic signature that satisfies article 6(1) or otherwise meets the requirements of applicable law. That is the equal treatment of signature technologies, and it is the headline principle of the instrument.

Article 2: the vocabulary Module II uses

Article 2(a): an electronic signature means data in electronic form in, affixed to or logically associated with, a data message, which may be used to identify the signatory in relation to the data message and to indicate the signatory's approval of the information contained in the data message.

Article 2(b): a certificate means a data message or other record confirming the link between a signatory and signature creation data.

Article 2(d): a signatory means a person that holds signature creation data and acts either on its own behalf or on behalf of the person it represents.

Article 2(e): a certification service provider means a person that issues certificates and may provide other services related to electronic signatures.

Article 2(f): a relying party means a person that may act on the basis of a certificate or an electronic signature.

Those five words map onto the Indian Act almost exactly. The Indian subscriber in section 2(1)(zg) is the signatory; the Indian Certifying Authority in section 2(1)(g) is the certification service provider; the Indian Electronic Signature Certificate in section 2(1)(tb) is the certificate. India has no term for the relying party, which is a real gap and one chapter 450 has to work around.

Notice also that "signature creation data" is what India calls the private key, and the Model Law deliberately avoids the cryptographic word.

Articles 8 to 11: three sets of duties

This is the part of the instrument that has no Indian counterpart in the same form, and it is worth learning as a set.

Article 8, the conduct of the signatory. Where signature creation data can be used to create a signature that has legal effect, each signatory shall exercise reasonable care to avoid unauthorised use of its signature creation data; shall without undue delay notify any person that may reasonably be expected to rely on or provide services in support of the signature if the signatory knows the data have been compromised, or if the circumstances known to the signatory give rise to a substantial risk that they may have been; and shall, where a certificate is used, exercise reasonable care to ensure the accuracy and completeness of all material representations made by the signatory that are relevant to the certificate throughout its life cycle. Article 8(2): a signatory shall bear the legal consequences of its failure to satisfy those requirements.

Article 9, the conduct of the certification service provider. It shall act in accordance with its own representations about its policies and practices; exercise reasonable care as to the accuracy and completeness of its material representations relevant to the certificate; provide reasonably accessible means enabling a relying party to ascertain from the certificate the identity of the provider, that the signatory identified had control of the signature creation data when the certificate was issued, and that the data were valid at or before that time; provide reasonably accessible means enabling a relying party to ascertain the method used to identify the signatory, any limitation on purpose or value, that the data are valid and uncompromised, any limitation on the provider's liability, whether means exist for the signatory to give notice under article 8, and whether a timely revocation service is offered; where those services are offered, actually provide them; and utilise trustworthy systems, procedures and human resources. Article 9(2) again attaches the legal consequences of failure.

Article 10 says how trustworthiness is assessed, and lists seven factors: financial and human resources including the existence of assets; quality of hardware and software systems; procedures for processing certificates and applications and for retaining records; availability of information to signatories and potential relying parties; regularity and extent of audit by an independent body; the existence of a declaration by the State, an accreditation body or the provider regarding compliance; and any other relevant factor.

Article 11, the conduct of the relying party. A relying party shall bear the legal consequences of its failure to take reasonable steps to verify the reliability of an electronic signature, or, where the signature is supported by a certificate, to take reasonable steps to verify the validity, suspension or revocation of the certificate and to observe any limitation with respect to it.

Article 11 is the shortest article and the most neglected. It puts a burden on the person who relies. A party that acts on a certificate without checking whether it has been revoked, or that ignores a stated limit on the value of transactions the certificate covers, bears the consequence. The Indian Act has no equivalent provision at all, and chapter 340 has to reason from section 42 and general principle instead.

Article 7: who decides

Article 7(1) leaves a blank for the enacting State: any person, organ or authority, whether public or private, specified by the enacting State as competent, may determine which electronic signatures satisfy article 6.

Article 7(2) requires any such determination to be consistent with recognised international standards, and article 7(3) preserves the rules of private international law.

India filled that blank with the Central Government and the Second Schedule. Section 3A of the Act provides that a subscriber may authenticate an electronic record by an electronic signature or authentication technique which is considered reliable and specified in the Second Schedule, and section 3A(2) lists the factors the technique must satisfy, which are recognisably article 6(3). Chapter 290 owns section 3A and the Second Schedule.

Article 12: foreign certificates and signatures

Article 12(1): in determining whether or to what extent a certificate or an electronic signature is legally effective, no regard shall be had to the geographic location where the certificate is issued or the signature created or used, or to the geographic location of the place of business of the issuer or signatory.

Article 12(2) and (3): a certificate issued outside the enacting State, and a signature created or used outside it, have the same legal effect as a domestic one if they offer a substantially equivalent level of reliability.

Article 12(4) directs regard to recognised international standards and any other relevant factors in assessing equivalence.

Article 12(5) preserves party autonomy: where parties agree between themselves to the use of certain types of electronic signatures or certificates, that agreement is to be recognised as sufficient for cross-border recognition, unless it would not be valid or effective under applicable law.

Section 19 of the Indian Act is a narrower answer. It empowers the Controller, with the previous approval of the Central Government and by notification, to recognise a foreign Certifying Authority, subject to conditions. So India requires an act of recognition where article 12 requires an assessment of equivalence. Chapter 420 owns section 19.

The two Model Laws compared

A worked example

Vikram, a director of a Nagpur company, holds an Electronic Signature Certificate and uses it to sign a supply agreement with a buyer in Colombo.

Under article 6(3), the signature is reliable if the signature creation data are linked to Vikram and to no other person, were under his sole control at the moment of signing, and if any later alteration to the signature or to the agreement is detectable. A digital signature achieves all four, so the requirement in article 6(1) is satisfied without any inquiry into what was appropriate.

Under article 8, Vikram must take reasonable care to stop anybody else using the data, and if he learns his private key has been copied, or learns facts giving rise to a substantial risk that it has, he must notify without undue delay both his certification service provider and anybody who may reasonably be expected to rely. Under article 8(2) he bears the consequences of not doing so.

Under article 9, his provider must operate trustworthy systems, must let the Colombo buyer check the certificate's validity and any limit on its use, and must run a timely revocation service if it has said it does.

Under article 11, the buyer must take reasonable steps to check that the certificate has not been suspended or revoked and to observe any limitation on it. If the certificate says it covers transactions up to fifty lakh rupees and the agreement is for two crore, the buyer that ignores the limit bears the consequence.

Under article 12, the fact that the certificate was issued in India and the buyer is in Sri Lanka is irrelevant, and the certificate has the same effect there as a Sri Lankan one if it offers a substantially equivalent level of reliability.

Under Indian law, article 6(3) is section 3A(2), and articles 8, 9, 11 and 12 have no direct counterpart. The signatory's duty is in section 42, the Certifying Authority's obligations are in sections 30 to 34 and the Certifying Authorities Rules 2000, there is nothing on the relying party, and foreign recognition is by notification under section 19.

What this does NOT mean

It does not mean the 2001 Law replaces the 1996 Law. The Guide to Enactment says the new Model Law is a separate legal instrument, fully consistent with the 1996 Law and building on its article 7. A State may enact either or both.

It does not mean article 6(3) defines an electronic signature. It states when one is considered reliable, and article 6(4) preserves the ability to prove reliability otherwise or to disprove it.

It does not mean India enacted this Model Law. It enacted its reliability criteria into section 3A(2), and the 2008 amendment's shift from digital signature to electronic signature follows its philosophy. The duty articles and article 12 were not taken.

Quick revision

• Adopted 12 December 2001 by resolution 56/80. Twelve articles. Builds on article 7 of the 1996 Model Law.
• Article 3, equal treatment of signature technologies: no method that meets article 6(1) or applicable law is to be excluded or restricted.
• Article 6(1): as reliable as appropriate in the circumstances. Article 6(3): four presumptive criteria. Signature creation data linked to the signatory alone; under the signatory's sole control at signing; any later alteration to the signature detectable; any later alteration to the information detectable where the requirement exists to assure integrity.
• Article 6(4): the four criteria are a safe harbour, not a definition. Reliability may be proved otherwise, and non-reliability may be proved.
• Article 7: the enacting State names who may determine which signatures satisfy article 6, consistently with recognised international standards. India named the Central Government and the Second Schedule, in section 3A.
• Articles 8, 9 and 11: duties of the signatory (care, notify on compromise, accurate representations), the certification service provider (act on its own representations, enable verification, trustworthy systems), and the relying party (verify reliability, check revocation, observe limitations). Each bears the consequences of failure.
• Article 10: seven factors for trustworthiness, including independent audit.
• Article 12: no regard to geography; a foreign certificate or signature has the same effect if substantially equivalent in reliability; party agreement suffices for cross-border recognition. India instead requires recognition by notification under section 19.

Test yourself

1. State the four criteria in article 6(3) and explain why none of them names a technology. Signature creation data linked to the signatory and to no other person in the context of use; under the signatory's control and no other person's at the time of signing; any later alteration to the signature detectable; and, where the requirement exists to assure integrity, any later alteration to the information detectable. They name results rather than techniques because naming a technology in a statute freezes it, which is the error the first European directive made, and because article 3 requires equal treatment of signature technologies.

2. What is the effect of article 6(4)? It makes article 6(3) a safe harbour rather than a definition: a person may establish the reliability of a signature that does not meet the four criteria in any other way, and a person may adduce evidence that a signature meeting them is in fact unreliable. Without it, the four criteria would have become an exclusive test and the equal treatment principle would have been defeated.

3. Set out the duty of the relying party and say why it matters. Article 11: a relying party bears the legal consequences of failing to take reasonable steps to verify the reliability of the signature and, where a certificate supports it, to verify the certificate's validity, suspension or revocation and to observe any limitation on it. It matters because it places part of the risk on the person who chose to act, so a party who ignores a revocation list or a stated value limit cannot complain, and because the Indian Act contains no equivalent.

4. How does India's answer to article 7 differ from India's answer to article 12? For article 7, India named a competent authority and a method: section 3A makes the Central Government and the Second Schedule the determinants, and section 3A(2) reproduces the reliability criteria. For article 12, India did not adopt the equivalence test at all; section 19 requires the Controller, with the previous approval of the Central Government, to recognise a foreign Certifying Authority by notification, so recognition is an administrative act rather than an assessment made case by case.

5. Why did the Commission write a second Model Law instead of amending the first? Because article 7 of the 1996 Law stated a correct principle that gave businesses no advance certainty about which methods would be accepted, while several legislatures were supplying certainty by writing one technology into their statutes. A separate instrument could add presumptive criteria and rules of conduct without disturbing the 1996 text, and could be enacted by States that had already enacted the first.

The four things India took, and took well

Writing, in section 4. Where any law provides that information or any other matter shall be in writing or in the typewritten or printed form, that requirement shall be deemed to have been satisfied if such information or matter is rendered or made available in an electronic form and accessible so as to be usable for a subsequent reference. That is article 6 with the criterion intact.

Retention, in section 7. The three conditions of article 10 are all there: accessibility for subsequent reference, retention in the format generated, sent or received or a format that can be demonstrated to represent it accurately, and retention of details enabling identification of the origin, destination, date and time of despatch or receipt. Section 7(2) adds a sensible exception for information automatically generated solely to enable a message to be sent or received.

Acknowledgment, in section 12. Article 14's structure survives: any communication or conduct sufficient to indicate receipt where no form was agreed; the message treated as never sent where the originator stipulated that it was conditional on acknowledgment; and the two-stage notice where it did not.

Despatch and receipt, in section 13. Despatch when the record enters a computer resource outside the originator's control. Receipt at the designated computer resource, or on retrieval if sent elsewhere, or on entry into any computer resource of the addressee where none was designated. And the deeming in section 13(3): the record is deemed despatched at the place where the originator has his place of business and received where the addressee has his, with section 13(5) defining place of business for parties with more than one or none. Chapter 870 works it with P.R. Transport Agency.

On these four, harmonisation was achieved. An Indian court and a Singaporean court applying their respective enactments would reach the same result on the same facts.

The one big divergence: signature

This is the answer to the critical half of the 2025-26 question, and it should be the centre of any answer on how far the Act incorporates the Model Law's principles.

Article 7 is a standard. Any method that identifies the person and indicates approval will do, if it is as reliable as appropriate in the circumstances. The circumstances include the value of the transaction, the practice between the parties and any agreement. A typed name may be enough for one purpose and not for another.

Section 5 is a rule. Where any law provides that information or any matter shall be authenticated by affixing the signature, that requirement shall be deemed satisfied if such information or matter is authenticated by means of an electronic signature affixed in such manner as may be prescribed by the Central Government.

Four consequences follow, and they are examinable.

First, certainty is gained. A business knows in advance that a digital signature from a licensed Certifying Authority, or the Aadhaar-based e-authentication technique in the Second Schedule, will satisfy any statutory signature requirement.

Second, flexibility is lost. A method that plainly identifies the signer and shows approval, and is entirely appropriate for the transaction, does not satisfy section 5 unless it is prescribed. A scanned signature, a typed name and a one-time password sent to a registered mobile number are all outside it.

Third, India built an institution the Model Law never needed. Because the acceptable methods are prescribed, somebody has to license and supervise the people who supply them, which is Chapters VI and VII of the Act and the whole of Module II topic 2.3.

Fourth, the technology neutrality of article 3 of the 2001 Model Law is achieved only formally. Section 3A does allow the Second Schedule to be amended, and section 3A(2) reproduces the article 6(3) criteria, so a new technique can be added. But it must be added, by the Central Government, before anyone may use it.

Two honest points on the other side. India was legislating in 1999 into a system with no history of accepting anything but a wet signature, and a prescribed method was the safer choice. And section 5 bites only where a law requires a signature, which most commercial dealing does not, so the practical reach of the divergence is narrower than it first appears. Chapter 930 shows what section 10A then does.

The four omissions, and what each costs

Article 3, interpretation. Without it, an Indian court construing section 13 has no direction to have regard to the instrument's international origin, to uniformity of application, or to the general principles of the Model Law in filling a gap. The cost is that Indian interpretation is not formally tied to the interpretation given elsewhere, which is a direct loss of the harmonisation the whole exercise was for.

Article 5 bis, incorporation by reference. Without it, the enforceability of terms behind a link is decided by ordinary principles of notice and assent with no statutory starting point. Chapter 960 works the browse-wrap problem that results.

Article 12, declaration of will. Without it, a unilateral electronic notice that is not part of a contract, such as a notice of termination or a revocation, is recognised only through the general width of section 4.

Article 13(3), (4) and (5), reliance on an attributed message. This is the most serious. Section 11 says when a record is the originator's. The Model Law goes on to say when the addressee is entitled to act as though it is, when that entitlement is lost, and what happens when transmission introduced an error. The compromised-password case, which is the commonest fact pattern in practice, is squarely within article 13(3)(b) and is answered in India only by the general law of agency, estoppel and negligence. Chapter 940 works it.

What India added, which the Model Law never had

Chapters VI and VII: the Controller of Certifying Authorities and the licensing regime, sections 17 to 42. The Model Law on Electronic Signatures has duty articles but no regulator, and the 1996 Model Law has neither.

Chapter IX and Chapter XI: penalties, compensation and offences, sections 43 to 47 and 65 to 78. Nothing in either Model Law creates a penalty or an offence. Every one of these is an Indian policy choice.

Chapter X: an appellate tribunal, sections 48 to 64.

The State powers in sections 69, 69A, 69B, 70, 70A and 70B, on interception, blocking, traffic data, protected systems, critical information infrastructure and CERT-In. These are the furthest of all from anything UNCITRAL wrote, and Module III is largely about them.

The intermediary provisions in section 79 and the rules under it. The Model Law defines an intermediary in order to exclude it from being an originator or an addressee. India defines it in order to give it an immunity and then attach conditions to it.

So the Act is a commercial statute with a regulatory statute and a criminal statute welded on. A critical answer should say so, and should say that the welding shows: the offences chapter uses the definitions written for a chapter about trade, so that section 66 borrows its actus reus from section 43, a civil provision about compensation.

How far was harmonisation achieved? An honest assessment

On the recognition provisions, substantially. Writing, retention, attribution in its basic form, acknowledgment and the rules on despatch and receipt are all recognisably the Model Law, and a foreign lawyer reading them would know where they came from.

On signature, not really. India adopted the objective of article 7 and rejected its method, which means that a signature acceptable in most enacting States is not acceptable in India, and the divergence is at the point where cross-border transactions most often need certainty.

On evidence, not at all. Article 9 keeps admissibility and weight apart and India merged them, which is why the Indian case law on section 65B and now section 63 of the Bharatiya Sakshya Adhiniyam has been so unsettled. Chapter 1270 works it.

And on everything India added, the question does not arise, because there was nothing to harmonise with.

One further point deserves credit. Because the Act took the Model Law's technology-neutral definitions of data, information and electronic record, it has survived twenty-six years of technological change without needing to be redefined, and the 2026 amendment on synthetically generated information was made in rules rather than by amending the Act's vocabulary. That is the Model Law's method working.

A worked example

Alpha Fabrics in Ichalkaranji contracts with Beta Textiles in Dubai by email. The Emirates has legislation based on the Model Law; India has the Act.

Writing. Both satisfied: article 6 in Dubai, section 4 in India, same criterion.

Retention. Both satisfied: article 10 and section 7, same three conditions.

Time and place. Both reach the same answers: despatch on leaving the sender's control, receipt at the designated system, place deemed to be the place of business.

Signature. Alpha's managing director types his name at the foot of the confirmation. In Dubai that may satisfy the signature requirement if it was as reliable as appropriate. In India it does not satisfy section 5, because a typed name is not prescribed. If Indian law requires a signature for this contract, and it generally does not, Alpha has a problem that Beta does not.

Attribution. Beta receives an order from Alpha's account, sent by a dismissed employee. In Dubai, article 13(3)(b) entitles Beta to act on it, subject to article 13(4). In India, section 11 does not attribute it, because the employee had no authority, and Beta must fall back on estoppel or on Alpha's negligence.

Those last two divergences are precisely the harmonisation gap, and they are what a critical answer should name.

What this does NOT mean

It does not mean the Act failed. It achieved for India what the Model Law was for, and it did it in 2000, ahead of most of the region.

It does not mean the omissions were accidents. India took the alternative texts the Commission itself offered in footnotes to article 1, which shows the drafters were reading closely.

It does not mean the added chapters are a criticism. Every State that enacted the Model Law added a penal and regulatory layer of some kind, because a commerce statute alone leaves the wrongs unaddressed. The criticism is about the joinery, not about the decision to build both.

Quick revision

• The object is uniformity, and resolution 51/162 says so; the Act's preamble recites it.
• Taken and taken well: writing (s.4 from art. 6), retention (s.7 from art. 10), acknowledgment (s.12 from art. 14), despatch and receipt (s.13 from art. 15).
• The big divergence: art. 7 is a reliability standard; s.5 is a prescribed method. Gains certainty, loses flexibility, and forces the whole Certifying Authority regime into existence.
• Four omissions: art. 3 (interpretation), art. 5 bis (incorporation by reference), art. 12 (declaration of will), and art. 13(3) to (5) (when the addressee may rely). The last is the most serious.
• Part two, arts. 16 and 17, not enacted, so India has no statutory criterion of uniqueness for an electronic transferable record.
• India added: the Controller and licensing (Ch. VI and VII), penalties and offences (Ch. IX and XI), a tribunal (Ch. X), the State powers (ss. 69 to 70B) and the intermediary safe harbour (s.79). None has a Model Law counterpart.
• Assessment: substantial harmonisation on recognition, little on signature, none on evidence, and no question arising on the added chapters.

Test yourself

1. How does a model law harmonise the law, and how does that differ from a treaty? A model law is a text legislatures may enact with or without modification, so harmonisation is achieved to the extent each State adopts it and is a question of fact about each enactment. A treaty produces a single text binding on ratifying States in the terms ratified. UNCITRAL chose a model law because the technology was moving faster than a treaty could be renegotiated.

2. Name four provisions of the Act that follow the Model Law closely, with the article each comes from. Section 4 from article 6 on writing; section 7 from article 10 on retention; section 12 from article 14 on acknowledgment of receipt; section 13 from article 15 on the time and place of despatch and receipt. Section 11 from article 13(1) and (2) on attribution is a fifth, but only in part.

3. Explain the difference between article 7 and section 5, and give two consequences. Article 7 accepts any method that identifies the signer and indicates approval and is as reliable as appropriate in the circumstances. Section 5 requires an electronic signature affixed in the manner prescribed by the Central Government. Consequences: businesses gain certainty about which methods work but lose the ability to use an appropriate method that has not been prescribed; and India needed a licensing regime for the suppliers of prescribed methods, which is Chapters VI and VII of the Act.

4. Which omission from the Model Law is the most serious in practice, and why? Article 13(3) to (5). Section 11 says when a record is the originator's, but the Act says nothing about when an addressee may act on a message that appears to be from the originator and is not, when that entitlement is lost, or what happens where transmission produced an error. The compromised-credential case is the commonest fact pattern in practice and is left to agency, estoppel and negligence.

5. Assess how far the Act successfully incorporates the Model Law's principles. Substantially on the recognition provisions, where writing, retention, acknowledgment and the rules on despatch and receipt reproduce the Model Law's criteria and would yield the same results in another enacting State. Only formally on signature, where the objective was adopted and the method rejected. Not at all on evidence, where article 9 keeps admissibility and weight apart and Indian law made reliability a condition of admissibility. And not applicable to the licensing, penal, appellate, State powers and intermediary chapters, which India added and which have no Model Law counterpart at all.

Two notes on that table, and both are traps.

Chapter II and Chapter III overlap in numbering because section 6A was inserted into Chapter III and sections 10 and 10A into Chapter II, so the section runs are not neatly separated. Read the chapter headings, not the numbers.

The chapter headings themselves have been amended. Chapter II was headed "Digital Signature" until 2008 and is now "Digital Signature and Electronic Signature"; Chapter X was headed "The Cyber Appellate Tribunal" until the Finance Act 2017 and is now "The Appellate Tribunal"; Chapter XII was substituted whole in 2008. A textbook printed before 2009 gives the old headings.

The four blocks

Block one, Chapters I to V, sections 1 to 16: making electronic records work. This is the Model Law. Everything here is about giving an electronic record the legal effect a paper one would have had, and about the mechanical rules that follow once people communicate by machine. If the Act had stopped at section 16 it would have been a faithful enactment of the 1996 Model Law and nothing else.

Block two, Chapters VI to VIII, sections 17 to 42: the trust infrastructure. Because section 5 accepts only a prescribed method, somebody must supply and vouch for that method, and somebody must supervise the suppliers. Chapter VI creates the Controller and the licence; Chapter VII governs the certificate; Chapter VIII binds the subscriber. Chapter 110 explains why India needed this block and the Model Law did not.

Block three, Chapters IX to XI, sections 43 to 78: consequences. Chapter IX is civil: damage, compensation, adjudication by an officer rather than a court. Chapter X is the appeal. Chapter XI is criminal. The sequence is deliberate and useful: the Act tries a civil answer first and reaches for the criminal law afterwards.

Block four, sections 69 to 70B and Chapter XII, and much of Chapter XIII: the State and the network. These sit inside Chapters XI and XIII rather than in a chapter of their own, which is the Act's least tidy feature. Interception, blocking, traffic-data monitoring, protected systems, critical information infrastructure and CERT-In are all in the offences chapter. The intermediary safe harbour has a chapter to itself. Module III is largely block four.

Where to find things: a lookup for the whole subject

Definitions: section 2. Every term. Chapters 150 and 160.

Does the Act apply to this document at all? Section 1(4) and the First Schedule. Chapter 140.

Is this electronic record as good as writing? Section 4. As good as a signature? Section 5 with sections 3 and 3A.

How long must this be kept, and in what form? Section 7.

Whose message is it? Section 11. When and where was it sent and received? Section 13.

Who licenses the people who issue certificates? Section 17, and the licence is under section 24.

My certificate has been misused. What now? Sections 37 to 39 on suspension and revocation, section 42 on the duty to keep the private key secret, and section 43 or 66 against whoever misused it.

Somebody damaged my data. Section 43 for compensation, section 66 for the offence, section 46 for who adjudicates a claim up to five crore rupees.

Somebody published my private photograph. Section 66E, and section 67 or 67A if it is obscene or sexually explicit, and rule 3(2)(b) of the 2021 Rules for a takedown in twenty-four hours.

The Government wants to read my messages. Section 69 and the Interception Rules 2009.

The Government wants a website blocked. Section 69A and the Blocking Rules 2009.

A platform is refusing to take down defamatory material. Section 79 with the 2021 Rules, and chapter 1360.

A company's server was breached and my data leaked. Section 43A with the SPDI Rules 2011 for compensation, section 72A if there was a service-provider disclosure in breach of contract, and the CERT-In directions for the reporting obligation.

Where does the Act say it prevails over other law? Section 81, with its proviso preserving the Copyright Act and the Patents Act. Chapter 1280.

The rules, and why the Act is unreadable without them

Section 87 empowers the Central Government to make rules, and it is a very long section. Almost every important question in this subject is answered in a rule and not in the Act.

A student who reads the Act and not the rules will know that section 79 confers an immunity and will not know a single thing an intermediary actually has to do.

The four Schedules

The First Schedule, under section 1(4), lists the documents and transactions the Act does not apply to. Chapter 140 owns it.

The Second Schedule, under section 3A, specifies the electronic signature or electronic authentication techniques. Chapter 290 owns it.

The Third and Fourth Schedules were the amending Schedules, carried by sections 91 to 94, which amended the Indian Penal Code, the Indian Evidence Act 1872, the Bankers' Books Evidence Act 1891 and the Reserve Bank of India Act 1934. Sections 91 to 94 were omitted in 2008 as spent, having done their work. What section 92 did to the Evidence Act, inserting the old section 65B, is taught in chapter 1270 as history.

A worked example: finding your way

A client says: "Our accounts clerk received an email that looked like it came from our supplier, changed the bank details, and we paid eighteen lakh rupees to a fraudster. What can we do?"

Start with Chapter I. Is this within the Act at all? Yes: an electronic record, a computer resource, and nothing in the First Schedule excludes it.

Chapter IV. Was the email attributed to the supplier under section 11? No, unless it was sent by the supplier, by somebody authorised, or by the supplier's automated system. So the supplier is not bound by it, and chapter 940 explains what the Act does not say about reliance.

Chapter IX. Section 43 gives a claim for compensation against whoever accessed a computer resource without authorisation or introduced a deceptive record; if the supplier's mail account was compromised and the supplier was negligent in protecting sensitive personal data, section 43A may reach the supplier too, and chapter 230 works the SPDI Rules.

Chapter XI. Section 66 makes the fraudster's conduct an offence; section 66C reaches the use of another's identifying feature; section 66D reaches cheating by personation using a computer resource.

Chapter IX again. Section 46: the claim for eighteen lakh rupees goes to the adjudicating officer, not to a civil court, because it is under five crore rupees.

Chapter XII. Is the email provider liable? Section 79, and almost certainly not.

Outside the Act. Section 318 of the Bharatiya Nyaya Sanhita for cheating, the bank's obligations under the Reserve Bank's directions on unauthorised electronic transactions, and section 63 of the Bharatiya Sakshya Adhiniyam to prove the emails.

Every one of those steps is a chapter of this book, and the map is what let us find them in order.

What this does NOT mean

It does not mean the chapters are watertight. Sections 69 to 70B create no offence in the ordinary sense and sit in the offences chapter; section 43A creates no penalty and sits in the penalties chapter. The headings are a guide, not a classification.

It does not mean the Act is self-contained. Section 81 gives it overriding effect, but the general criminal law, the law of contract, the law of evidence and the law of copyright all continue to apply, and much of Module IV is about how they fit together.

It does not mean sections 91 to 94 never mattered. They are the reason electronic records are admissible in Indian courts at all, and their omission in 2008 is a tidying up of provisions that had already done their work.

Quick revision

• Thirteen chapters, sections 1 to 90. Five omitted sections: 20, 91, 92, 93, 94.
• Four blocks: recognition (I to V, ss.1 to 16); trust infrastructure (VI to VIII, ss.17 to 42); consequences (IX to XI, ss.43 to 78); the State and the network (ss.69 to 70B, XII and parts of XIII).
• Chapter headings have been amended: Chapter II gained "and Electronic Signature" in 2008; Chapter X lost "Cyber" in 2017; Chapter XII was substituted in 2008.
• Section 87 is the rule-making power, and almost every operative detail is in a rule, not in the Act.
• Four Schedules: the First under s.1(4), exclusions; the Second under s.3A, signature techniques; the Third and Fourth, the amending Schedules carried by ss.91 to 94, now omitted as spent.
• The untidiness worth naming: sections 69 to 70B are State powers sitting in the offences chapter, and section 43A is a compensation provision sitting in the penalties chapter.

Test yourself

1. Name the four blocks of the Act and the sections in each. Recognition, Chapters I to V, sections 1 to 16. The trust infrastructure, Chapters VI to VIII, sections 17 to 42. Consequences, Chapters IX to XI, sections 43 to 78. The State and the network, sections 69 to 70B inside Chapter XI, Chapter XII on intermediaries, and parts of Chapter XIII.

2. Which chapter would you look in for each of: whether an email satisfies a requirement of writing; who licenses a Certifying Authority; whether a marketplace is liable for a seller's listing; and where a claim for four crore rupees is decided? Chapter II, section 4. Chapter VI, sections 17 and 24. Chapter XII, section 79. Chapter IX, section 46, because the claim is under five crore rupees and goes to the adjudicating officer.

3. Why is it a mistake to read the Act without the rules? Because section 87 leaves the operative detail to rules, and the provisions that decide practical questions are in them: what reasonable security practices are, how a blocking direction is made and reviewed, what an intermediary must do to keep its immunity, and how an adjudication proceeds. Section 79 confers an immunity and says nothing about what an intermediary must actually do; the 2021 Rules do.

4. What did sections 91 to 94 do, and why are they no longer in the Act? They carried the Third and Fourth Schedules, which amended the Indian Penal Code, the Indian Evidence Act 1872, the Bankers' Books Evidence Act 1891 and the Reserve Bank of India Act 1934, and it was section 92 with the Second Schedule that inserted the old section 65B into the Evidence Act. They were omitted by the 2008 amendment as spent, the amendments having already taken effect in the amended statutes.

5. Give two places where the Act's chapter headings mislead. Sections 69, 69A, 69B, 70, 70A and 70B confer State powers and sit in Chapter XI, headed "Offences", although the sections themselves create powers rather than offences, with the offences attached as consequences of non-compliance. And section 43A, which creates a right to compensation with no penalty at all, sits in Chapter IX headed "Penalties, Compensation and Adjudication".

So the connecting factor India chose is the location of the machine, not the nationality of the offender and not the location of the victim. A person anywhere who attacks a server in Pune is within the Act. A person anywhere who attacks an Indian company's server in Frankfurt is not, on the face of section 75, however Indian the victim.

Section 1(3): commencement

"It shall come into force on such date as the Central Government may, by notification, appoint and different dates may be appointed for different provisions of this Act."

The Act was brought into force on 17 October 2000, and the Information Technology (Amendment) Act, 2008 was brought into force on 27 October 2009. Those two dates matter constantly, because a great many of the provisions a student meets did not exist before the second.

The power to appoint different dates for different provisions is not a formality either. It is the same power the Digital Personal Data Protection Act, 2023 used to stage its own commencement over eighteen months, and chapter 1050 works out what that means for the parts of that Act that are not yet law.

The section closes by providing that a reference in any provision to the commencement of the Act is to be construed as a reference to the commencement of that provision. That is the drafting device that makes staged commencement workable.

Section 1(4) and (5): the First Schedule

"Nothing in this Act shall apply to documents or transactions specified in the First Schedule: Provided that the Central Government may, by notification in the Official Gazette, amend the First Schedule by way of addition or deletion of entries thereto."

"Every notification issued under sub-section (4) shall be laid before each House of Parliament."

Sub-sections (4) and (5) in this form were substituted by the 2008 amendment. The Act as passed had a fixed Schedule; the amendment made it amendable by notification, with the notification laid before Parliament.

Two things follow. The list of exclusions is not in the Act's own text and can change without an amending Act, so it must be checked rather than remembered. And it has in fact changed: chapter 140 works the notification of 26 September 2022 that rewrote it.

The words "save as otherwise provided in this Act"

These words in section 1(2) are the hinge between section 1 and everything else. They mean the extraterritorial claim yields wherever the Act says something different, and section 75(2) is exactly such a provision.

They also mean that the exclusion in section 1(4) is not affected by section 1(2). A document in the First Schedule is outside the Act whether it is made in India or abroad.

A worked example

Three sets of facts, and the same section decides all three.

A person in Manila breaks into a Mumbai bank's server and moves money. Section 1(2) applies the Act to a contravention committed outside India by any person. Section 75(2) is satisfied because the conduct involves a computer system located in India. So sections 43 and 66 both reach him, and section 75(1) makes his Filipino nationality irrelevant. Whether India can get him is a different question, and chapter 880 works it.

An Indian citizen in Toronto sends a threatening message to another Indian in Toronto, using a service whose servers are in Ireland. Section 1(2) claims application, but section 75(2) is not satisfied: no computer, computer system or computer network located in India was involved. The Act does not apply on its own terms.

A builder in Thane and a buyer in Dombivli make an agreement for the sale of a flat by exchanging signed electronic documents. Before 26 September 2022 this would have been outside the Act under serial number 5 of the First Schedule. Chapter 140 shows why it is not any more, and that change is the single most surprising thing in section 1.

What this does NOT mean

It does not mean the Act applies to everything done abroad. Section 1(2) states the claim and section 75(2) confines it to conduct involving a machine located in India. Reading section 1(2) alone is the commonest mistake made about this section.

It does not mean a person abroad can be tried in India as a matter of course. Applicability of the Act is one question; getting the accused before a court, which needs extradition or presence, is another. Chapter 840 keeps prescriptive and enforcement jurisdiction apart.

It does not mean the First Schedule is fixed. It is amendable by notification under the proviso to section 1(4), and it has been amended.

It does not mean the Act does not apply in Jammu and Kashmir. It extends to the whole of India, and any statement to the contrary reflects the pre-2019 position.

Quick revision

• Section 1(1): short title. The principal Act is still the Information Technology Act, 2000, Act 21 of 2000, not renamed by the 2008 amendment.
• Section 1(2): extends to the whole of India and to any offence or contravention committed outside India by any person, save as otherwise provided.
• Section 75(1) adds "irrespective of his nationality"; section 75(2) supplies the limit: the conduct must involve a computer, computer system or computer network located in India.
• Section 1(3): commencement by notification, different dates for different provisions. Act in force 17 October 2000; the 2008 amendment in force 27 October 2009.
• Section 1(4): the Act does not apply to what the First Schedule lists, and the Central Government may amend the Schedule by notification. Section 1(5): every such notification is laid before each House.
• The connecting factor India chose is the location of the machine, not the nationality of the offender or the location of the victim.

Test yourself

1. Set out the extraterritorial rule in the Act and state its limit. Section 1(2) applies the Act to any offence or contravention under it committed outside India by any person, and section 75(1) adds that nationality is irrelevant. Section 75(2) limits it: the Act applies to such conduct only if the act or conduct constituting the offence or contravention involves a computer, computer system or computer network located in India.

2. An Indian company's data is stolen from its server in Singapore by a hacker in Brazil. Does the Act apply? Not on the face of section 75(2), because no computer, computer system or computer network located in India was involved in the conduct. Indian ownership of the data and Indian nationality of the victim are not connecting factors under this Act, though the general criminal law and the law of the place of the server may apply.

3. Why does section 1(3) allow different dates for different provisions, and give a current example of the power being used? Because a statute of this kind needs institutions built before its substantive provisions can operate, so the Government stages commencement. The Digital Personal Data Protection Act, 2023 used the same power in section 1(2) of that Act: G.S.R. 843(E) of 13 November 2025 brought its Board provisions into force at once, its consent manager provisions after twelve months, and its substantive sections 3 to 17 after eighteen months.

4. How may the First Schedule be changed, and what safeguard attaches? Under the proviso to section 1(4) the Central Government may amend it by notification in the Official Gazette, by addition or deletion of entries. Section 1(5) requires every such notification to be laid before each House of Parliament, which is the parliamentary control on a power that would otherwise let the executive remove documents from the Act's operation by itself.

5. What do the words "save as otherwise provided in this Act" in section 1(2) do? They subordinate the extraterritorial claim to any contrary provision of the Act, and section 75(2) is the principal such provision, cutting the claim down to conduct involving a machine in India. Without those words section 1(2) and section 75(2) would be in direct conflict.

Serial number 5 read: "Any contract for the sale or conveyance of immovable property or any interest in such property." It was omitted by S.O. 4720(E), and the omission is the most consequential change to this Act since 2009 that nobody talks about.

The amendment of 26 September 2022

The notification was made under the proviso to section 1(4), and it did three things.

It substituted serial number 1, so that a cheque, a demand promissory note or a bill of exchange is no longer excluded if it is issued in favour of or endorsed by an entity regulated by the Reserve Bank of India, the National Housing Bank, the Securities and Exchange Board of India, the Insurance Regulatory and Development Authority of India or the Pension Fund Regulatory and Development Authority.

It amended serial number 2, so that a power of attorney empowering such a regulated entity to act for, on behalf of, and in the name of the executant is no longer excluded.

It omitted serial number 5 entirely.

The first two changes have a single purpose and it is worth naming. Lending in India is documented by a demand promissory note and a power of attorney, and until 2022 a lender regulated by the Reserve Bank could not take either electronically. The amendment lets a regulated lender complete a loan file without paper. It is deliberately narrow: the exclusion still stands for everybody else, so an ordinary promissory note between two individuals is still outside the Act.

The third change is not narrow at all.

What the omission of serial number 5 means

Since 26 September 2022, a contract for the sale or conveyance of immovable property, or of any interest in it, is within the Act. So sections 4, 5, 7 and 10A apply to it, and an agreement for sale made by electronic record is not outside the Act's recognition provisions.

Three cautions, and a student who gives only the headline will be caught by any of them.

First, the Act's removal of one obstacle does not remove the others. The Registration Act, 1908 requires certain instruments to be registered, and registration requires presentation to the registering officer. The Transfer of Property Act, 1882 requires a sale of tangible immovable property of one hundred rupees and upwards to be made by a registered instrument. Section 1(4) getting out of the way does not make an unregistered electronic conveyance effective; it makes the Act's recognition provisions available to instruments that are otherwise good.

Second, stamp duty is untouched. State stamp laws and their machinery for e-stamping operate independently.

Third, the distinction between an agreement for sale and a conveyance matters. An agreement for sale of immovable property does not itself transfer an interest, and section 17 of the Registration Act requires registration of certain agreements in some States and not in others. The omission of serial 5 has its clearest effect on agreements that never needed registration.

So the honest statement is this. The Act no longer stands aside from property transactions, which is a real and current change; the other statutes that govern them still stand where they did.

The exclusions and the reason for each

A worked example

Kirti Housing Finance, a company regulated by the National Housing Bank, lends thirty lakh rupees to Mr and Mrs Salvi against their flat in Kalyan.

The demand promissory note. Before 26 September 2022 this was serial number 1 and could not be electronic. Now, because it is a demand promissory note issued in favour of an entity regulated by the National Housing Bank, it is outside the exclusion, so section 4 makes an electronic note satisfy a requirement of writing and section 5 makes a prescribed electronic signature satisfy a requirement of signature.

The power of attorney in favour of the lender. Before 2022 this was serial number 2. Now, because it empowers a regulated entity to act for, on behalf of, and in the name of the Salvis, it is outside the exclusion.

The loan agreement. Never excluded, and always capable of being electronic.

The mortgage of the flat. Serial number 5 is gone, so the Act does not stand aside. But section 59 of the Transfer of Property Act requires a mortgage other than by deposit of title deeds to be effected by a registered instrument, and the Registration Act requires registration. What has changed is that the Act's recognition provisions are available; what has not changed is the registration requirement.

A will the Salvis make leaving the flat to their daughter. Serial number 4 still excludes it, and an electronic will is ineffective in India however carefully it is signed.

What this does NOT mean

It does not mean the excluded documents are unlawful in electronic form. It means the Act's provisions do not apply to them, so the pre-2000 position governs, and under that position a will must be signed and attested and a negotiable instrument must be an instrument.

It does not mean the exclusion of negotiable instruments has gone. Only the three named kinds, and only where a regulated financial entity is the payee or the endorser. A promissory note between two individuals is still excluded.

It does not mean electronic conveyancing is now available in India. The Act's obstacle is gone; the Registration Act, the Transfer of Property Act and the State stamp laws are not.

It does not mean the Schedule can be changed quietly. Section 1(5) requires every notification under section 1(4) to be laid before each House of Parliament.

Quick revision

• Section 1(4): nothing in the Act applies to what the First Schedule lists. Proviso: the Central Government may amend the Schedule by notification. Section 1(5): every such notification is laid before each House.
• Four entries survive: negotiable instrument, power of attorney, trust, will.
• S.O. 4720(E), 26 September 2022, did three things: carved a cheque, demand promissory note and bill of exchange out of serial 1 where a regulated financial entity is payee or endorser; carved out of serial 2 a power of attorney empowering such an entity to act for the executant; and omitted serial number 5 entirely.
• Serial 5 was "any contract for the sale or conveyance of immovable property or any interest in such property". It is gone.
• The omission removes the Act's obstacle only. The Registration Act 1908, the Transfer of Property Act 1882 and State stamp laws are untouched.
• The regulators named are the RBI, the National Housing Bank, SEBI, IRDAI and PFRDA.

Test yourself

1. List the First Schedule as it now stands. A negotiable instrument as defined in section 13 of the Negotiable Instruments Act, 1881, other than a cheque, a demand promissory note or a bill of exchange issued in favour of or endorsed by an entity regulated by the Reserve Bank of India, the National Housing Bank, SEBI, IRDAI or PFRDA; a power of attorney as defined in section 1A of the Powers-of-Attorney Act, 1882, excluding one empowering such a regulated entity to act for, on behalf of and in the name of the executant; a trust as defined in section 3 of the Indian Trusts Act, 1882; and a will as defined in section 2(h) of the Indian Succession Act, 1925, including any other testamentary disposition.

2. What was serial number 5, what happened to it, and when? It was "any contract for the sale or conveyance of immovable property or any interest in such property". It was omitted by notification S.O. 4720(E) dated 26 September 2022, made under the proviso to section 1(4).

3. Does that omission make electronic conveyancing possible in India? Not by itself. It removes the Act's own exclusion, so sections 4, 5 and 10A can apply to such a contract. It does not touch section 54 or section 59 of the Transfer of Property Act, 1882, the registration requirements of the Registration Act, 1908, or State stamp legislation, all of which continue to require a registered instrument for a sale or mortgage of immovable property.

4. Why were cheques and demand promissory notes carved out only for regulated entities? Because the purpose was to let regulated lenders complete a loan file electronically, and the risks of a copyable negotiable instrument are containable within a supervised financial system where the payee or endorser is an entity the regulator can hold to account. Between two individuals the risk of multiple holders remains, so the exclusion still applies.

5. Why does a will remain excluded when a conveyance does not? Because the formality that a will requires, signature by the testator attested by two witnesses who saw him sign, exists precisely because the testator cannot be asked what he meant, and there is no accepted electronic equivalent of attestation in the presence of the testator. A conveyance, by contrast, is made between living parties who can be asked, and its third-party protection comes from registration rather than from the medium of the document.

Computer: clause (i)

"'Computer' means any electronic, magnetic, optical or other high-speed data processing device or system which performs logical, arithmetic, and memory functions by manipulations of electronic, magnetic or optical impulses, and includes all input, output, processing, storage, computer software or communication facilities which are connected or related to the computer in a computer system or computer network."

Three features, and each does work.

Technology neutral. "Electronic, magnetic, optical or other". A technology that does not yet exist is inside the definition if it processes data at high speed by manipulating impulses.

Functional. The test is performing logical, arithmetic and memory functions. A device is a computer because of what it does, not what it is called.

Inclusive. The keyboard, the monitor, the printer, the disk, the software and the communication facilities connected or related to it are all part of the computer. That matters for search and seizure under section 80 and for confiscation under section 76: seizing a computer means seizing its peripherals.

Computer system: clause (l)

"'Computer system' means a device or collection of devices, including input and output support devices and excluding calculators which are not programmable and capable of being used in conjunction with external files, which contain computer programmes, electronic instructions, input data and output data, that performs logic, arithmetic, data storage and retrieval, communication control and other functions."

The difference from clause (i) is that a computer system may be a collection of devices working as a unit, and that it must contain programmes, instructions and data.

The exclusion is the only express exclusion in the machine definitions. A calculator which is neither programmable nor capable of being used with external files is not a computer system. A programmable one is not excluded, and neither is a scientific calculator that reads a memory card.

Clause (l) also adds two functions to the list: data storage and retrieval, and communication control.

Computer network: clause (j)

"'Computer network' means the inter-connection of one or more computers or computer systems or communication device through (i) the use of satellite, microwave, terrestrial line, wire, wireless or other communication media; and (ii) terminals or a complex consisting of two or more interconnected computers or communication device whether or not the inter-connection is continuously maintained."

This clause was substituted by the 2008 amendment, and two changes matter. The original required two or more computers; the substituted clause says "one or more computers or computer systems or communication device", which brings a phone connected to a server inside it. And the closing words, "whether or not the inter-connection is continuously maintained", put beyond argument that an intermittent connection is a network.

The list of media is illustrative and closed with "or other communication media", so a technology not listed is inside.

Computer resource: clause (k)

"'Computer resource' means computer, computer system, computer network, data, computer data base or software."

Six words, and three of them are not machines. This is the widest term in the Act and the one to watch. It includes data, a computer database and software.

Which sections use it? Section 43 in some of its clauses, section 66C, 66D, 66E and 66F, sections 69, 69A and 69B, section 70, section 72A, section 79, and the definitions of cyber cafe and cyber security. In short, every provision written or rewritten in 2008 uses computer resource, and the older ones use the narrower terms.

That is the single most useful observation in this chapter, and it explains why the State powers reach a file and a website while section 43's older clauses are written around machines.

Communication device: clause (ha)

"'Communication device' means cell phones, personal digital assistance or combination of both or any other device used to communicate, send or transmit any text, video, audio or image."

Inserted in 2008, and its function is to put a phone inside the Act without argument. A phone is a computer under clause (i) anyway, but in 2008 that was not obvious to everybody, and several offences are framed in terms of "a computer resource or a communication device" precisely to close the point. Section 66C and section 66D are both drafted that way.

Data, information, electronic form and electronic record

"'Data' means a representation of information, knowledge, facts, concepts or instructions which are being prepared or have been prepared in a formalised manner, and is intended to be processed, is being processed or has been processed in a computer system or computer network, and may be in any form (including computer printouts magnetic or optical storage media, punched cards, punched tapes) or stored internally in the memory of the computer." Clause (o).

The words in brackets carry the surprise. A computer printout is data. So a person who takes a printed report has taken data, and the offence or contravention does not fail because nothing electronic was touched at the moment of taking.

"'Information' includes data, message, text, images, sound, voice, codes, computer programmes, software and data bases or micro film or computer generated micro fiche." Clause (v), as amended in 2008 to add "data, message, text".

So information is the wider word and data sits inside it, which is the opposite of the ordinary usage in which data is raw and information is data with meaning. Chapter 20 explains the ordinary usage; the statute reverses it, and an answer must use the statute's.

"'Electronic form', with reference to information, means any information generated, sent, received or stored in media, magnetic, optical, computer memory, micro film, computer generated micro fiche or similar device." Clause (r).

"'Electronic record' means data, record or data generated, image or sound stored, received or sent in an electronic form or micro film or computer generated micro fiche." Clause (t).

Electronic record is the unit the whole Act operates on. Sections 3, 4, 7, 11, 12, 13, 14, 65 and 67 are all about electronic records, and the term corresponds to the Model Law's "data message", which chapter 60 works.

Function, and secure system

"'Function', in relation to a computer, includes logic, control, arithmetical process, deletion, storage and retrieval and communication or telecommunication from or within a computer." Clause (u). Note that deletion is expressly a function, which matters for section 43(d) and for section 65.

"'Secure system' means computer hardware, software, and procedure that (a) are reasonably secure from unauthorised access and misuse; (b) provide a reasonable level of reliability and correct operation; (c) are reasonably suited to performing the intended functions; and (d) adhere to generally accepted security procedures." Clause (ze). Chapter 220 works secure records and signatures.

"'Security procedure' means the security procedure prescribed under section 16 by the Central Government." Clause (zf).

Cyber cafe and cyber security

"'Cyber cafe' means any facility from where access to the internet is offered by any person in the ordinary course of business to the members of the public." Clause (na), inserted 2008. Chapter 1430 works the Cyber Cafe Rules 2011.

"'Cyber security' means protecting information, equipment, devices, computer, computer resource, communication device and information stored therein from unauthorised access, use, disclosure, disruption, modification or destruction." Clause (nb), inserted 2008.

Clause (nb) is the statutory definition of the phrase MU prints as topic 3.3, and it is worth noticing that it is a definition by reference to six harms: unauthorised access, use, disclosure, disruption, modification and destruction. Chapter 750 builds on it.

The four terms side by side, with what turns on each

A worked example

Nikhil, who works for a Pune analytics firm, copies a client database to a personal drive on his last day and emails a summary to a competitor.

Was there access? Yes, under clause (a): he communicated with and instructed the memory function resources of his employer's computer system. It does not matter that he was authorised to be at the keyboard; authorisation to use is not authorisation to copy, and section 43 turns on whether the act was without permission of the owner.

What did he take? The database is data under clause (o) and a computer data base, so it is also a computer resource under clause (k). The summary email is an electronic record under clause (t).

Which sections reach it? Section 43(b) covers downloading, copying or extracting data from a computer, computer system or computer network. Section 66 makes the same act an offence if done dishonestly or fraudulently. Section 72A may reach him if he was a person providing services under a contract who disclosed personal information in breach of it, because that section is drafted around a computer resource. Chapters 1100, 1180 and 1250 own those three.

Change one fact. Suppose he printed the database and carried out the paper. There is now no access under clause (a), because he did not gain entry into, instruct or communicate with anything after the printing. But the printout is still data under clause (o), so his employer's remedies under the general law and any offence of criminal breach of trust remain, and the point is that the Act's reach turned on the definition and not on the wrongfulness of what he did.

What this does NOT mean

It does not mean the four machine terms are interchangeable. Reading "computer resource" into a section that says "computer" widens the section beyond what Parliament wrote, and reading "computer" into a section that says "computer resource" narrows it.

It does not mean the section 2 definitions govern other statutes. They apply "in this Act, unless the context otherwise requires". Where the Bharatiya Sakshya Adhiniyam or the Copyright Act uses similar words it has its own definitions, and chapter 480 shows how differently the Copyright Act defines a computer programme.

It does not mean information means what it means in ordinary speech. In the Act, information includes data, which is the reverse of the usual relationship.

It does not mean everything in section 2 is here. The definitions about people and transactions, originator, addressee, intermediary, subscriber, Certifying Authority, key pair and the rest, are in chapter 160.

Quick revision

• Access, 2(1)(a): gaining entry into, instructing or communicating with the logical, arithmetical or memory function resources. Instruction alone is access.
• Computer, 2(1)(i): technology neutral, functional, and inclusive of peripherals, storage, software and communication facilities.
• Computer system, 2(1)(l): a device or collection of devices; excludes a calculator that is not programmable and cannot use external files.
• Computer network, 2(1)(j): substituted in 2008; one or more computers, systems or communication devices; whether or not the interconnection is continuously maintained.
• Computer resource, 2(1)(k): the widest. Computer, computer system, computer network, data, computer data base or software. Every provision written in 2008 uses it.
• Data, 2(1)(o): includes a computer printout. Information, 2(1)(v): includes data, so information is the wider word.
• Electronic record, 2(1)(t): the unit the Act operates on; the Model Law's data message.
• Communication device, 2(1)(ha), cyber cafe, 2(1)(na), cyber security, 2(1)(nb), electronic signature, 2(1)(ta) and Electronic Signature Certificate, 2(1)(tb): all inserted in 2008.

Test yourself

1. Distinguish computer, computer system and computer network. A computer, section 2(1)(i), is a high-speed data processing device performing logical, arithmetic and memory functions, including its input, output, storage, software and communication facilities. A computer system, section 2(1)(l), is a device or collection of devices including input and output support devices, containing programmes, instructions and data, that performs logic, arithmetic, storage and retrieval and communication control, expressly excluding a calculator that is not programmable and cannot use external files. A computer network, section 2(1)(j), is the interconnection of one or more computers, computer systems or communication devices by any medium, whether or not the interconnection is continuously maintained.

2. Why does it matter that section 69 uses "computer resource" and section 43 in part uses "computer, computer system or computer network"? Because computer resource, section 2(1)(k), additionally includes data, a computer database and software, while the other three are machines. A power framed around a computer resource therefore reaches a file, a database or a program directly, whereas a provision framed around the machines reaches data only through the specific acts the provision lists.

3. A person floods a website with automated requests until it stops responding. Has he accessed it? Yes. Section 2(1)(a) makes instructing or communicating with the logical, arithmetical or memory function resources of a computer, computer system or computer network access, so entry is not required. That is why a denial of service attack is within section 43(f), which covers denying or causing the denial of access to any person authorised to access.

4. Is a printout data? Yes. Section 2(1)(o) provides that data may be in any form, "including computer printouts, magnetic or optical storage media, punched cards, punched tapes", so a printed representation of processed information is data within the Act.

5. Which definitions were inserted or substituted by the 2008 amendment, and why does it matter? Inserted: communication device, clause (ha); cyber cafe, (na); cyber security, (nb); electronic signature, (ta); Electronic Signature Certificate, (tb); and Indian Computer Emergency Response Team, (ua). Substituted: computer network, clause (j), and intermediary, clause (w). It matters because a book or a judgment predating 27 October 2009 works from a materially different section 2, and because every provision the amendment inserted is drafted using the vocabulary it inserted with them.

This clause was substituted by the 2008 amendment, which added the list. The original definition was the bare functional test.

Four things about it decide most of Module IV.

It is defined with respect to a particular electronic record. The same company may be an intermediary in relation to one record and not another. A platform that carries a user's post is an intermediary as to that post; the same platform's own advertisement for itself is its own content and it is not an intermediary as to that.

The functional test is four-limbed: on behalf of another person, receives, stores or transmits that record, or provides any service with respect to that record. The last limb is very wide, and it is what brings a search engine, which neither receives, stores nor transmits the underlying page, inside the definition.

The list is inclusive, not exhaustive. "Includes" means a business not on the list is an intermediary if it satisfies the functional test.

A cyber cafe is expressly on the list, and separately defined in clause (na), which is why the Cyber Cafe Rules 2011 exist and why chapter 1430 uses them as the clearest worked example of due diligence.

The consequence is section 79, the safe harbour, and chapter 1360 works it. Being an intermediary is not a liability; it is the gateway to an immunity, subject to conditions.

Subscriber: clause (zg)

"'Subscriber' means a person in whose name the electronic signature Certificate is issued."

Short and consequential. The subscriber is the person the certificate names, and Chapter VIII of the Act, sections 40 to 42, puts three duties on him: to generate the key pair as prescribed, to accept the certificate in the manner the section requires, and to keep the private key secret. Chapter 340 works them.

Note the mismatch with the Model Law's vocabulary. The 2001 Model Law calls this person the signatory, and defines a relying party as well. India has no term for the relying party, which is a real gap and one chapter 340 has to reason around.

Certifying Authority and Controller

"'Certifying Authority' means a person who has been granted a licence to issue an electronic signature Certificate under section 24." Clause (g).

The definition is by reference to the licence, not to the activity. A person who issues something that looks like a certificate without a licence is not a Certifying Authority under the Act, and commits an offence under section 21(1) read with the penalties.

"'Controller' means the Controller of Certifying Authorities appointed under sub-section (1) of section 17." Clause (m). Chapter 400 works the office.

"'Certification practice statement' means a statement issued by a Certifying Authority to specify the practices that the Certifying Authority employs in issuing electronic signature Certificates." Clause (h). Chapter 450 shows why it matters: it is the document against which the Authority's conduct is judged.

"'Licence' means a licence granted to a Certifying Authority under section 24." Clause (z).

The cryptographic definitions

"'Asymmetric crypto system' means a system of a secure key pair consisting of a private key for creating a digital signature and a public key to verify the digital signature." Clause (f).

"'Key pair', in an asymmetric crypto system, means a private key and its mathematically related public key, which are so related that the public key can verify a digital signature created by the private key." Clause (x).

"'Private key' means the key of a key pair used to create a digital signature." Clause (zc).

"'Public key' means the key of a key pair used to verify a digital signature and listed in the Digital Signature Certificate." Clause (zd).

These four clauses put one technology into the statute, and chapter 260 explains what asymmetric cryptography actually is. The 2008 amendment did not remove them; it added electronic signature alongside, so the Act now contains both a technology-specific vocabulary and a technology-neutral one. Chapter 310 works the resulting distinction.

Digital signature, electronic signature, and the two certificates

"'Digital signature' means authentication of any electronic record by a subscriber by means of an electronic method or procedure in accordance with the provisions of section 3." Clause (p).

"'Electronic signature' means authentication of any electronic record by a subscriber by means of the electronic technique specified in the Second Schedule and includes digital signature." Clause (ta), inserted 2008.

So electronic signature is the wider term and digital signature sits inside it, exactly as information is wider than data. That relationship is the answer to a question set in 2015 and again as a short note in 2025-26.

"'Digital Signature Certificate' means a Digital Signature Certificate issued under sub-section (4) of section 35." Clause (q).

"'Electronic Signature Certificate' means an Electronic Signature Certificate issued under section 35 and includes Digital Signature Certificate." Clause (tb), inserted 2008. Same relationship again.

"'Affixing electronic signature' with its grammatical variations and cognate expressions means adoption of any methodology or procedure by a person for the purpose of authenticating an electronic record by means of digital signature." Clause (d), as amended.

Clause (d) is a drafting untidiness worth noticing. The 2008 amendment substituted "electronic signature" for "digital signature" in the term being defined but left "digital signature" in the definition itself, so "affixing electronic signature" is defined as authenticating by means of a digital signature. Chapter 310 records it.

Verify: clause (zh)

"'Verify', in relation to a digital signature, electronic record or public key, with its grammatical variations and cognate expressions, means to determine whether (a) the initial electronic record was affixed with the digital signature by the use of private key corresponding to the public key of the subscriber; (b) the initial electronic record is retained intact or has been altered since such electronic record was so affixed with the digital signature."

Two questions, and both must be answered before verification succeeds. Was it signed by the private key matching this public key, which is authenticity; and has it changed since, which is integrity. Chapter 280 works how the mathematics answers both at once.

The remaining definitions

"'Adjudicating officer' means an adjudicating officer appointed under sub-section (1) of section 46." Clause (c). Chapter 1120.

"'Appellate Tribunal' means the Appellate Tribunal referred to in sub-section (1) of section 48." Clause (da), inserted 2008. Chapter 1140 shows that what section 48 now refers to is the Telecom Disputes Settlement and Appellate Tribunal.

"'Appropriate Government' means, as respects any matter enumerated in List II of the Seventh Schedule to the Constitution, or relating to any State law enacted under List III, the State Government, and in any other case the Central Government." Clause (e). This is the clause behind section 90, the State rule-making power, and behind the division of function in sections 69 and 69B.

"'Electronic Gazette' means the Official Gazette published in the electronic form." Clause (s). Chapter 360 works section 8.

"'Function', 'law', 'prescribed', 'secure system' and 'security procedure' are in clauses (u), (y), (zb), (ze) and (zf). Clause (y) is worth a glance: "law" includes an Act of Parliament or of a State Legislature, an Ordinance, Regulations made by the President under article 240, a President's Act under article 357(1)(a), and rules, regulations, bye-laws and orders made under any of them. That width is what makes sections 4 and 5 reach subordinate legislation as well as statutes.

"'Indian Computer Emergency Response Team' means an agency established under sub-section (1) of section 70B." Clause (ua), inserted 2008. Chapter 760.

Section 2(2) provides that a reference in the Act to any enactment or provision is, in relation to an area where it is not in force, to be construed as a reference to the corresponding law in force in that area.

The Act's vocabulary against the Model Law's

A worked example

Ashwini buys a saree from a marketplace. The seller is a shop in Surat. Payment goes through a payment gateway. The marketplace's servers are rented from a cloud provider.

Who is the originator of the order? Ashwini, under clause (za): she sent it, and she caused it to be transmitted.

Who is the addressee? The seller, if the order was intended for the seller. If the marketplace itself contracts as seller under an inventory model, the marketplace is the addressee. That is a question of fact about the marketplace's own terms, and chapter 970 works the marketplace and inventory models under the E-Commerce Rules 2020.

Who is an intermediary? The marketplace, as to the seller's listing and as to Ashwini's order, because it receives, stores or transmits those records on behalf of another. The payment gateway, expressly on the list as an online payment site. Her internet service provider. The cloud provider, as to the records it stores. Each of them, separately, and each only as to the particular records it handles.

Who is not an intermediary? The marketplace, as to its own advertising, its own product descriptions if it wrote them, and its own terms of service. Section 79 gives it nothing there, and chapter 1360 shows the line the cases have drawn.

Now suppose the saree never arrives and Ashwini alleges the listing was fraudulent. Every question about the marketplace's liability begins by asking whether it was acting as an intermediary in relation to the particular record complained of. The definition is not background; it is the first issue.

What this does NOT mean

It does not mean being an intermediary is a liability. It is the qualification for an immunity under section 79, subject to that section's conditions.

It does not mean the intermediary list is exhaustive. "Includes" makes it illustrative, and any person satisfying the functional test is an intermediary whether or not it is on the list.

It does not mean a Certifying Authority is anyone who certifies. Clause (g) defines it as a person granted a licence under section 24, so the definition is institutional.

It does not mean the Act has a term for the relying party. It does not, and the duty article 11 of the 2001 Model Law puts on that person has no Indian counterpart.

Quick revision

• Originator, 2(1)(za) and addressee, 2(1)(b): both taken from the Model Law and both expressly exclude an intermediary. The originator includes a person who causes a message to be sent, and one who stores it.
• Intermediary, 2(1)(w), substituted 2008: with respect to a particular electronic record, a person who on behalf of another receives, stores or transmits it or provides any service with respect to it; the list of businesses is inclusive.
• Subscriber, 2(1)(zg): the person the certificate names. The Model Law calls him the signatory.
• Certifying Authority, 2(1)(g): defined by the licence under section 24, not by the activity.
• Digital signature, 2(1)(p) sits inside electronic signature, 2(1)(ta); Digital Signature Certificate, 2(1)(q) sits inside Electronic Signature Certificate, 2(1)(tb).
• Verify, 2(1)(zh): two questions, authenticity and integrity.
• Asymmetric crypto system, key pair, private key, public key, clauses (f), (x), (zc), (zd): one technology written into the statute in 2000 and left there in 2008.
• India has no definition of a relying party, and no equivalent of article 11 of the 2001 Model Law.

Test yourself

1. Why do the definitions of originator and addressee both exclude an intermediary? Because an intermediary handles the message on behalf of another and has no interest in its content, so treating it as a party would attach to it the legal consequences of a communication it did not make and did not intend to receive. The exclusion is taken from articles 2(c) and 2(d) of the 1996 Model Law.

2. Set out the definition of intermediary and identify its four limbs. Section 2(1)(w): with respect to any particular electronic records, any person who on behalf of another person (i) receives, (ii) stores or (iii) transmits that record, or (iv) provides any service with respect to that record, and includes the businesses listed. The fourth limb is the widest and is what brings a search engine within the definition.

3. Is a company an intermediary in relation to everything on its website? No. The definition operates "with respect to any particular electronic records", so the same company may be an intermediary as to a user's post and not as to its own content, its own advertising, or descriptions it wrote itself. That distinction is the first issue in any question about section 79.

4. Explain the relationship between digital signature and electronic signature under section 2. Section 2(1)(p) defines a digital signature as authentication in accordance with section 3, which is the asymmetric crypto system and hash function route. Section 2(1)(ta), inserted in 2008, defines an electronic signature as authentication by the technique specified in the Second Schedule and expressly includes a digital signature. So electronic signature is the wider term and every digital signature is an electronic signature, but not the reverse.

5. Name two places where the Act's vocabulary has no Model Law counterpart, and one where the Model Law's has no Indian counterpart. The Act's Certifying Authority is defined by a licence, which has no Model Law counterpart because the Model Law regulates conduct rather than status; and the Act's cryptographic definitions in clauses (f), (x), (zc) and (zd) name a technology the Model Laws deliberately avoid. Conversely the 2001 Model Law's "relying party", article 2(f), has no Indian definition, so article 11's duty on that person has no counterpart in the Act.

Purpose three: amending four statutes. Sections 91 to 94 with the Third and Fourth Schedules, all since omitted as spent. What section 92 did to the Indian Evidence Act, inserting the old section 65B, is the reason electronic records are admissible in Indian courts at all, and chapter 1270 works its successor.

Purpose four, in the third recital: promoting efficient delivery of Government services by means of reliable electronic records. The word reliable is doing quiet work. Reliability is what Chapters VI, VII and VIII are for: a certificate is reliable because a licensed Certifying Authority stands behind it. So the licensing regime is traceable to the preamble, though only through this recital.

What the preamble does not mention

No offence. Chapter XI, sections 65 to 78, creates about twenty offences, and nothing in the preamble announces them.

No State power over the network. Sections 69, 69A, 69B, 70, 70A and 70B give powers of interception, blocking, traffic monitoring, and the machinery of protected systems, critical information infrastructure and CERT-In. The preamble is silent.

No intermediary regime. Section 79 and the rules under it are the most consequential part of the Act in daily life, and the preamble does not hint at them. Section 79 in its present form was inserted in 2008, long after the preamble was written.

No data protection. Section 43A and the SPDI Rules 2011 came in 2008 and 2011.

That is not a defect of drafting; it is the record of what happened. The Act was written as a commerce statute in 1999 and became, by amendment, the principal instrument of internet regulation in India. Chapter 180 works the amendment that did most of it.

Holding the Act against its own purposes

On purpose one it has largely succeeded. Electronic contracting is ordinary in India, the recognition provisions are used without controversy, and the courts have not had to strain them. The one real gap is section 5's prescribed-method rule for signatures, which chapter 110 works.

On purpose two it has succeeded beyond what was expected. Section 6 was drafted for filing forms; what it enabled, with section 6A and the rules of 2011, is a service delivery architecture through which a citizen obtains documents rather than merely submitting them. Chapter 380 works it.

On purpose three it did what it said, and the provisions have been omitted as spent.

On the purposes it never stated, the record is mixed and contested, which is what Modules III and IV are about. Section 66A was struck down. Sections 69A and 79 survived and were read down. The 2021 Rules are the subject of continuing litigation. A student writing a critical answer has plenty to say and should say it about the parts the preamble never claimed.

A worked example

A court has to decide whether a wholly new kind of electronic instrument, unmentioned in the Act, is within it. Counsel on both sides argue from the preamble. How is the argument run?

Step one, what the preamble says. The Act is to provide legal recognition for transactions carried out by means of electronic data interchange and other means of electronic communication, commonly referred to as electronic commerce, which involve the use of alternatives to paper-based methods of communication and storage of information; to facilitate electronic filing of documents with Government agencies; and to amend the Indian Penal Code, 1860, the Indian Evidence Act, 1872, the Bankers' Books Evidence Act, 1891, and the Reserve Bank of India Act, 1934.

Step two, what a preamble may be used for. It is a key to the intention of the makers and may be used to resolve an ambiguity, but it cannot control clear words. So counsel may argue from it that a doubtful provision should be read to include the new instrument, and may not argue from it that a plain exclusion should be ignored.

Step three, the argument for inclusion. The first purpose is drawn widely, "and other means of electronic communication", and the functional equivalence approach the Act adopts from the Model Law asks what a paper rule is for rather than what form it takes. Chapter 80.

Step four, the argument against, and it is the stronger one. The First Schedule excludes five classes of document by type, not by function, so Parliament has shown that it legislates by naming, and section 1(4) gives that exclusion statutory force. Section 3A requires an electronic signature technique to be specified in the Second Schedule, so recognition is by listing and not by resemblance. Chapters 140 and 250.

Step five, and the point the preamble makes by omission. It says nothing about cyber crime, nothing about cyber security, nothing about privacy or data protection and nothing about intermediaries. Chapters IX and XI, sections 69, 69A, 69B, 70A, 70B, 79 and 43A were all added later or expanded far beyond what the preamble contemplated. A statute whose preamble is about electronic commerce now carries India's interception power, its blocking power and its national incident response agency.

Step six, the conclusion to state. That the Act has succeeded on its first two purposes, spent itself on the third, and grown a fourth body of law its preamble never announced, and that an argument from the preamble is therefore weakest exactly where the modern litigation is. Chapter 1420.

What this does NOT mean

It does not mean the added chapters are ultra vires. Parliament may legislate on what it chooses, and a preamble does not confine the enacting words. It means only that the Act's stated purpose is a poor description of the Act as it now stands.

It does not mean the preamble is useless. It is the reason the Model Law is a legitimate aid to construing sections 4, 7, 11, 12 and 13, because the Act says on its face that it was enacted to give effect to the resolution adopting it.

It does not mean the Act failed at what it set out to do. On its stated purposes it worked.

Quick revision

• The preamble names three purposes: legal recognition of electronic commerce; facilitating electronic filing with Government agencies; amending the Indian Penal Code, the Indian Evidence Act 1872, the Bankers' Books Evidence Act 1891 and the Reserve Bank of India Act 1934.
• The recitals name resolution A/RES/51/162, the recommendation of favourable consideration in the interests of uniformity, and the promotion of efficient delivery of Government services by reliable electronic records.
• The word "reliable" is the only textual hook for Chapters VI to VIII, the licensing regime.
• Not mentioned: offences, the State powers in sections 69 to 70B, the intermediary safe harbour in section 79, and data protection. All of the last three were inserted in 2008 or later.
• The preamble legitimises using the Model Law to construe the recognition provisions, because the Act says on its face that it was enacted to give effect to the resolution adopting it.

Test yourself

1. State the purposes the preamble names. To provide legal recognition for transactions carried out by means of electronic data interchange and other means of electronic communication commonly referred to as electronic commerce, involving alternatives to paper-based methods of communication and storage of information; to facilitate electronic filing of documents with Government agencies; and to amend the Indian Penal Code, the Indian Evidence Act 1872, the Bankers' Books Evidence Act 1891 and the Reserve Bank of India Act 1934.

2. Which substantial parts of the Act are not traceable to any stated purpose? The offences in Chapter XI; the State powers in sections 69, 69A, 69B, 70, 70A and 70B; the intermediary safe harbour in section 79 and the rules under it; and the data protection provision in section 43A. The licensing regime in Chapters VI to VIII is traceable only through the third recital's reference to reliable electronic records.

3. What use can be made of the preamble in construing section 13? It records that the Act was enacted to give effect to General Assembly resolution A/RES/51/162 adopting the UNCITRAL Model Law on Electronic Commerce, which makes the Model Law and its Guide to Enactment legitimate aids to construction of the provisions taken from it, of which section 13 is one.

4. Does the mismatch between the preamble and the contents affect the validity of the added chapters? No. A preamble does not confine enacting words, and Parliament's competence to legislate is not measured by the Act's stated purposes. The mismatch is a description of how the statute developed and is material for criticism, not for validity.

What the amendment substituted or rewrote

Section 66 was rewritten completely. It had been headed "Hacking with computer system" and had contained its own definition of the conduct. It now reads: if any person, dishonestly or fraudulently, does any act referred to in section 43, he shall be punishable with imprisonment for a term which may extend to three years or with fine which may extend to five lakh rupees or with both. The word hacking left the statute. Chapter 1180 works the consequences, and the point worth noticing here is that a criminal provision now borrows its conduct from a civil one.

Section 43 was widened. The one crore rupee cap on compensation was removed, so compensation is now at large, and the list grew from eight entries to ten: clause (i), destroying, deleting or altering information or diminishing its value or utility, and clause (j), stealing, concealing, destroying or altering computer source code with intent to cause damage, were both inserted.

Section 46 gained sub-section (1A), giving the adjudicating officer jurisdiction where the claim for damage does not exceed five crore rupees and vesting jurisdiction above that in the competent court. Chapter 1120 works it.

Section 69 was substituted. The original section 69 was a decryption power in narrow terms. The new one is a full interception, monitoring and decryption power with five stated grounds, and chapter 800 works it with the 2009 Rules.

Section 79 was substituted whole, and Chapter XII was rewritten around it. The original section 79 gave a network service provider a defence of proving that the contravention was committed without its knowledge or that it had exercised all due diligence. The new section confers an exemption subject to three conditions, and chapter 1360 works it.

Section 2 gained six definitions: communication device, cyber cafe, cyber security, electronic signature, Electronic Signature Certificate and Indian Computer Emergency Response Team; and two were substituted, computer network and intermediary. Chapters 150 and 160 own them.

Section 67 was rewritten, and the sentence structure changed: the maximum on first conviction became three years and five lakh rupees, and on second or subsequent conviction five years and ten lakh rupees.

The First and Second Schedules were substituted.

What the amendment omitted

Sections 91 to 94 were omitted as spent, having carried the amendments to the Indian Penal Code, the Indian Evidence Act 1872, the Bankers' Books Evidence Act 1891 and the Reserve Bank of India Act 1934.

Section 20 was omitted, which had made the Controller a repository of all Digital Signature Certificates.

The five things the amendment changed in kind

One: from one technology to many. Sections 3A and 15, with the Second Schedule, replaced a statute that recognised only the asymmetric crypto system with one that can recognise any technique the Central Government specifies. Chapter 290 works it. This is the 2001 Model Law's philosophy arriving eight years late.

Two: from one offence to a graded set. The original Act had section 65 and section 66, and the second was headed hacking. The amendment produced sections 66 and 66A to 66F, each with its own conduct and its own sentence, running from three years for computer-related offences to imprisonment for life for cyber terrorism. Chapter 1090 shows the resulting scheme.

Three: from silence to a surveillance code. Sections 69, 69A and 69B, with the three sets of Rules of 2009, are the Indian State's principal powers over the network, and none existed in this form before. Chapters 800 to 820 work them.

Four: from no institutions to three. Section 70A creates the national nodal agency for critical information infrastructure protection, section 70B creates CERT-In as the national agency for incident response, and section 79A provides for notified Examiners of Electronic Evidence. Chapters 780, 760 and 1270.

Five: from a defence to a conditional immunity. The new section 79 is the difference between an intermediary having to prove absence of knowledge and diligence in every case, and having an exemption it keeps by observing due diligence and acting on actual knowledge. Chapter 1360 works it.

A worked example

The same facts under the two versions of the Act.

In 2007, a user of an online marketplace lists an obscene video clip for sale. Another user buys it. The clip is transmitted.

Under the Act as it then stood. The seller has published obscene material in electronic form and is caught by section 67. The marketplace has published nothing and has no exemption designed for it: section 79 as it then read gave a network service provider a defence on proof of no knowledge and all due diligence, and it was arguable whether a marketplace was a network service provider at all. The chief executive was prosecuted. There was no provision at all reaching the buyer's onward transmission by phone.

Under the Act as amended. The seller is caught by section 67 and, if the material is sexually explicit, by section 67A. The marketplace is an intermediary within the substituted section 2(1)(w), which now names online-market places expressly, and section 79(1) exempts it from liability for third party information it did not initiate, select the receiver of, or select or modify, provided it observes due diligence and takes down on actual knowledge. Section 79(3)(b), as read down in 2015, makes actual knowledge mean a court order or a government notification. Section 85 governs when an officer of the company is liable. And the buyer's onward transmission by mobile phone is reached because section 67 covers transmitting, and a communication device is now defined.

The comparison is the answer to a question about what the amendment achieved, and it also shows what it cost: section 66A, drafted in the same amendment, was so wide that it was struck down.

What this does NOT mean

It does not mean the Act was renamed. The principal Act is still the Information Technology Act, 2000. The amending Act is Act 10 of 2009, commonly called ITAA 2008 after the year the Bill was passed.

It does not mean everything since 2009 is unchanged. The Finance Act 2017, the Digital Personal Data Protection Act 2023 and the rules of 2021 and 2026 have all changed the Act or the law around it, and chapter 190 works them.

It does not mean the amendment was well received. Section 66A was struck down as unconstitutional. Sections 69 and 69A are criticised as executive powers with no judicial oversight. The manner of passage, without effective debate in December 2008, is a standing complaint. A good answer says all three.

Quick revision

• Act 10 of 2009, in force 27 October 2009. Bill passed 23 December 2008; the Expert Committee had reported in 2005; the Mumbai attacks of November 2008 are the reason for the manner of passage.
• Every lettered section is a later insertion, and almost all are from this amendment: 3A, 6A, 7A, 10A, 40A, 43A, 52A to 52D, 66A to 66F, 67A to 67C, 69A, 69B, 70A, 70B, 72A, 77A, 77B, 79A, 84A to 84C.
• Rewritten: section 66, which now borrows its conduct from section 43 and drops the word hacking; section 43, cap removed and clauses (i) and (j) added; section 69, now a full interception power; section 79, now a conditional immunity; section 67; and section 2, with six new definitions and two substituted.
• Section 46(1A) gave the adjudicating officer the five crore rupee limit.
• Omitted: sections 91 to 94 as spent, and section 20.
• Five changes in kind: one technology to many; one offence to a graded set; silence to a surveillance code; no institutions to three; a defence to a conditional immunity.

Test yourself

1. Name six sections inserted by the 2008 amendment and say what each does. Section 43A, compensation for a body corporate's failure to protect sensitive personal data. Section 66C, identity theft. Section 66E, violation of privacy. Section 66F, cyber terrorism. Section 69A, blocking public access to information. Section 70B, CERT-In. Any six of the lettered sections listed above will do, provided the function is stated.

2. How did the amendment change section 66, and why does that matter? It replaced the offence of hacking with a provision punishing any act referred to in section 43 done dishonestly or fraudulently. It matters because a criminal offence now takes its conduct from a civil compensation provision, so the ten clauses of section 43 define the actus reus of section 66, and the entire criminal liability turns on the two mental elements, dishonestly and fraudulently, which the Act borrows from the general penal law.

3. What was the position of an intermediary before 2009 and what is it now? Before, section 79 gave a network service provider a defence if it proved that the contravention was committed without its knowledge or that it had exercised all due diligence, which put the burden on the provider in every case and left it unclear which businesses qualified. Now section 79(1) exempts an intermediary from liability for third party information provided it did not initiate the transmission, select the receiver or select or modify the information, and provided it observes due diligence and acts on actual knowledge under section 79(3)(b).

4. Give three criticisms of the amendment. It was passed on 23 December 2008 in the aftermath of the Mumbai attacks without effective debate. Section 66A was drafted so widely that it was struck down as unconstitutional in 2015. And the surveillance powers in sections 69, 69A and 69B were conferred on the executive with review by a committee of officials rather than any judicial oversight.

5. Why is a book or judgment dated before 27 October 2009 unsafe on this subject? Because the amendment inserted twenty-seven sections, substituted section 66, section 69, section 79 and both Schedules, added six definitions and substituted two more. Almost every provision a student meets in Modules III and IV came from it, and the pre-amendment Act has a different section 66, a different section 79 and no sections 43A, 66A to 66F, 67A to 67C, 69A, 69B, 70A, 70B or 72A at all.

2022: the First Schedule loses an entry

Notification S.O. 4720(E) dated 26 September 2022, made under the proviso to section 1(4), did three things: it carved a cheque, demand promissory note and bill of exchange out of serial number 1 where a regulated financial entity is the payee or endorser; it carved a power of attorney empowering such an entity out of serial number 2; and it omitted serial number 5 entirely.

Serial number 5 was "any contract for the sale or conveyance of immovable property or any interest in such property". Chapter 140 works the change and, just as importantly, what it does not do.

2021 and 2026: the rules under section 79 are replaced and then amended

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 were notified on 25 February 2021 in supersession of the Information Technology (Intermediaries Guidelines) Rules, 2011. They did three things the 2011 Rules had not: they expanded the due diligence in rule 3; they created a class of significant social media intermediary with additional obligations in rule 4; and they added Part III, a Code of Ethics for publishers of news and current affairs content and of online curated content, with a three-tier grievance mechanism. Chapters 1350, 1360 and 1370 work them.

They were amended in 2022 to add the Grievance Appellate Committees, in 2023 to add online gaming provisions and a fact check unit, and again with effect from 20 February 2026.

G.S.R. 120(E) dated 10 February 2026, in force 20 February 2026, is the most recent change to this subject and the most striking. It inserted into rule 2(1) a definition of audio, visual or audio-visual information, clause (ca), and a definition of synthetically generated information, clause (wa); it inserted rule 3(3), a due diligence regime for synthetically generated information requiring labelling, permanent provenance metadata, a declaration by the user and reasonable technical measures to verify; and it substituted "three hours" for "thirty-six hours" in the removal window in rule 3. Chapters 990 and 1000 work it in full.

A further set of amendments remains a draft. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Second Amendment Rules, 2026 were published for consultation in March and April 2026 and had not been notified when this book was written: the published text carries blanks where the date and the G.S.R. number should be. They are named in this book as a proposal and never taught as law.

2023 and 2025: the Digital Personal Data Protection Act, commencing in stages

This is the change most likely to be stated wrongly, and the reason is that the Act was passed in 2023 and is coming into force in 2027.

Section 44 of the Digital Personal Data Protection Act, 2023 makes three sets of consequential amendments. Sub-section (1) substitutes clause (c) of section 14 of the TRAI Act, so that the Telecom Disputes Settlement and Appellate Tribunal is the Appellate Tribunal under the Information Technology Act, the Airports Economic Regulatory Authority of India Act and the Digital Personal Data Protection Act. Sub-section (2) amends the Information Technology Act by omitting section 43A, by inserting a reference to the Digital Personal Data Protection Act in the proviso to section 81, and by omitting clause (ob) of section 87(2). Sub-section (3) substitutes clause (j) of section 8(1) of the Right to Information Act, 2005 to read simply "information which relates to personal information".

Notification G.S.R. 843(E) dated 13 November 2025 brought the Act into force in three stages, and which stage a provision is in decides whether it is law today.

Three propositions follow and each is examinable.

Section 43A of the Information Technology Act is still live law, and so are the Reasonable Security Practices and Procedures and Sensitive Personal Data or Information Rules, 2011 made under it, because section 44(2) is in the third stage and does not commence until 13 May 2027. Chapter 230 works the SPDI Rules on that footing and chapter 1040 works section 43A.

Section 8(1)(j) of the Right to Information Act has already been rewritten, from 13 November 2025, because section 44(3) is in the first stage. The exemption now reads "information which relates to personal information" without the qualifications the old clause carried, which is a significant narrowing of the right to information and is not yet in most textbooks.

The substantive data protection scheme is not yet in force. Sections 3 to 17, which contain the grounds for processing, consent, notice, the duties of a Data Fiduciary, the obligations towards children, the Significant Data Fiduciary provisions and the rights of a Data Principal, all commence on 13 May 2027. Chapter 1050 teaches them and says so on the page.

The Data Protection Board of India exists, because sections 18 to 26 commenced on 13 November 2025, and the Digital Personal Data Protection Rules, 2025 were notified the same day with a matching staged application. Chapter 1060 works the Board.

The state of the law, in one table

A worked example

A student is asked in an examination: "A company's server is breached and the personal data of two lakh customers is leaked. Advise."

A textbook answer from 2024 would say that section 43A has been repealed by the Digital Personal Data Protection Act and that the customers' remedy lies under that Act.

The correct answer today is different in both halves. Section 43A is in force, because section 44(2) of the DPDP Act does not commence until 13 May 2027, so a customer may claim compensation from the body corporate for negligence in implementing and maintaining reasonable security practices, which the SPDI Rules 2011 define. And the substantive DPDP obligations are not in force either, because sections 3 to 17 commence on the same date, so no claim lies under them.

What is in force from the DPDP Act is the Board, sections 18 to 26, which has been established but whose enforcement powers bite on obligations that do not yet exist.

And what does apply immediately is the CERT-In direction of 28 April 2022, which requires the incident to be reported to CERT-In within six hours of noticing it.

Getting that answer right requires the commencement notification and nothing else, which is why chapter 1050 quotes it.

What this does NOT mean

It does not mean the Act has been rewritten again. Only section 48 and the First Schedule have been altered in the Act's own text since 2009. Everything else is either in rules or is a change that has not yet commenced.

It does not mean the DPDP Act is a dead letter. It is law, passed and partly commenced, and the compliance timelines run from November 2025 whether or not the obligations bite until 2027.

It does not mean the draft Second Amendment Rules can be ignored. They should be named as a proposal in any answer about the direction of the law, and never stated as law.

It does not mean section 66A is back. It was struck down in 2015 and no amendment has restored it. Chapter 1190 works what happened.

Quick revision

• Finance Act 2017, Part XIV of Chapter VI: Cyber Appellate Tribunal abolished; TDSAT becomes the Appellate Tribunal under substituted section 48(1); sections 49 to 54 and 56 omitted; 52D and 55 survive.
• S.O. 4720(E), 26 September 2022: First Schedule amended; serial number 5, contracts for sale or conveyance of immovable property, omitted.
• IT Rules 2021, 25 February 2021, superseded the 2011 Intermediaries Guidelines and added Part III.
• G.S.R. 120(E), 10 February 2026, in force 20 February 2026: synthetically generated information defined and regulated; three hours replaces thirty-six.
• DPDP Act 2023, commenced by G.S.R. 843(E) of 13 November 2025 in three stages: at once, sections 1(2), 2, 18 to 26, 35, 38 to 43, and 44(1) and 44(3); after twelve months, 6(9) and 27(1)(d); after eighteen months, sections 3 to 17 and section 44(2), on 13 May 2027.
• So today: IT Act section 43A and the SPDI Rules 2011 are LIVE; RTI Act section 8(1)(j) has already been substituted; and the DPDP substantive scheme is not yet in force.
• The Second Amendment Rules 2026 are a draft, not notified.

Test yourself

1. Which body is the Appellate Tribunal under the Information Technology Act today, and under which statute is it constituted? The Telecom Disputes Settlement and Appellate Tribunal, constituted under section 14 of the Telecom Regulatory Authority of India Act, 1997. Section 48(1) of the Information Technology Act, as substituted, makes it the Appellate Tribunal for the purposes of that Act on and from the commencement of Part XIV of Chapter VI of the Finance Act, 2017.

2. Is section 43A of the Information Technology Act in force? Yes. Section 44(2)(a) of the Digital Personal Data Protection Act, 2023 provides for its omission, but notification G.S.R. 843(E) of 13 November 2025 placed section 44(2) in the eighteen-month stage, so it comes into force on 13 May 2027. Until then section 43A and the SPDI Rules 2011 made under it continue to apply.

3. Which provisions of the DPDP Act are already in force, and what did two of them change outside that Act? Section 1(2), section 2, sections 18 to 26, sections 35 and 38 to 43, and section 44(1) and (3), all from 13 November 2025. Section 44(1) substituted clause (c) of section 14 of the TRAI Act so that the TDSAT is named as the Appellate Tribunal under the IT Act, the AERA Act and the DPDP Act. Section 44(3) substituted clause (j) of section 8(1) of the Right to Information Act, 2005, which now exempts "information which relates to personal information".

4. What did G.S.R. 120(E) do and when did it take effect? Notified 10 February 2026 and in force from 20 February 2026, it amended the IT Rules 2021 by defining audio, visual or audio-visual information in rule 2(1)(ca) and synthetically generated information in rule 2(1)(wa), by inserting rule 3(3) requiring labelling, permanent provenance metadata, a user declaration and reasonable technical verification measures for synthetically generated information, and by substituting three hours for thirty-six hours in the removal window in rule 3.

5. Why is a commencement notification worth reading in full rather than summarising? Because it is a list, and what it omits is not in force. G.S.R. 843(E) brings section 44(1) and 44(3) into force at once and section 44(2) only after eighteen months, so a summary saying "the DPDP Act came into force in November 2025" produces two wrong answers: that section 43A of the IT Act has gone, and that the consent and rights provisions apply now. Neither is true.

Non-repudiation: the sender cannot later deny sending it. This is authenticity looked at from the other end, and it is why the reliability criteria in section 3A(2) require sole control of the signature creation data. If two people could have created the signature, the signer can deny it.

Section 11, attribution, is the Act's answer to a dispute about both, and chapter 940 shows how narrow that answer is.

How the objectives are actually achieved

Four families of control, and the SPDI Rules require a body corporate to have all four.

Administrative controls are policies and people: an information security policy, defined roles, background checks, training, and a process for granting and withdrawing access when somebody joins or leaves. Rule 8(1) of the SPDI Rules calls these managerial controls and requires them to be documented.

Technical controls are the machinery: authentication, access control lists, encryption at rest and in transit, firewalls, intrusion detection, patching and logging.

Operational controls are the routines: backups that are tested, monitoring of logs, incident response, and change management.

Physical controls are locks, access to server rooms, and disposal of old media.

Rule 8(1) requires "managerial, technical, operational and physical security control measures that are commensurate with the information assets being protected with the nature of business", which is those four families in the Rules' own words. Chapter 230 works rule 8 in full.

Two principles a lawyer should be able to state

Defence in depth. No single control is relied on. A firewall, an authentication requirement, encryption and logging each fail sometimes; the point is that they must fail together for the breach to succeed. When an incident is investigated, the question is not whether one control failed but whether the layers were there at all.

Least privilege. A person or a program is given the access needed for the task and no more. This is the control most often missing in practice, and it is why the departing employee in chapter 150's worked example could copy an entire database: he had access he did not need.

Security is not privacy, and the distinction matters legally

A body corporate that encrypts everything and sells the data has perfect security and no privacy. That is why the DPDP Act was needed and why section 43A was never a data protection statute. Chapters 1040 and 1050 work the distinction.

A worked example

Ratnagiri Diagnostics keeps patients' test reports on a server in its clinic.

Confidentiality. Reports contain medical records, which are sensitive personal data or information under rule 3(v) of the SPDI Rules. Access is limited to the doctors and the lab, each with an individual login, and the reports are encrypted on the disk.

Integrity. A report cannot be edited after it is signed off; a correction is made by issuing a new report and the old one is retained. Each report carries a hash recorded in a register, so an altered report is detectable. Chapter 270 explains the mechanism.

Availability. The server is backed up nightly to a second location and the backup is restored to a test machine each month, because a backup that has never been restored is not a backup.

Now the failure. A receptionist's password is written on a note under the keyboard. A visitor uses it and copies four hundred reports.

Which objective failed? Confidentiality, and the cause was administrative rather than technical: the encryption, the access controls and the logging all worked as designed and were defeated by a credential that was not kept secret. That is the ordinary shape of a real breach.

What follows in law? Section 43A gives the patients a claim for compensation if the clinic was negligent in implementing and maintaining reasonable security practices, and rule 8 supplies the standard. Whether the clinic's documented programme covered password handling is the whole question. Section 43(b) and section 66 reach the visitor. And the incident is a cyber incident, reportable to CERT-In within six hours under the direction of 28 April 2022, which chapter 770 works.

What this does NOT mean

It does not mean security is a technical subject that lawyers may leave alone. Section 43A makes the adequacy of security practices a question a court or an adjudicating officer decides, and rule 8 makes it a question about documentation, audit and standards, which is a lawyer's territory.

It does not mean more security is always better. Section 16 requires the Central Government, when prescribing security procedures, to have regard to the commercial circumstances and the nature of transactions, which is a direction to be proportionate.

It does not mean a certificate is a defence. Rule 8(4) deems compliance where IS/ISO/IEC 27001 or approved codes of best practice have been implemented and certified or audited on a regular basis by an approved independent auditor. A certificate obtained once and never audited does not attract the deeming.

It does not mean information security is the same as cyber security. Section 2(1)(nb)'s definition of cyber security is about protecting information and the equipment holding it; information security is the wider practice and covers paper too, which is why data in section 2(1)(o) includes a printout.

Quick revision

• Section 2(1)(nb) defines cyber security by six harms: unauthorised access, use, disclosure, disruption, modification or destruction.
• Three objectives: confidentiality (access, use, disclosure), integrity (modification, destruction), availability (disruption).
• Two more for transactions: authenticity (it is from whom it says) and non-repudiation (the sender cannot deny it).
• They pull against one another, and section 16's proviso directs regard to commercial circumstances and the nature of transactions.
• Four families of control: administrative, technical, operational, physical. Rule 8(1) of the SPDI Rules names all four.
• Two principles: defence in depth and least privilege.
• Security is not privacy. Security asks whether the information is protected; privacy asks whether it should have been collected and whether this use is permitted.

Test yourself

1. State the three objectives of information security and give one section of the Act attacking a failure of each. Confidentiality, attacked by section 43(b) on downloading or copying data without permission or by section 72A on disclosure in breach of a lawful contract. Integrity, attacked by section 43(i) on destroying, deleting or altering information or diminishing its value or utility, or by section 65 on altering source code. Availability, attacked by section 43(f) on denying access to an authorised person.

2. Why does the Act's definition of cyber security list six harms rather than stating an objective? Because a definition by harms is capable of being applied to conduct, which is what a penal and regulatory statute needs, whereas an objective would state an aspiration. The six, unauthorised access, use, disclosure, disruption, modification and destruction, map onto the three objectives, with the first three going to confidentiality, disruption to availability, and modification and destruction to integrity.

3. Distinguish security from privacy with an example. A hospital that encrypts every record, restricts access and audits its systems has good security; if it then sells those records to an insurer without consent it has no privacy protection at all. Conversely a clinic that collects only what it needs with proper consent has good privacy practice and none of it survives a breach caused by weak passwords. Section 43A addresses the second; the Digital Personal Data Protection Act addresses the first.

4. What does rule 8(1) of the SPDI Rules require, and what does rule 8(4) deem? Rule 8(1) requires implemented security practices and standards with a comprehensive documented information security programme and policies containing managerial, technical, operational and physical control measures commensurate with the information assets and the nature of the business, and requires the body corporate to demonstrate implementation after a breach. Rule 8(4) deems compliance where IS/ISO/IEC 27001 or approved best-practice codes have been implemented, provided they are certified or audited regularly by an approved independent auditor.

5. Explain defence in depth and least privilege, and say which failed in the clinic example. Defence in depth means using layered controls so that a breach requires several to fail together. Least privilege means giving each person or program only the access the task requires. In the clinic example neither principle was breached in design; an administrative control failed, because a credential was written down, and the layers were defeated by a legitimate login. That illustrates why the standard in section 43A is about the documented programme and its implementation, not about the presence of any one technical measure.

A botnet is a network of compromised machines under one controller. The owners do not know. Botnets are rented out, and they are what makes a large denial of service attack possible.

Attacks on people: social engineering

The technical controls are usually sound and the person is not, and most successful attacks begin here.

Phishing is a message that pretends to come from somebody trusted and asks for credentials or a payment. The classic is an email that appears to be from a bank with a link to a page that looks like the bank's. It engages section 66C, identity theft, and section 66D, cheating by personation using a computer resource, and chapter 1210 works those.

Spear phishing is phishing aimed at one person, using facts about them, and it is far more effective. Business email compromise is its commercial form: an email that appears to come from a director instructing a payment, or from a supplier changing its bank details, which is the fact pattern chapter 120 works.

Vishing and smishing are the same attack by voice call and by text message.

Pretexting is inventing a situation that makes the request seem normal, such as calling as the information technology helpdesk and asking a new employee to confirm a password.

None of these is a technical failure, which is why rule 8(1) of the SPDI Rules requires managerial and operational controls and not only technical ones. Chapter 230 works it.

Attacks on the machine

Unauthorised access is using a system you are not permitted to use. It may be by a stolen or guessed credential, by an unpatched weakness in the software, or by a configuration mistake such as a database left open to the internet. Section 43(a) covers accessing or securing access without permission; section 66 makes it an offence if done dishonestly or fraudulently.

Exceeding authorised access is being permitted to use a system and doing more with it than permitted. The employee who is allowed to read one customer's file and reads ten thousand is the paradigm. In India section 43 turns on "without the permission of the owner", which covers it. In the United States the same question produced the litigation chapter 630 works.

A brute force attack tries passwords until one works. A dictionary attack tries likely ones. Credential stuffing tries username and password pairs leaked from some other service, which works because people reuse passwords.

Privilege escalation is turning ordinary access into administrator access, usually by exploiting a defect.

Injection attacks send input that the receiving program treats as an instruction. The best known is SQL injection, where text typed into a form is passed to the database as part of a query, so that typing the right characters into a login box can return the entire customer table. It requires no special access at all and is still among the commonest causes of large breaches.

A man in the middle attack sits between two parties, relaying and possibly altering what each sends while both believe they are talking directly. Encrypted connections and certificate checking exist to defeat it, which is the practical reason the certificate machinery of Module II matters.

Attacks on availability

A denial of service attack sends a machine more requests than it can answer, so that legitimate users cannot get through.

A distributed denial of service attack does the same from thousands of machines at once, usually a botnet, which makes it very hard to block because the traffic looks like ordinary users.

Section 43(f) covers denying or causing the denial of access to any person authorised to access, and section 43(e) covers disrupting a computer, computer system or computer network. Against a protected system or critical infrastructure, section 66F(1)(A) makes denial of access an act of cyber terrorism where the intent or knowledge that section requires is present. Chapter 1320 works it.

Attacks on the supply chain and on infrastructure

A supply chain attack compromises a supplier to reach its customers. Software update mechanisms are the usual route, because an update is trusted by definition.

Domain name system attacks send a user to the wrong machine. In pharming, the translation of a name to an address is corrupted so that a correct address in the browser reaches an attacker's server.

Website defacement replaces the content of a page, which is often political rather than acquisitive and engages section 43(i) and section 66, and section 66F where the target and the intent bring it within cyber terrorism.

The attacks and the provisions, side by side

A worked example

A distributor in Kolhapur receives an email that appears to be from its regular supplier in Ludhiana, saying the supplier's bank account has changed. The distributor pays twenty-two lakh rupees to the new account. The money is gone.

Step one: what actually happened? Two possibilities, and they have different legal consequences. Either the supplier's mailbox was compromised and the email really came from it, or the email was spoofed and merely looked as though it did. The headers answer this, and chapter 20 explains why they must be preserved before anything else.

If the mailbox was compromised, there was unauthorised access to the supplier's system under section 43(a), probably by phishing or credential stuffing. The supplier may be exposed under section 43A if it held the distributor's information and was negligent about security, and chapter 230 supplies the standard. The fraudster is caught by sections 66, 66C and 66D.

If the email was spoofed, no computer of the supplier was touched at all. The fraudster is still caught by sections 66C and 66D, because he used another person's unique identification feature and cheated by personation using a computer resource. The supplier is not exposed, and the distributor's own verification process becomes the issue.

In both cases the general penal law applies as well, section 318 of the Bharatiya Nyaya Sanhita on cheating, and chapter 1280 shows how the two statutes work together. The money is traced through the banking system, and the Reserve Bank's directions on unauthorised electronic transactions govern the bank's position.

The point of the example is that the legal analysis did not begin with a section. It began with a technical question about which machine was accessed.

What this does NOT mean

It does not mean every attack is an offence under this Act. Section 66 requires the act to be done dishonestly or fraudulently, so a security researcher who accesses a system to report a weakness commits a contravention under section 43 and may not commit the section 66 offence at all. Chapter 1180 works the mental element.

It does not mean the classification decides the section. The names in this chapter are technical usage, not statutory categories. The Act's categories are the ten clauses of section 43 and the offences in Chapter XI, and an answer should reason from those.

It does not mean the attacker is always outside the organisation. Most serious losses involve a person who was given access, which is why least privilege matters and why section 43's test is the owner's permission rather than physical intrusion.

Quick revision

• Malware: virus (needs a user), worm (spreads itself), trojan (pretends to be useful), ransomware (encrypts and demands payment, attacking availability), spyware and keyloggers, rootkits (hide), botnets (rented networks of compromised machines).
• Social engineering: phishing, spear phishing and business email compromise, vishing, smishing, pretexting. Most successful attacks begin here, and the failure is administrative rather than technical.
• On the machine: unauthorised access, exceeding authorised access, brute force, dictionary and credential stuffing, privilege escalation, injection including SQL injection, man in the middle.
• On availability: denial of service and distributed denial of service.
• Elsewhere: supply chain attacks, DNS attacks and pharming, defacement.
• The Act's own words are computer contaminant and computer virus, defined in the Explanation to section 43.
• Section 66 needs the act to be dishonest or fraudulent; section 43 does not.

Test yourself

1. Distinguish a virus, a worm and a trojan. A virus attaches to a file or program and spreads when that file is executed, so it needs a human act. A worm spreads by itself across a network by exploiting a defect, which is why it propagates so fast. A trojan is installed deliberately by the user because it appears to be something useful, and performs a hidden function as well.

2. Which clauses of section 43 does a ransomware attack engage, and why more than one? Clause (c) if a computer contaminant or virus was introduced; clause (d) for damage to data; clause (e) for disruption of the computer, computer system or computer network; and clause (f) for denial of access to authorised persons. More than one because the single attack simultaneously introduces malicious code, alters the data by encrypting it, disrupts the system's working, and locks out the people entitled to use it.

3. What is SQL injection and why is it a lawyer's concern? Input typed into an ordinary form is passed to the database as part of a query, so that carefully chosen characters cause the database to return or alter data the user was never entitled to. It is a lawyer's concern because it requires no credential and no privileged access, so a breach caused by it is almost always attributable to the defendant's own failure to validate input, which goes directly to the negligence question under section 43A and rule 8.

4. A security researcher accesses a company's server without permission, takes nothing, and reports the weakness. What is the position? He has secured access to a computer resource without the permission of the owner, so section 43(a) is engaged and a contravention has occurred, for which compensation may be claimed if damage is shown. Section 66 requires the act to be done dishonestly or fraudulently, and on those facts neither mental element is present, so the offence is not made out.

5. Why does the analysis of a business email compromise begin with the email headers? Because the legal consequences differ according to whether the supplier's mailbox was actually accessed or the message was merely spoofed. In the first case there was unauthorised access to the supplier's system and the supplier's own security may be in issue under section 43A; in the second no computer of the supplier was touched and only the fraudster is liable. Only the headers, and the mail server logs, distinguish the two, and both are volatile.

It is a deeming provision. Once the procedure has been applied, the record shall be deemed secure. There is no discretion.

Section 15: secure electronic signature

The section as it now stands was substituted by the 2008 amendment, and the original spoke of a secure digital signature and required verification through the prescribed security procedure. The substituted section reads:

"An electronic signature shall be deemed to be a secure electronic signature if (i) the signature creation data, at the time of affixing signature, was under the exclusive control of signatory and no other person; and (ii) the signature creation data was stored and affixed in such exclusive manner as may be prescribed. Explanation: In case of digital signature, the 'signature creation data' means the private key of the subscriber."

Two conditions, and both must be satisfied.

Exclusive control at the moment of signing. Not before, not afterwards: at the time of affixing. That is the same idea as article 6(3)(b) of the UNCITRAL Model Law on Electronic Signatures, which chapter 100 works, and it is what makes non-repudiation possible. If two people could have made the signature, the signer can deny it.

Storage and affixing in the prescribed exclusive manner. This is where the technical requirements live: in practice, that the private key is held in a device from which it cannot be extracted, and that the signing operation happens inside that device.

The Explanation is the bridge to the older vocabulary. For a digital signature, the signature creation data is the private key of the subscriber, which section 2(1)(zc) defines. For a technique that is not a digital signature, the signature creation data is whatever plays the same part.

Notice how the section changed in 2008 and why. The original was written for one technology and required verification by a security procedure. The substituted section states the two functional conditions, which is the technology-neutral approach the 2001 Model Law asks for, and leaves the technique to what is prescribed.

Section 16: the power to prescribe

"The Central Government may, for the purposes of sections 14 and 15, prescribe the security procedures and practices: Provided that in prescribing such security procedures and practices, the Central Government shall have regard to the commercial circumstances, nature of transactions and such other related factors as it may consider appropriate."

Section 16 was also substituted in 2008. The original listed the factors the Government was to consider: the nature of the transaction, the level of sophistication of the parties, the volume of similar transactions, the availability of alternatives, the cost of alternatives, and the procedures in general use for similar transactions. The substituted section compresses those into "the commercial circumstances, nature of transactions and such other related factors".

The proviso is a direction to be proportionate, and it is the Act's own acknowledgement that security is a trade-off rather than a maximum. Chapter 200 makes the same point.

What has been prescribed? The Information Technology (Security Procedure) Rules, 2004, made under section 16, provide that a secure digital signature is one created by applying the standards in the Second Schedule and stored in a manner that ensures exclusive control. In practice the operative requirements now sit in the Certifying Authorities Rules 2000 and in the Second Schedule, and chapter 460 works them.

Secure and ordinary, side by side

That last row is the whole point of the chapter. Sections 14 to 16 say what secure means and confer no advantage of their own. The advantage is that a court presumes things about a secure record and signature that it does not presume about an ordinary one, and chapter 1270 sets out the presumptions in the Bharatiya Sakshya Adhiniyam.

A worked example

Two companies each execute an agreement electronically.

Company A's finance officer holds her private key on a USB cryptographic token issued by a licensed Certifying Authority. The key was generated inside the token, cannot be exported from it, and the signing happens inside the token when she enters a PIN. Section 15(i) is satisfied because the signature creation data was under her exclusive control when she signed; section 15(ii) is satisfied because it was stored and affixed in the prescribed exclusive manner. Her signature is a secure electronic signature.

Company B's finance officer has a signing certificate installed as a file on the office desktop, with the password saved. Three colleagues use that machine. The key is on the disk and could be copied. Section 15(i) is not satisfied: the signature creation data was not under her exclusive control and no other person's. Her signature may still be a valid electronic signature satisfying section 5, if the technique is one specified in the Second Schedule, but it is not secure.

The difference appears when the agreement is disputed. Company A's officer, denying that she signed, faces the presumption the law of evidence attaches to a secure electronic signature. Company B's officer denying it faces no such presumption, and Company B must prove the signature affirmatively, most likely by evidence about the machine, the logs and who had access.

Neither signature is invalid. The difference is entirely about who has to prove what, which is exactly the sort of difference that decides litigation.

What this does NOT mean

It does not mean an insecure electronic record is inadmissible. Admissibility is governed by the law of evidence, and chapter 1270 works it. Chapter V affects presumptions, not admission.

It does not mean a secure electronic signature cannot be challenged. A presumption may be rebutted. It shifts the burden; it does not close the question.

It does not mean section 14 and section 15 work the same way. Section 14 confers the status by the application of a prescribed security procedure. Section 15 confers it by satisfying two stated conditions, one of which is factual (exclusive control) and one of which refers to what is prescribed. So a record is secure because a procedure was applied; a signature is secure because of a fact about the key plus compliance with what is prescribed.

It does not mean the pre-2009 sections say the same thing. The original section 15 was about a secure digital signature and required verification through a security procedure, and the original section 16 listed six factors. A textbook printed before 27 October 2009 prints both.

Quick revision

• Section 14: a prescribed security procedure applied to an electronic record at a specific time makes it a secure electronic record from that time to the time of verification. A deeming provision.
• Section 15, substituted 2008: an electronic signature is deemed secure if (i) the signature creation data was under the exclusive control of the signatory and no other person at the time of affixing, and (ii) it was stored and affixed in the prescribed exclusive manner. The Explanation says that for a digital signature the signature creation data is the private key.
• Section 16, substituted 2008: the Central Government may prescribe, having regard to the commercial circumstances, the nature of transactions and other related factors. A direction to be proportionate.
• Section 2(1)(zf) defines security procedure by reference to what is prescribed under section 16.
• The payoff is in the law of evidence, not in this Act: the presumptions attaching to a secure record and a secure signature.

Test yourself

1. State the two conditions in section 15 and explain why the first is expressed as at the time of affixing. The signature creation data must have been under the exclusive control of the signatory and no other person at the time of affixing the signature, and it must have been stored and affixed in such exclusive manner as may be prescribed. The first is fixed to the moment of signing because that is the only moment at which sole control matters: what happened to the key before or afterwards does not bear on whether this signature could have been made by anyone else.

2. What does section 14 confer, and for how long? It deems an electronic record to be a secure electronic record from the specific point of time at which a prescribed security procedure was applied to it until the time of verification. The status is therefore an interval and not a permanent attribute, which matches the way integrity is tested: secured at one moment, checked at another.

3. Where is the advantage of being secure actually found? Not in this Act. Chapter V defines the class; the consequence is in the law of evidence, where the presumptions available in respect of a secure electronic record and a secure electronic signature are stronger than those available for ordinary ones. Sections 14 to 16 give no substantive right of their own.

4. Why was section 15 substituted in 2008? Because the original spoke of a secure digital signature and tied the status to verification through a prescribed security procedure, which is technology specific. The substituted section states two functional conditions, exclusive control and prescribed storage and affixing, and leaves the technique to the Second Schedule, which is the technology-neutral method the UNCITRAL Model Law on Electronic Signatures of 2001 asks for.

5. Is a signature that fails section 15 invalid? No. Section 5 asks only whether the record was authenticated by an electronic signature affixed in the prescribed manner, and a signature may satisfy that and still fail section 15 because the key was not under exclusive control. Failing section 15 costs the presumptions; it does not cost validity.

Rule 2: the definitions that decide who is covered

Rule 2(1)(c): "body corporate" means the body corporate as defined in clause (i) of the Explanation to section 43A, which is any company and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities.

That excludes the Government. A Government department is not a body corporate engaged in commercial or professional activities, so section 43A and these Rules do not reach it, which was the largest single gap in Indian data protection law before the DPDP Act.

Rule 2(1)(i): "personal information" means any information that relates to a natural person which, either directly or indirectly, in combination with other information available or likely to be available with a body corporate, is capable of identifying such person.

The words "in combination with other information available or likely to be available" are wider than students expect. Information that identifies nobody on its own is personal information if the holder has, or is likely to have, the other pieces.

Rule 2(1)(b) defines biometrics as technologies measuring and analysing human body characteristics, naming fingerprints, eye retinas and irises, voice patterns, facial patterns, hand measurements and DNA, for authentication purposes.

Rule 2(1)(d) defines cyber incidents, and rule 2(1)(h) defines password to include an encryption or decryption key.

Rule 3: sensitive personal data or information

The list is closed and it is short. Sensitive personal data or information means personal information consisting of information relating to:

(i) password; (ii) financial information such as bank account or credit card or debit card or other payment instrument details; (iii) physical, physiological and mental health condition; (iv) sexual orientation; (v) medical records and history; (vi) biometric information; (vii) any detail relating to the above clauses as provided to a body corporate for providing service; and (viii) any of the information received under the above clauses by a body corporate for processing, stored or processed under lawful contract or otherwise.

The proviso is important and often forgotten. Any information that is freely available or accessible in the public domain, or furnished under the Right to Information Act, 2005 or any other law for the time being in force, is not sensitive personal data or information for the purposes of these Rules.

What is not on the list is as instructive as what is. A name, an address, a telephone number, an email address, an identity number, caste, religion, political opinion and criminal record are all personal information and none of them is sensitive under rule 3. So the strict obligations in rules 5 and 6 do not attach to them.

Compare the Digital Personal Data Protection Act 2023, which abandons the sensitive category altogether and applies one set of obligations to all digital personal data. Chapter 1050 works it, and the comparison is a good examination point.

Rule 4: the privacy policy

Rule 4(1) requires the body corporate, or any person collecting on its behalf, to provide a privacy policy for handling of or dealing in personal information including sensitive personal data or information, and to ensure that it is available for view by those who have provided information under a lawful contract.

The policy must be published on the website, and rule 4(2) requires it to provide for: clear and easily accessible statements of its practices and policies; the type of personal or sensitive personal data or information collected; the purpose of collection and usage; disclosure of information including sensitive personal data or information as provided in rule 6; and the reasonable security practices and procedures as provided under rule 8.

Rule 5: collection

This is the longest rule and it contains nine obligations.

Rule 5(1): consent in writing. The body corporate shall obtain consent in writing through letter or fax or email from the provider of the sensitive personal data or information regarding the purpose of usage before collection.

Rule 5(2): lawful purpose and necessity. It shall not collect sensitive personal data or information unless the information is collected for a lawful purpose connected with a function or activity of the body corporate, and the collection is considered necessary for that purpose. Two conditions, both required.

Rule 5(3): notice at collection. While collecting directly from the person, it shall take reasonable steps to ensure the person knows the fact that the information is being collected, the purpose, the intended recipients, and the name and address of the agency collecting it and the agency that will retain it.

Rule 5(4): retention limit. It shall not retain the information for longer than is required for the purposes for which it may lawfully be used or is otherwise required under any other law.

Rule 5(5): purpose limitation. The information shall be used for the purpose for which it has been collected.

Rule 5(6): review and correction. It shall permit the providers, as and when requested, to review the information they provided, and shall ensure that anything found inaccurate or deficient is corrected or amended as feasible. The proviso relieves the body corporate of responsibility for the authenticity of what the provider supplied.

Rule 5(7): the option not to give, and withdrawal. Prior to collection it shall provide an option to the provider not to provide the data sought. The provider shall also have an option, at any time, to withdraw consent given earlier, in writing. Where the provider does not give or later withdraws consent, the body corporate shall have the option not to provide goods or services for which the information was sought.

Rule 5(8): it shall keep the information secure as provided in rule 8.

Rule 5(9): the Grievance Officer. It shall address any discrepancies and grievances of the provider in a time bound manner, and for that purpose shall designate a Grievance Officer and publish his name and contact details on its website. The Grievance Officer shall redress grievances expeditiously but within one month from receipt.

Rule 6: disclosure

Rule 6(1): disclosure to a third party requires prior permission from the provider, unless the disclosure has been agreed to in the contract between them, or the disclosure is necessary for compliance of a legal obligation.

The proviso is the Government exception. Information shall be shared without obtaining prior consent with Government agencies mandated under the law to obtain it for the purpose of verification of identity, or for prevention, detection, investigation including cyber incidents, prosecution, and punishment of offences. The agency shall send a request in writing stating clearly the purpose, and shall also state that the information obtained shall not be published or shared with any other person.

Rule 6(2): notwithstanding sub-rule (1), sensitive personal data or information shall be disclosed to any third party by an order under the law for the time being in force.

Rule 6(3): the body corporate shall not publish the sensitive personal data or information.

Rule 6(4): the third party receiving it shall not disclose it further.

Rule 7: transfer, including outside India

A body corporate may transfer sensitive personal data or information, including any information, to any other body corporate or person in India or located in any other country, that ensures the same level of data protection that is adhered to by the body corporate as provided under these Rules.

The transfer may be allowed only if it is necessary for the performance of the lawful contract between the body corporate and the provider, or where the provider has consented to the transfer.

Two conditions, and both must be met: an equivalent level of protection at the destination, and either necessity for the contract or consent. There is no adequacy list and no approval requirement, which makes rule 7 far lighter than Chapter V of the European General Data Protection Regulation, and chapter 690 draws the comparison.

Rule 8: reasonable security practices

Rule 8(1) states the standard. A body corporate is considered to have complied if it has implemented security practices and standards and has a comprehensive documented information security programme and information security policies containing managerial, technical, operational and physical security control measures commensurate with the information assets being protected with the nature of business. In the event of a breach, it shall be required to demonstrate, as and when called upon by the agency mandated under the law, that it has implemented security control measures as per its documented programme and policies.

Rule 8(2) names a standard: IS/ISO/IEC 27001 on Information Technology, Security Techniques, Information Security Management System, Requirements, is one such standard. It is not the only one, and it is not mandatory.

Rule 8(3) allows an industry association whose members follow other codes of best practice to have those codes approved and notified by the Central Government.

Rule 8(4) is the deeming provision, and it has a condition. A body corporate which has implemented either IS/ISO/IEC 27001 or approved codes shall be deemed to have complied, provided that such standard or codes have been certified or audited on a regular basis by entities through independent auditor duly approved by the Central Government. The audit is to be carried out at least once a year or when the body corporate undertakes a significant upgradation of its process and computer resource.

So a certificate obtained once and never audited does not attract the deeming, and that is the most commonly missed point in the whole of these Rules.

The obligations at a glance

A worked example

Sahyadri Wellness runs a chain of diagnostic clinics and a mobile application.

What it holds. Names, addresses and phone numbers, which are personal information but not sensitive under rule 3. Medical records and test results, which are sensitive under rule 3(iii) and (v). Payment card details, sensitive under rule 3(ii). Fingerprints used to log staff in, sensitive under rule 3(vi).

What rule 5 requires for the sensitive items. Written consent by letter, fax or email before collection, stating the purpose of usage. A lawful purpose connected with its activity, which diagnosis plainly is, and necessity, which is where collecting a patient's sexual orientation for a routine blood test would fail. Notice at collection naming Sahyadri as collector and its cloud provider as the agency that will retain the data. Retention no longer than required. Use only for the stated purpose, so using the records to market a health insurance product is a breach of rule 5(5) unless that purpose was stated and consented to.

A patient asks to see and correct her record. Rule 5(6) requires Sahyadri to permit review and to correct what is inaccurate as feasible.

A patient withdraws consent. Rule 5(7) allows her to do so in writing, and allows Sahyadri to decline to provide the service for which the information was sought.

The police ask for a patient's records. Rule 6's proviso allows disclosure without consent to a Government agency mandated under the law, for one of the listed purposes, on a written request stating the purpose and stating that the information will not be published or shared. A telephone request does not satisfy it.

Sahyadri wants to move its records to a cloud provider in Singapore. Rule 7 permits it if the provider ensures the same level of protection as these Rules require and the transfer is necessary for the performance of the contract with the patient or the patient has consented.

Then the breach. Fourteen thousand records are taken. Section 43A asks whether Sahyadri was negligent in implementing and maintaining reasonable security practices, and rule 8(1) makes that a question about its documented programme and whether it can demonstrate implementation. If it holds a current IS/ISO/IEC 27001 certification that has been audited annually by an approved independent auditor, rule 8(4) deems compliance. If the certification lapsed two years ago, it does not.

What this does NOT mean

It does not mean these Rules apply to the Government. They apply to a body corporate as defined in section 43A, which is an entity engaged in commercial or professional activities.

It does not mean all personal information is protected by rules 5 and 6. Those rules operate on sensitive personal data or information as rule 3 defines it. A name and address are personal information and are not sensitive.

It does not mean an ISO certificate is a complete answer. Rule 8(4) deems compliance only where the standard has been certified or audited regularly by an approved independent auditor.

It does not mean these Rules survive 2027. They are made under section 43A, and when section 44(2) of the DPDP Act commences on 13 May 2027 the parent provision goes. What happens to rules made under a repealed section is a question section 6 of the General Clauses Act, 1897 will have to answer.

Quick revision

• G.S.R. 313(E), 11 April 2011, made under section 87(2)(ob) read with section 43A. Eight rules. Still in force.
• Body corporate excludes the Government. Personal information, rule 2(1)(i), includes information identifying a person in combination with other information the body corporate has or is likely to have.
• Rule 3, sensitive: password; financial information; physical, physiological and mental health condition; sexual orientation; medical records and history; biometrics; details of the above given for a service; and such information received for processing. Proviso: not information freely available in the public domain or furnished under the RTI Act or any other law.
• Rule 4: privacy policy, published, covering practices, types, purpose, disclosure and security.
• Rule 5: written consent before collection; lawful purpose and necessity; notice of fact, purpose, recipients and both agencies; retention limit; purpose limitation; review and correction; option not to give and to withdraw, with the right to refuse service; Grievance Officer named on the website, redress within one month.
• Rule 6: disclosure needs prior permission unless contracted for or legally obliged; Government exception on a written request stating the purpose and a no-publication undertaking; no publication; no onward disclosure.
• Rule 7: transfer, in India or abroad, needs equivalent protection plus necessity or consent.
• Rule 8: documented programme with managerial, technical, operational and physical controls, demonstrable on demand; IS/ISO/IEC 27001 is one standard; the deeming in 8(4) requires a regular audit by an approved independent auditor.

Test yourself

1. List the categories of sensitive personal data or information and state the proviso. Password; financial information such as bank account, credit card, debit card or other payment instrument details; physical, physiological and mental health condition; sexual orientation; medical records and history; biometric information; any detail relating to those clauses provided to a body corporate for providing a service; and any such information received by a body corporate for processing, stored or processed under lawful contract or otherwise. The proviso excludes information freely available or accessible in the public domain, or furnished under the Right to Information Act, 2005 or any other law in force.

2. What form must consent take under rule 5(1), and what may the body corporate do if consent is withdrawn? Consent must be in writing through letter, fax or email, obtained from the provider regarding the purpose of usage, before collection. Under rule 5(7) the provider may withdraw consent at any time in writing, and the body corporate then has the option not to provide the goods or services for which the information was sought.

3. On what conditions may a Government agency obtain sensitive personal data without the provider's consent? Under the proviso to rule 6(1) the agency must be mandated under the law to obtain such information, the purpose must be verification of identity or prevention, detection, investigation including cyber incidents, prosecution or punishment of offences, the agency must send a request in writing stating clearly the purpose, and it must also state that the information obtained shall not be published or shared with any other person.

4. When is a body corporate deemed to have complied with reasonable security practices? Under rule 8(4), where it has implemented IS/ISO/IEC 27001 or codes of best practice approved and notified under rule 8(3), provided that the standard or codes have been certified or audited on a regular basis by entities through an independent auditor duly approved by the Central Government. Without that regular independent audit the deeming does not operate and the body corporate must satisfy rule 8(1) on its own terms.

5. Are these Rules still in force, and why is that surprising? Yes. It is surprising because section 44(2)(a) of the Digital Personal Data Protection Act, 2023 provides for the omission of section 43A, the parent provision, and most commentary written since 2023 states that section 43A has gone. Notification G.S.R. 843(E) dated 13 November 2025 placed section 44(2) in the eighteen-month stage, so it comes into force on 13 May 2027, and until then both section 43A and these Rules apply.

Ask whether the record is attributed to the person said to have sent it. Section 11: sent by him, by a person authorised, or by an automated system he programmed. If none of the three, the Act does not attribute it, and chapter 940 shows what the Act then does not say.

Ask when and where it was despatched and received. Section 13, and chapter 870. This decides the place of the transaction and often the forum.

Ask who the intermediaries are, record by record. Chapter 160 works the definition; chapter 1360 works what follows.

Question three: does the transaction hold up?

Writing. Section 4. Is the information rendered or made available in electronic form and accessible so as to be usable for a subsequent reference? Chapter 300.

Signature. Section 5, with sections 3 and 3A. Was it authenticated by an electronic signature affixed in the prescribed manner? Remember that section 5 bites only where a law requires a signature. Chapters 280, 290 and 300.

Contract. Section 10A, which since 2009 puts the validity of an electronic contract beyond argument. Chapter 930.

Retention. Section 7, and its three conditions including the metadata condition. Chapter 360.

Security. Sections 14 and 15: is the record or the signature secure? That decides the presumptions rather than the validity. Chapter 220.

Proof. Section 63 of the Bharatiya Sakshya Adhiniyam and its certificate. Chapter 1270.

Question four: what remedy do the facts disclose?

Take the civil side first, because it is the one clients usually want.

Section 43 for damage to a computer, computer system, computer network, data or source code: ten clauses, compensation at large. Section 43A where a body corporate was negligent in protecting sensitive personal data. Section 46: the adjudicating officer decides claims up to five crore rupees, the competent court above that. Chapters 1100, 1040 and 1120.

Then the criminal side. Chapter XI, sections 65 to 78, and the mapping table in chapter 210 is the quickest route from conduct to section. Remember section 66 needs dishonestly or fraudulently, and remember that the general penal law applies alongside, with section 81 and Sharat Babu Digumarti deciding which prevails. Chapters 1180 and 1280.

Then the regulatory side, which is where most practical answers now lie. Is there an intermediary who can be required to take the material down, under rule 3 of the IT Rules 2021? Is a blocking direction under section 69A appropriate? Is there a reporting obligation to CERT-In within six hours? Chapters 1360, 810 and 770.

And always ask what the rules add. Chapter 120 lists the twelve sets of rules and which section each is made under. A question about intermediaries answered only from section 79 loses most of the marks.

The route in one table

A worked example, taking the route in order

Facts. Anaya, in Mumbai, sells handmade jewellery through her own website hosted on a service whose servers are in Ireland. A buyer in Chennai places an order by filling a form and clicking "I agree" to the terms. Anaya ships. The buyer then complains that a photograph of her, taken from her social media account, has been used on Anaya's site without permission, and that her card details, stored by Anaya, have appeared on a fraud forum. Anaya says the order was never placed by that buyer at all.

Step 1. Nothing in the First Schedule. The Act applies.

Step 2. The conduct is in India; the server is not, which does not matter, because the parties and the machines they used are here and section 75 is engaged only for conduct outside India.

Steps 3 and 4. The records in issue are the order, the terms accepted by the click, the photograph on the site, and the stored card details. Anaya is the originator of the terms and of the photograph. The buyer is the originator of the order. The hosting service is an intermediary as to the records it stores, and Anaya is not an intermediary as to her own product photographs.

Step 5. Anaya disputes the order. Section 11 attributes it to the buyer only if she sent it, authorised somebody, or ran an automated system. If a third party used her card details to place it, section 11 does not attribute it and chapter 940 shows that the Act gives Anaya nothing further.

Steps 6 and 7. Section 13 places despatch and receipt at the parties' places of business, Mumbai and Chennai. Section 10A makes the click-wrap contract valid; whether its terms were properly incorporated is a contract question, and chapter 960 works it.

Steps 8 to 10. Anaya's records of the order and the logs are what will prove it, subject to the certificate under section 63 of the Bharatiya Sakshya Adhiniyam.

Step 11. The buyer's card details are sensitive personal data or information under rule 3(ii) of the SPDI Rules. If Anaya was negligent in implementing reasonable security practices under rule 8, section 43A gives the buyer compensation, and section 46 sends the claim to the adjudicating officer.

Step 12. Whoever took the card details is caught by sections 43(b) and 66, and by section 66C if they used the buyer's identifying feature. Using the buyer's photograph without consent may engage section 66E if it was taken in circumstances giving rise to a reasonable expectation of privacy, and chapter 1210 works the elements.

Step 13. The buyer can require the hosting service to take the photograph down under rule 3(2)(b) of the IT Rules 2021 if it is a morphed or intimate image, or on a court order under section 79(3)(b) otherwise. Chapter 1360.

Step 14. The photograph is also a copyright question if the buyer took it herself, and section 81's proviso preserves the Copyright Act. Chapter 1280.

Fourteen steps, and not one of them required a memory of a section number, because each step names the question and the chapter that answers it.

What this does NOT mean

It does not mean the order is rigid. A criminal problem starts at step 12 and works backwards. A contract problem may stop at step 7.

It does not mean the Act is the only statute in play. Almost every real problem in this subject also involves the Bharatiya Nyaya Sanhita, the Bharatiya Sakshya Adhiniyam, the Contract Act, the Consumer Protection Act, the Copyright Act or the DPDP Act. Step 14 exists to make sure the question is asked.

It does not mean an answer should recite the route. The route is how you find the provisions. What goes on the paper is the provisions and what they do.

Quick revision

• Four questions, in order: does the Act apply; what is the record and whose is it; does the transaction hold up; what remedy do the facts disclose.
• Question one is section 1(4) and the First Schedule, then sections 1(2) and 75 for anything done abroad.
• Question two is sections 2, 11 and 13, and it identifies every party including the intermediaries, record by record.
• Question three is sections 4, 5, 10A, 7, 14 and 15, and then section 63 of the Bharatiya Sakshya Adhiniyam for proof.
• Question four has three limbs: civil under sections 43, 43A and 46; criminal under Chapter XI; and regulatory under section 79 with the IT Rules 2021, section 69A, and section 70B with the CERT-In directions.
• Always finish with section 81 and the question of what other statute applies alongside.
• And always ask what the rules add, because most operative detail is in a rule and not in the Act.

Test yourself

1. What is the first question to ask of any facts under this Act, and why is it first? Whether the Act applies at all: whether the document or transaction is in the First Schedule under section 1(4), and, for conduct outside India, whether section 75(2) is satisfied by the involvement of a computer, computer system or computer network located in India. It is first because a negative answer ends the inquiry and no other provision needs to be considered.

2. Why must the intermediary question be asked record by record? Because section 2(1)(w) defines an intermediary "with respect to any particular electronic records", so the same person may be an intermediary as to one record and the author of another. A platform is an intermediary as to a user's post and is not an intermediary as to its own advertising, and the availability of section 79 turns on which record is complained of.

3. Where does a claim for three crore rupees under section 43 go, and where does one for seven crore go? Section 46(1A) gives the adjudicating officer jurisdiction where the claim for damage does not exceed five crore rupees, so three crore goes to the adjudicating officer. The proviso vests jurisdiction in respect of a claim exceeding five crore rupees in the competent court, so seven crore goes there.

4. A client asks whether an email exchange made a binding contract. Which steps of the route apply? Steps 3 and 4 to identify the records and the originator and addressee; step 5, section 11, on attribution if either party denies sending; step 6, section 13, for when and where; step 7, sections 4, 5 and 10A, for writing, signature and validity; and step 10, section 63 of the Bharatiya Sakshya Adhiniyam, for how the exchange will be proved. Step 1 should still be asked, because if the contract is one the First Schedule excludes the Act does not touch it at all.

5. Why is an answer built only on the Act likely to be incomplete? Because section 87 leaves the operative detail to rules, so the duties of an intermediary, the standard of reasonable security practices, the procedure for interception or blocking, and the manner of adjudication are all in rules rather than in the Act; and because section 81's overriding effect is qualified, so the Bharatiya Nyaya Sanhita, the Bharatiya Sakshya Adhiniyam, the Contract Act, the Consumer Protection Act and the Copyright Act frequently apply alongside.