How India Came to Have an Information Technology Act

The Model Law's method is worked in chapters 60 to 90, and its central idea, the functional equivalent approach, is the single most useful thing in Module I.

What India did

The Bill was introduced in 1999 and the Act received the President's assent on 9 June 2000. It was brought into force on 17 October 2000.

The Statement of Objects and Reasons sets out four purposes, and they map on to the Act's structure exactly.

To give legal recognition to transactions carried out by electronic data interchange and other means of electronic communication, commonly referred to as electronic commerce, which involve the use of alternatives to paper-based methods of communication and storage of information. That is Chapters II to IV of the Act, sections 3 to 13.

To facilitate electronic filing of documents with Government agencies. That is Chapter III, sections 6 to 9.

To amend the Indian Penal Code, the Indian Evidence Act 1872, the Bankers' Books Evidence Act 1891 and the Reserve Bank of India Act 1934. That was done by sections 91 to 94 and the four Schedules, all since omitted as spent, and it is how section 65B came into the Evidence Act.

And, added by the Act itself rather than by the Model Law, to create offences and a regulatory machinery. That is Chapters VI to XI.

Two of those four purposes have no counterpart in the Model Law at all. The Model Law is about commerce. It says nothing about licensing certifying authorities, nothing about hacking, and nothing about obscenity. India built a regulatory and penal statute on a commercial foundation, and a good deal of the criticism of the Act is that the two halves do not sit comfortably together.

The three phases of the Act's life

Phase one, 2000 to 2009: the commerce statute. The Act as passed recognised electronic records and digital signatures, set up the Controller of Certifying Authorities and a licensing regime, created a Cyber Regulations Appellate Tribunal, and provided a short list of offences of which the best known was section 66, then headed "hacking with computer system".

Phase two, 2009 onwards: the amended Act. The Information Technology (Amendment) Act, 2008 came into force on 27 October 2009 and rewrote the statute. It replaced digital signature with the wider electronic signature, inserted sections 43A, 66A to 66F, 67A to 67C, 69A, 69B, 70A, 70B, 72A, 79 in its present form, 84A to 84C, and much else. Chapter 180 works it in full. Almost everything a student meets in Modules III and IV was put there in 2008.

Phase three, 2017 onwards: the Act as amended by other Acts and filled out by rules. The Finance Act 2017 abolished the Cyber Appellate Tribunal and made the Telecom Disputes Settlement and Appellate Tribunal the appellate forum. The Intermediary Guidelines and Digital Media Ethics Code Rules, 2021 replaced the 2011 intermediary rules and added a code for digital media. The Digital Personal Data Protection Act, 2023 will remove section 43A when its section 44(2) comes into force. The amendment of 10 February 2026 brought synthetically generated information into the Rules. Chapter 190 works this phase.

A short chronology

A worked example

Take one dispute and ask what a court could have done with it in 1998, in 2002, in 2012 and today. Nalini Sridhar orders goods by email from Vipul Shah, he denies the order and she produces a printout.

In 1998, before the Act. The printout is a document only if the Evidence Act, 1872, treats it as one, and section 3 as it then stood spoke of matter recorded upon a substance by letters, figures or marks. There is no provision making an electronic record admissible, no rule attributing it to a sender, and no way to satisfy a statute that requires a signature. Nalini's difficulty is not that she will lose; it is that nobody knows what the answer is.

In 2002, under the Act as enacted. Section 4 gives legal recognition to an electronic record where a law requires writing. Section 5 gives legal recognition to a digital signature where a law requires a signature. Section 11 attributes the record to the originator. Section 13 fixes when and where it was sent and received. And section 92 of this Act with the Second Schedule has inserted sections 65A and 65B into the Evidence Act, so the printout is admissible with a certificate. Everything Nalini needed has arrived at once, and that is what the Act was for.

In 2012, after the amendment of 2008. The same answers, plus section 10A, which puts beyond argument that a contract is not unenforceable merely because it was made electronically, and section 3A, which widens signature recognition beyond digital signatures to any technique in the Second Schedule. If Vipul now says his account was compromised, section 11 still does not help him or her, because it attributes only in three cases and none of them is the stolen password.

Today. The Evidence Act is repealed; section 61 of the Bharatiya Sakshya Adhiniyam, 2023, forbids denial of admissibility on the ground that the record is electronic, section 57 may make the file itself primary evidence, and section 63 carries the old section 65B certificate with the added requirement of an expert's signature. Chapter 1270.

And the shape the example shows. The Act's first phase, from 2000, was about recognition; the second, from 2008, added crime, security and intermediaries; and the third, from 2021, is rules rather than statute. The chronology below is that story with dates on it.

What this does NOT mean

It does not mean India copied the Model Law. India enacted its substance for electronic records and signatures and then added a licensing regime, an offence chapter and a State powers chapter that the Model Law never contemplated. Chapter 110 compares the two clause by clause, which is a question the University has set three times.

It does not mean the Act repealed the older statutes. It amended four of them and otherwise left the general law standing, which is why section 81 was needed to say which prevails and why chapter 1280 has to work out how the Act and the Bharatiya Nyaya Sanhita apply together.

It does not mean the Act was drafted for the internet we have. It was drafted for electronic data interchange between businesses. Social media, cloud computing, smartphones and machine-generated content all arrived afterwards, and the strain shows.

Quick revision

• Before 2000: writing and signature were defined physically in the General Clauses Act 1897; the Evidence Act 1872 had no rule for records inside a machine; the Penal Code 1860 reached none of the new conduct.
• UNCITRAL is the United Nations Commission on International Trade Law. A Model Law binds nobody until enacted.
• Resolution A/RES/51/162, 16 December 1996, adopted the Model Law on Electronic Commerce and is recited in the Act's own preamble.
• Assent 9 June 2000, Act 21 of 2000, in force 17 October 2000.
• Four objects: recognise electronic transactions; facilitate electronic filing with Government; amend four statutes; and, added by India, create offences and a regulator.
• Three phases: the commerce statute to 2009; the amended Act from 27 October 2009; and the Act as reshaped by the Finance Act 2017, the 2021 Rules, the DPDP Act 2023 and the amendment of February 2026.

Test yourself

1. State three obstacles in Indian law before 2000 to doing business electronically. The definitions of writing and of signature in the General Clauses Act, 1897 assumed marks on a physical surface. The Indian Evidence Act, 1872 had no rule for admitting a record held inside a computer and required primary evidence of a document. The Indian Penal Code, 1860 did not reach copying data without removing it, corrupting data, or fabricating an electronic record.

2. What is a Model Law, and which one does the Act's preamble recite? A text prepared for legislatures to enact with or without modification, binding on nobody until enacted. The preamble recites the UNCITRAL Model Law on Electronic Commerce, adopted by General Assembly resolution A/RES/51/162 dated 30 January 1997 as the Act prints it, and recommends favourable consideration in the interests of uniformity.

3. Which two of the Act's purposes have no counterpart in the Model Law? The regulatory purpose, meaning the licensing and supervision of Certifying Authorities in Chapters VI and VII, and the penal purpose, meaning the offences in Chapter XI. The Model Law is a commercial instrument and contains neither.

4. Give the date the Act came into force and the date the 2008 amendment came into force, and say why the second matters more. The Act came into force on 17 October 2000; the 2008 amendment on 27 October 2009. The second matters more because almost every provision a student meets in Modules III and IV, sections 43A, 66A to 66F, 67A to 67C, 69A, 69B, 70A, 70B, 72A, the present section 79 and sections 84A to 84C, was inserted by it.

5. Why is it wrong to say the Act is simply the Model Law in Indian form? Because the Model Law supplied only the recognition provisions on electronic records, signatures, attribution, acknowledgment and the time and place of despatch and receipt. The Certifying Authority regime, the offences, the State powers of interception and blocking, and the intermediary provisions are Indian additions with no Model Law counterpart.