IndiaInformation Technology Act, Unauthorized Access and Computer-Related Offences
Information Technology Act 2000 (No. 21 of 2000), as amended by the Information Technology (Amendment) Act, 2008 (No. 10 of 2009), ss. 43, 66
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not access, or secure access to, a computer, computer system or computer network, or download, copy or extract data from it, without the permission of its owner or the person in charge of it.
- Doing so dishonestly or fraudulently is a criminal offence carrying up to three years' imprisonment or a fine of up to five lakh rupees, or both, in addition to a civil compensation claim by the affected person that carries no upper limit.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Imprisonment for a term which may extend to three years, or a fine which may extend to five lakh rupees, or both, under section 66, where the section 43 conduct is done dishonestly or fraudulently.
Penalty structure
Section 66's criminal fine cap of five lakh rupees. Section 43's own civil compensation, for the same underlying conduct without the dishonest-or-fraudulent element, carries no cap since the 2009 amendment (Act 10 of 2009) removed the original one-crore-rupee ceiling.
- Rule
- Fixed only
- As of
- Currency
- INR
- Fixed cap
- 500,000
Who enforces it
Enforcement body
An adjudicating officer appointed by the Central Government decides claims for compensation under section 43 up to rupees five crore (section 46), and a police officer not below the rank of Inspector investigates offences under the Act (section 78).
Settledness
- As of
- Open questions
- Does reading a web page that the operator serves to every visitor, in breach only of its terms of use, 'access or secure access' to a computer resource 'without permission of the owner' under section 43(a)?
- Which provision now supplies the meaning of 'dishonestly' and 'fraudulently' in section 66, whose Explanation points to sections 24 and 25 of the Indian Penal Code (45 of 1860)?
What it makes you log
Logging duty
Sections 43 and 66 make unauthorized access to a computer resource, and other listed acts, a ground of compensation and, when dishonest or fraudulent, an offence. They impose no duty to create, keep, produce or review a log or record. The Act's preservation and retention duty on intermediaries (s. 67C) is not cited by this row. Section 75 applies the Act to an offence or contravention committed outside India when the conduct involves a computer, computer system or computer network located in India; that limb turns on where the computer sits and is read as an effect in India.
- Kind
- None
- As of
What this law does
Section 43 makes any person who, without the permission of a computer resource's owner or the person in charge of it, accesses or secures access to it, or downloads, copies or extracts data from it, liable to pay damages by way of compensation to the person so affected; the 2009 amendment that substituted this closing language removed the original one-crore-rupee ceiling, so the civil compensation now carries no cap. Section 66 makes the same conduct, done dishonestly or fraudulently, a criminal offence punishable with imprisonment for a term which may extend to three years or a fine which may extend to five lakh rupees, or both.
The Act has applied since its own commencement, , per the Central Government's notification under section 1(3).
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .