IT Act 2000 for IT Companies: Key Sections & Compliance

The Information Technology Act, 2000 is India's core cyber law. It gives electronic records and signatures legal validity, defines cyber offences, sets duties for intermediaries such as platforms and hosting providers, and is the source of CERT-In's powers. Every IT company operating in India is subject to it in some way, and the rules made under it changed again in February 2026. This guide explains the sections that matter to IT and software companies, the IT Rules 2021 for intermediaries, the transition from Section 43A to the DPDP Act, and a practical compliance checklist.

Quick answer: The IT Act 2000 is a mandatory law of India, as amended in 2008, with rules made under it. For IT companies the most important parts are: Section 43 (compensation for unauthorised access and damage), Section 43A (compensation for negligent handling of sensitive personal data, with the SPDI Rules 2011, until it is omitted when the DPDP Act's main provisions start on 13 May 2027), criminal offences such as Sections 66, 66C, 66D and 72A, Section 70B and the CERT-In Directions, and Section 79 safe harbour for intermediaries that follow the IT Rules 2021, most recently amended in February 2026 for synthetic content.

What is the IT Act 2000?

The IT Act provides the legal framework for electronic commerce and governance in India and addresses cybercrime. It applies to the whole of India and, under Section 75, to offences committed outside India involving a computer system located in India.

Full form and definition

The law is the Information Technology Act, 2000 (Act No. 21 of 2000). Key definitions include "computer resource", "electronic record", "intermediary" (anyone who receives, stores or transmits electronic records on behalf of others, including telecom operators, ISPs, web hosts, search engines, payment sites, marketplaces and cyber cafes) and "body corporate".

Law, standard or certification?

It is a law with civil and criminal consequences, plus subordinate rules and directions issued by the Ministry of Electronics and Information Technology (MeitY) and CERT-In. There is no IT Act certification.

History and background of the IT Act

The Act came into force on 17 October 2000, based on the UNCITRAL Model Law on Electronic Commerce. The IT (Amendment) Act 2008, in force from 27 October 2009, was a major update. It added data protection (Section 43A), new offences (Sections 66A to 66F, 67A, 67B), interception and blocking powers (Sections 69, 69A, 69B), CERT-In's statutory role (Section 70B), disclosure in breach of contract (Section 72A) and a conditional safe harbour for intermediaries (Section 79).

In Shreya Singhal v. Union of India (2015), the Supreme Court struck down Section 66A as unconstitutional. Rules followed over time, including the SPDI Rules 2011, the CERT-In Rules 2013, the CERT-In Directions 2022 and the Intermediary Guidelines and Digital Media Ethics Code Rules 2021, which have been amended several times, most recently with effect from 20 February 2026.

Why was the IT Act introduced?

India needed legal recognition for electronic transactions to support e-commerce and e-governance, and a legal basis to prosecute cybercrime. The 2008 amendment responded to growing outsourcing, data security concerns and new forms of cyber attack.

What is changing?

When the main provisions of the DPDP Act 2023 commence on 13 May 2027, Section 43A and the SPDI Rules fall away and personal data protection moves to the DPDP regime. The government has also discussed a broader Digital India Act to replace the IT Act; as of October 2026 no such bill has been enacted.

Main objectives and purpose

Legal recognition of electronic records, signatures and contracts.
Define and penalise cyber offences.
Protect computer systems and data, including critical information infrastructure.
Set duties and conditional immunity for intermediaries.
Enable lawful interception, blocking and incident response.

Who needs to comply with the IT Act?

All IT, SaaS and IT services companies in India, as bodies corporate handling data and computer resources.
Intermediaries, including hosting providers, cloud providers, marketplaces, social media, messaging and app platforms, with extra duties for significant social media intermediaries.
Service providers, data centres and corporates covered by the CERT-In Directions.
Foreign companies offering services in India, which may be treated as intermediaries and are subject to blocking orders and CERT-In directions.

Key requirements of the IT Act for IT companies

Civil liability

Section 43: compensation for unauthorised access, downloading, introducing malware, damaging or disrupting computer systems, denying access and similar acts.
Section 43A: a body corporate that is negligent in implementing reasonable security practices while handling sensitive personal data, causing wrongful loss or gain, must pay compensation. Until 13 May 2027, the SPDI Rules 2011 define sensitive data (passwords, financial information, health, biometrics and similar), require a privacy policy, consent and security practices; ISO/IEC 27001 is cited as an example of a reasonable security standard.

Key criminal offences

Offences relevant to IT companies
Section	Offence
65	Tampering with computer source documents
66	Computer-related offences (dishonest or fraudulent acts under Section 43)
66C	Identity theft, including misuse of passwords and electronic signatures
66D	Cheating by personation using computer resources
66E	Violation of privacy through images of private areas
66F	Cyber terrorism
67, 67A, 67B	Publishing or transmitting obscene, sexually explicit or child sexual abuse material
72A	Disclosure of personal information in breach of a lawful contract, without consent
85	Offences by companies: officers in charge can be liable unless they show lack of knowledge or due diligence

CERT-In (Section 70B)

CERT-In is the national agency for incident response. Its April 2022 Directions require reporting of specified cyber incidents within 6 hours, log retention for 180 days in India, clock synchronisation and, for some providers, customer record keeping. Non-compliance is an offence under Section 70B(7).

Interception, monitoring and blocking (Sections 69, 69A, 69B)

Authorised agencies can direct interception, decryption, monitoring of traffic data and blocking of content, with procedures set out in rules. Companies must assist when lawfully directed and keep such directions confidential.

Intermediary duties (Section 79 and IT Rules 2021)

Intermediaries are not liable for third-party content if they meet due diligence requirements, including:

Publishing rules, privacy policy and user agreement, and informing users of prohibited content
Acting on court orders and government notifications to remove or disable unlawful content within prescribed timelines
Appointing a grievance officer and resolving complaints within set periods
Retaining information for specified periods and providing assistance to authorised agencies
For significant social media intermediaries: a chief compliance officer, nodal contact person and resident grievance officer in India, monthly compliance reports and other duties
From 20 February 2026: duties around synthetically generated information, including labelling, and faster removal (within 3 hours) for specified government or court orders

How to comply with the IT Act: step by step

Classify your business: body corporate only, intermediary, significant social media intermediary, or a service provider covered by CERT-In Directions.
Implement reasonable security practices, ideally through ISO 27001, and document them for Section 43A and the SPDI Rules.
Publish a privacy policy and obtain consent for sensitive personal data under the SPDI Rules until the DPDP regime takes over.
Set up CERT-In compliance: 6-hour incident reporting, 180-day log retention in India, NTP clock synchronisation and a point of contact.
For intermediaries: publish terms, appoint a grievance officer, build takedown and grievance workflows that meet IT Rules timelines, including the 2026 synthetic content duties.
Update contracts with confidentiality and data protection terms (relevant to Section 72A).
Prepare for lawful requests: a procedure to verify, respond to and log government directions.
Train staff on cyber offences, data handling and incident reporting.
Plan the DPDP transition for 13 May 2027.

Documentation required

Information security policy and evidence of reasonable security practices
Privacy policy and consent records (SPDI Rules)
Incident response plan with CERT-In reporting procedure and contact details
Log retention configuration and evidence
For intermediaries: terms of use, grievance officer details, takedown logs, monthly compliance reports (SSMIs)
Lawful request handling procedure and register
Contracts with confidentiality and data protection clauses

Audit and assessment requirements

The IT Act does not require routine external audits of all companies. Under the SPDI Rules, a body corporate following ISO 27001 or an approved code should have it audited at least once a year, or when it significantly upgrades its processes. CERT-In-empanelled auditors conduct security audits for government and regulated sectors under CERT-In's audit guidelines. Regulators such as the RBI and SEBI impose their own audits.

Estimated implementation timeline

Baseline legal and security review: 4 to 8 weeks
CERT-In logging and reporting setup: 4 to 8 weeks
Intermediary grievance and takedown workflows: 4 to 12 weeks, depending on scale
Obligations are ongoing

Cost considerations

Legal review of classification, policies and contracts
Security controls and log storage in India
Grievance and trust and safety staff for intermediaries
Content moderation and synthetic media detection tools
Audit fees where required

Benefits of compliance

Safe harbour protection for intermediaries.
Reduced civil and criminal exposure for the company and its officers.
Readiness for DPDP, CERT-In and sector regulations.
Trust with Indian clients and government buyers.

Risks and consequences of non-compliance

Compensation claims under Sections 43 and 43A, adjudicated by adjudicating officers up to INR 5 crore and by civil courts above that.
Criminal prosecution under Sections 66 to 72A, with imprisonment and fines; for example, Section 72A carries up to three years' imprisonment, a fine up to INR 5 lakh, or both.
Liability of officers in charge under Section 85.
Loss of Section 79 safe harbour, making intermediaries liable for third-party content.
Penalties for failing to comply with CERT-In directions.

Common mistakes

Assuming the IT Act only matters for cybercrime victims.
Not realising that hosting, SaaS and marketplace businesses can be intermediaries.
Logs stored only outside India or kept for less than 180 days.
No 24x7 process to meet 6-hour CERT-In reporting.
Grievance officer appointed but complaints not tracked against deadlines.
Ignoring the February 2026 changes on synthetic content.

Challenges for IT companies

Overlapping incident reporting: CERT-In, sector regulators and, from 2027, the DPDP Board.
Short takedown timelines for user-generated and AI-generated content.
Balancing lawful access requests with client confidentiality obligations.
Uncertainty about a future Digital India Act.

Best practices and recommendations

Use ISO 27001 as your evidence of reasonable security practices.
Run a single incident playbook covering CERT-In, DPDP and client notifications.
Automate takedown and grievance tracking with SLA timers.
Keep a register of government directions and responses.
Review IT Rules amendments as soon as they are notified.

Tools and technologies that help

SIEM and log management with storage in Indian regions
NTP synchronisation to Indian government time sources as required by CERT-In
Trust and safety platforms for reports, takedowns and appeals
Content provenance and synthetic media labelling tools
Case management for lawful requests

Relationship with other compliance frameworks

IT Act and related requirements
Framework	Relationship
CERT-In Directions	Issued under Section 70B; incident reporting, log retention and record keeping
DPDP Act	Replaces Section 43A and the SPDI Rules from 13 May 2027
ISO 27001	Cited in the SPDI Rules as an example of reasonable security practices
NIST CSF	Useful structure for the security programme that supports IT Act duties

Real-world implementation examples

The following are illustrative composites based on common patterns, not named clients.

Indian marketplace platform

A B2B marketplace recognised it was an intermediary, published compliant terms, appointed a grievance officer, built a takedown workflow with timers, and added labelling for AI-generated product images after the February 2026 amendment.

Cloud hosting company

A regional hosting provider moved all logs to Indian data centres with 180-day retention, synchronised clocks to the required time sources and set up 24x7 CERT-In reporting.

Frequently asked questions

Is the IT Act 2000 still in force?

Yes, as amended in 2008 and supplemented by rules and directions. Section 43A will be omitted when the DPDP Act's main provisions start on 13 May 2027.

What is Section 43A of the IT Act?

It requires a body corporate to pay compensation if negligence in reasonable security practices for sensitive personal data causes wrongful loss or gain.

What are the SPDI Rules?

The IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011, made under Section 43A.

Who is an intermediary under the IT Act?

Anyone who receives, stores or transmits electronic records on behalf of others, including hosting providers, platforms, marketplaces and ISPs.

What changed in the IT Rules in 2026?

Amendments in force from 20 February 2026 introduced duties for synthetically generated content, including labelling, and faster removal timelines for certain orders.

Is Section 66A still valid?

No. The Supreme Court struck it down in 2015 in Shreya Singhal v. Union of India.

Does the IT Act apply to foreign companies?

It applies to offences involving computer systems in India, and intermediary and CERT-In obligations can apply to foreign services offered in India.

Can company directors be liable under the IT Act?

Yes. Under Section 85, persons in charge of the company can be liable unless they prove the offence was committed without their knowledge or despite due diligence.

Is ISO 27001 mandatory under the IT Act?

No, but the SPDI Rules recognise it as an example of reasonable security practices.

Will the Digital India Act replace the IT Act?

A Digital India Act has been discussed, but as of October 2026 no bill has been enacted.

Conclusion and next steps

The IT Act sets the baseline duties for every IT business in India. Classify your role, document reasonable security, meet CERT-In and intermediary duties, and prepare for the DPDP transition.

Classify your business under the Act.
Document security practices, ideally with ISO 27001.
Implement CERT-In reporting and logging.
Build intermediary workflows if applicable.
Plan for 13 May 2027.

This guide is general information, not legal advice. Consult a qualified Indian technology lawyer.

How we keep this guide up to date

We review this guide every six months and whenever MeitY amends the IT Rules, CERT-In issues new directions, courts deliver significant judgments, or new legislation replaces parts of the Act.