IT Act 2000 — Key Provisions, Amendments, Section 66A & UPSC Polity Guide

The Information Technology Act, 2000 (IT Act) is India's primary legislation governing electronic commerce, digital signatures, cybercrimes, and the regulation of online activity. As India's digital economy has expanded exponentially, the IT Act and its subsequent amendments have become central to questions of governance, fundamental rights, and cybersecurity. For UPSC aspirants, this topic is relevant across Polity (GS Paper II), Science & Technology (GS Paper III), and Essay.

Background and Purpose

India enacted the Information Technology Act on 17 October 2000, with retrospective effect from 9 June 2000. It was based on the UNCITRAL Model Law on Electronic Commerce (1996), a framework developed by the United Nations to harmonise e-commerce laws globally.

Key objectives:

1. Provide legal recognition for electronic records and digital signatures.
2. Facilitate electronic governance (e-governance) by recognising electronic filings.
3. Establish a legal framework for preventing and punishing cybercrimes.
4. Regulate intermediaries (internet service providers, social media platforms, etc.).
5. Protect sensitive personal data in electronic form.

The IT Act applies to the whole of India and also applies to offences committed outside India if they involve a computer, computer system, or computer network located in India (Section 75 — extraterritorial jurisdiction).

Key Provisions of the IT Act, 2000

Chapter-Wise Overview

Important Sections in Detail

Section 43: Penalty for damage to a computer, computer system — compensation up to Rs 1 crore (later made unlimited by the 2008 amendment).

Section 65: Tampering with computer source documents — imprisonment up to 3 years or fine up to Rs 2 lakh.

Section 66: Computer-related offences (dishonestly or fraudulently) — imprisonment up to 3 years or fine up to Rs 5 lakh.

Section 66A (struck down): Sending offensive messages through communication services. This section was struck down by the Supreme Court in Shreya Singhal v. Union of India (2015) — discussed in detail below.

Section 66F: Cyber terrorism — whoever commits or conspires to commit certain acts with intent to threaten the unity, integrity, security, or sovereignty of India. Punishment: imprisonment which may extend to life.

Section 69: Power of the government to issue directions for interception, monitoring, or decryption of any information through any computer resource, in the interest of sovereignty, integrity, defence, security of the state, friendly relations with foreign states, public order, or for preventing incitement to a cognizable offence.

Section 69A: Power to issue directions for blocking public access to information. This is the section under which the government orders blocking of websites, apps (such as the 2020 ban on several Chinese apps), and social media accounts.

Section 79: Safe harbour provision for intermediaries. An intermediary (ISP, social media platform, search engine) is not liable for third-party content hosted on its platform, provided it observes due diligence and acts upon government or court orders to remove content.

IT Act Amendment, 2008

The Information Technology (Amendment) Act, 2008 was a major overhaul that introduced several new provisions:

• Section 66A: Added offence for sending offensive/menacing messages (later struck down).
• Section 66F: Introduced the offence of cyber terrorism.
• Section 69A: Empowered the government to block websites.
• Section 69B: Empowered the government to monitor and collect traffic data.
• Section 43A: Data protection — body corporates handling sensitive personal data must implement reasonable security practices; failure to do so attracts compensation.
• Section 79: Refined the safe harbour provision for intermediaries.
• Removed Section 57: The earlier cap of Rs 1 crore on compensation under Section 43 was removed, allowing unlimited compensation.
• Introduced provisions on electronic signatures (broader than just digital signatures) under Section 3A.

Shreya Singhal v. Union of India (2015) — Section 66A

This is one of the most important Supreme Court judgments for UPSC, at the intersection of fundamental rights and cyber law.

Background: Section 66A criminalised sending "offensive" or "menacing" messages through a computer or communication device. It was widely criticised for being vague and overbroad — the terms "grossly offensive," "menacing," and "causing annoyance" were undefined, giving authorities sweeping power to arrest individuals for online speech.

Several cases of arrest for social media posts (including cases in Maharashtra where individuals were arrested for Facebook posts criticising political figures) triggered public outrage and legal challenges.

Supreme Court Ruling (24 March 2015):

• The Court struck down Section 66A in its entirety as unconstitutional, holding that it violated Article 19(1)(a) (freedom of speech and expression).
• The Court held that the section was vague — terms like "grossly offensive" and "causing annoyance" had no clear definition and created a chilling effect on free speech.
• The Court distinguished between discussion, advocacy, and incitement — only the last can be restricted.
• However, the Court upheld Section 69A (blocking of websites) and Section 79 (intermediary liability), finding them to be constitutionally valid as they contained sufficient procedural safeguards.

UPSC significance: Shreya Singhal is a landmark case for fundamental rights (Article 19), reasonable restrictions (Article 19(2)), and the balance between state power and individual liberty in the digital age.

Intermediary Guidelines and Digital Media Ethics Code, 2021

Under Section 87(2)(zg) of the IT Act, the government notified the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, replacing earlier 2011 guidelines. Key provisions:

• Due diligence obligations for intermediaries: publish privacy policy, inform users about prohibited content, remove content within 36 hours of court/government order.
• Significant Social Media Intermediaries (SSMIs) — platforms with over 5 million registered users in India — must appoint a Chief Compliance Officer, Nodal Contact Person, and Resident Grievance Officer (all based in India).
• Traceability: SSMIs must enable identification of the first originator of a message when ordered by a court or the government (relevant to encrypted messaging platforms like WhatsApp).
• Digital Media Ethics Code: Brought online news portals and OTT platforms under a three-tier grievance redressal mechanism.

These rules have faced legal challenges on grounds of free speech and privacy. Multiple petitions are pending before the Supreme Court and various High Courts.

Digital Personal Data Protection Act, 2023 (DPDP Act)

The Digital Personal Data Protection Act, 2023 is India's dedicated data protection law, enacted to replace the patchwork of data protection provisions under the IT Act (particularly Section 43A and the 2011 Rules). Key features:

• Applies to digital personal data processed within India and to processing outside India if it involves offering goods/services to individuals in India.
• Establishes the Data Protection Board of India as the adjudicatory body.
• Defines rights of data principals (individuals): right to access, correction, erasure, grievance redressal, and nomination.
• Imposes obligations on data fiduciaries (organisations processing data): purpose limitation, data minimisation, accuracy, security.
• Provides for significant financial penalties (up to Rs 250 crore) for data breaches and non-compliance.
• Includes provisions for processing children's data with verifiable parental consent.
• Allows the Central Government to exempt certain government agencies from data protection obligations in the interest of sovereignty, security, and public order — a controversial provision.

UPSC Relevance

GS Paper Mapping:

• Prelims: Key sections of the IT Act, Shreya Singhal judgment, DPDP Act provisions, intermediary guidelines.
• GS Paper II (Mains): Fundamental rights vs state power, Supreme Court judgments (Shreya Singhal), governance through digital regulation.
• GS Paper III (Mains): Cyber security, IT and computers, data protection, digital economy.
• Essay: Digital rights, surveillance state, balance between security and freedom.

Key Prelims Facts:

• The IT Act was enacted in 2000, based on the UNCITRAL Model Law on E-Commerce.
• Section 66A was struck down by the Supreme Court in Shreya Singhal v. Union of India (2015) as violating Article 19(1)(a).
• Section 69A empowers the government to block websites and apps.
• Section 79 provides safe harbour for intermediaries subject to due diligence.
• The 2008 amendment introduced cyber terrorism (Section 66F) and website blocking (Section 69A).
• The 2021 Intermediary Guidelines require SSMIs to appoint compliance officers based in India and enable first-originator traceability.
• The DPDP Act, 2023 establishes the Data Protection Board of India.
• The DPDP Act provides for penalties up to Rs 250 crore for data breaches.
• The IT Act has extraterritorial jurisdiction under Section 75.

PDF