IT Act 2000: What India's IT Law Means for Technology Companies

The Information Technology Act, 2000 (IT Act) is India’s foundational technology law. It gives legal recognition to electronic records and digital signatures, defines cyber offences, sets out when online platforms are liable for user content, and gives the government powers to intercept, monitor and block information. Many of the compliance rules Indian IT companies follow day to day, such as CERT-In incident reporting and the IT Intermediary Rules, are made under it.

This guide is general information, not legal advice.

What is the IT Act?

The Act has several parts that matter to technology companies:

History and why it was introduced

The government has also proposed a new Digital India Act to replace the IT Act, but as of October 2026 no such bill has been enacted.

The IT Act was introduced to give legal certainty to e-commerce and electronic records, and to deal with emerging cybercrime.

Main objectives:

1. Legal recognition of electronic transactions, records and signatures.
2. Deterrence of cybercrime.
3. Protection of critical information infrastructure.
4. A framework for intermediaries and government cyber powers.

Who needs to comply?

Is it mandatory?

Yes. Consequences include:

Claims for compensation up to INR 5 crore are decided by an adjudicating officer (usually the state IT Secretary); larger claims go to civil courts. Appeals go to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), which absorbed the Cyber Appellate Tribunal in 2017.

Key requirements for IT companies

Section 43A: reasonable security practices

A body corporate that possesses, deals with or handles sensitive personal data in a computer resource it owns, controls or operates must implement reasonable security practices and procedures. The SPDI Rules 2011 explain what this means, naming IS/ISO/IEC 27001 as one acceptable standard. This section is omitted when the DPDP Act fully commences in May 2027, after which the DPDP Act’s reasonable security safeguards apply.

Section 72A: contractual confidentiality

Service providers that obtain personal information under a lawful contract must not disclose it without consent or in breach of the contract, with intent to cause wrongful loss or gain. This matters for IT services firms handling client data.

Section 70B: CERT-In

CERT-In is the national agency for cyber incident response. Under its April 2022 Directions, service providers, intermediaries, data centres, body corporates and government organisations must:

• report specified cyber incidents to CERT-In within six hours of noticing them;
• keep ICT system logs for 180 days within India;
• synchronise clocks to the NTP servers of the National Informatics Centre or NPL, or sources traceable to them;
• designate a point of contact.

See CERT-In Directions for details.

Section 79: intermediary safe harbour

An intermediary isn’t liable for third-party information it hosts or transmits if it doesn’t initiate, select the receiver of, or modify the transmission, observes due diligence under the IT Intermediary Rules, and removes unlawful content when it has actual knowledge through a court order or government notification. The Rules have been amended several times, most recently in 2026 with requirements on labelling synthetically generated content and faster takedowns.

Sections 69 and 69A: interception and blocking

The government can order interception, monitoring or decryption of information (Section 69) and blocking of public access (Section 69A), under procedural rules. Intermediaries and service providers must provide technical assistance. Non-compliance is an offence.

Electronic records and signatures

Electronic records and signatures are legally valid, with some exceptions (for example negotiable instruments other than cheques, wills, and contracts for sale of immovable property). Aadhaar-based eSign is widely used under the electronic signature framework.

How to comply

1. Identify your roles: body corporate, service provider, intermediary, data centre, critical infrastructure.
2. Implement reasonable security, ideally aligned with ISO 27001, covering sensitive personal data.
3. Set up CERT-In compliance: six-hour reporting process, 180-day log retention in India, NTP sync and a point of contact.
4. If you are an intermediary, implement the Intermediary Rules: terms of use, grievance officer, takedown timelines, and additional duties if you are a significant social media intermediary.
5. Review client contracts for confidentiality and data handling, given Section 72A.
6. Prepare for lawful requests: a process for interception, blocking and information requests from authorities.
7. Plan for the DPDP Act replacing Section 43A in May 2027.
8. Train staff on cybercrime risks such as insider data theft (Section 66, 72A).

Documentation and policies

• Information security policy and reasonable security practices documentation
• Privacy policy (required by the SPDI Rules for bodies handling personal data)
• CERT-In incident reporting procedure and point of contact
• Log retention policy (180 days in India for CERT-In)
• Time synchronisation configuration
• Intermediary terms of use, privacy policy and grievance mechanism (if an intermediary)
• Procedure for handling government requests
• Client contracts with confidentiality and data protection clauses

Audits and enforcement

• CERT-In can call for information and issue directions; it also empanels security auditors.
• Police and cyber cells investigate offences.
• Adjudicating officers decide compensation claims.
• No certification exists for the IT Act itself; ISO 27001 certification is used as evidence of reasonable security.

Cost

Benefits

• Legal certainty for electronic contracts and records.
• Safe harbour protection for platforms that follow due diligence.
• Clear incident reporting expectations.
• Recognition of ISO 27001 for reasonable security (until May 2027).

Risks of non-compliance

• Compensation claims for data breaches due to negligence.
• Criminal liability for officers under Section 85.
• Loss of safe harbour for intermediaries.
• Penalties for not complying with CERT-In.

Common mistakes

• Ignoring CERT-In’s six-hour deadline and 180-day log rule.
• Assuming foreign hosting avoids the Act. Logs must be kept in India, and the Act reaches offences involving systems in India.
• No privacy policy or reasonable security documentation.
• Intermediaries without a grievance officer or takedown process.
• Forgetting the DPDP transition in May 2027.

Challenges for IT companies

• Multiple overlapping obligations: CERT-In, Intermediary Rules, DPDP Act, sector regulators.
• Log retention in India for cloud-native companies hosted abroad.
• Responding quickly to government takedown and information requests.
• Rapid changes to intermediary rules, such as 2026’s synthetic content labelling.

Best practices

• Use ISO 27001 as the backbone for reasonable security and CERT-In readiness.
• Keep one incident playbook with CERT-In, DPDP Board, sector regulator and customer timelines.
• Store security logs in an Indian region for at least one year.
• Track MeitY and CERT-In notifications.
• Map every intermediary obligation to an owner.

Tools that help

How the IT Act relates to other frameworks

Real-world examples

• Shreya Singhal v. Union of India (2015). The Supreme Court struck down Section 66A and clarified that intermediaries need a court order or government notification to have “actual knowledge” under Section 79.
• CERT-In Directions (2022). Led several VPN providers to remove servers from India rather than keep subscriber records.
• Illustrative scenario, not a real company: a Bengaluru SaaS company hosted in a foreign cloud region sets up an Indian log archive for 180 days, a six-hour CERT-In reporting process and an ISO 27001-aligned security programme, and plans its DPDP transition for 2027.

Frequently asked questions

Does the IT Act apply to foreign companies? Yes, for offences involving a computer system in India (Section 75), and many rules made under it apply to services offered in India.

What is Section 43A? It makes companies that are negligent in protecting sensitive personal data liable to pay compensation. It will be omitted when the DPDP Act fully commences.

What is Section 79? It gives intermediaries safe harbour from liability for third-party content if they follow due diligence and act on lawful takedown orders.

What are the CERT-In reporting rules? Report specified cyber incidents within six hours and keep logs for 180 days in India.

Is the IT Act being replaced? The government has proposed a Digital India Act, but no replacement law had been enacted as of October 2026.

Are electronic signatures valid in India? Yes, under the IT Act, with exceptions for certain documents such as wills and property sale contracts.

Next steps

• Map which IT Act roles apply to your company.
• Set up six-hour CERT-In reporting and 180-day log retention in India.
• Document reasonable security practices for sensitive data.
• Plan the move from Section 43A to the DPDP Act by May 2027.