The Information Technology Act, 2000: Governing the Digital Age in India

Every time you file your taxes online, sign a document with an electronic signature, or access an e-book from a library portal, you are operating within a legal framework that did not exist in India before the turn of the millennium. The internet had arrived, e-commerce was growing, and yet electronic contracts, digital records, and online signatures held no legal value in Indian courts. The Information Technology Act, 2000 changed that. It became the foundation on which India’s entire digital economy now stands, and it remains the country’s primary law governing cyberspace more than two decades later.

Why the country needed an IT law 🔗

Before 2000, a serious gap existed in the legal system. Contracts, documents, and records had value only if they existed on paper with a handwritten signature. An email agreement, a digitally signed file, or an electronic record had no standing in court. For a country trying to participate in the rapidly expanding world of online commerce, this created uncertainty and risk for businesses operating online.

The push for a dedicated law also came from an international source. In 1996, the United Nations Commission on International Trade Law (UNCITRAL) adopted the Model Law on Electronic Commerce, which member nations were encouraged to adopt. The IT Act was India’s response. When it received Presidential assent on 9 June 2000 and came into force on 17 October 2000, India became one of the earliest nations in the world to have separate legislation dedicated to information technology.

The objectives were ambitious. The Act aimed to grant legal recognition to electronic transactions, promote e-governance through electronic delivery of government services, prevent computer-related crime, and bring India’s cyber laws in line with global practice. In doing so, it amended four older statutes, including the Indian Penal Code, 1860, and the Indian Evidence Act, 1872, to accommodate electronic records as valid evidence.

How the Act tackles cybercrime 🔗

One of the central purposes of the Act was to define and penalise offences committed in the digital world. In its original form, it dealt with cybercrime through a few broad provisions, mainly Sections 43, 66, and 67, covering unauthorised access, computer-related offences, and the publication of obscene material in electronic form.

An important feature is the Act’s reach. It applies to offences committed inside or outside India, as long as a computer, computer system, or network located in India is involved. This extra-territorial jurisdiction means a person can be held liable under Indian law regardless of their physical location, although enforcement still depends heavily on international cooperation.

Hacking and unauthorised access 🔗

Section 66 addresses computer-related offences. It covers acts done dishonestly or fraudulently that involve unauthorised access, damage to computer systems, or theft of data. The original Section 43 also imposes civil liability, requiring a person who causes such damage to pay compensation to the affected party.

Identity theft and online fraud 🔗

Identity theft is one of the most common cybercrimes today. Section 66C punishes the fraudulent or dishonest use of another person’s electronic signature, password, or unique identification feature, with imprisonment of up to three years and a fine of up to one lakh rupees. Closely related is Section 66D, which targets cheating by personation using a computer resource. This covers the kind of fraud most people encounter as phishing, fake calls, and online scams where the offender pretends to be someone else.

Cyber terrorism 🔗

The most serious cyber offence under the Act is defined in Section 66F. It deals with acts intended to threaten the unity, integrity, security, or sovereignty of India through cyber means, such as denying access to critical systems, unauthorised access to sensitive data, or introducing harmful code into protected infrastructure. Unlike most other offences under the Act, cyber terrorism can attract life imprisonment, placing it on the same footing as the gravest crimes against the nation.

The key provisions that power digital India 🔗

Beyond punishing crime, the Act built the legal machinery that allows digital services to function. Three pillars stand out.

Digital and electronic signatures 🔗

The Act gave legal validity to digital signatures, allowing them to authenticate the identity of a sender and ensure the integrity of a document. This is the basis on which companies file documents through the Ministry of Corporate Affairs portal, taxpayers submit returns, and individuals sign contracts without printing a single page. A 2008 amendment broadened the definition from “digital signature” to the more inclusive term “electronic signature”, so the law could accommodate newer authentication methods rather than being tied to one technology.

Electronic governance 🔗

The Act made it legally possible for government departments to accept and issue records in electronic form. This provision is the legal backbone of e-governance platforms such as DigiLocker, eSign, and online tax filing. A citizen can now hold a driving licence or a degree certificate as a legally recognised electronic document, something that would have been impossible before 2000.

Data protection and intermediaries 🔗

The Act also addressed who is responsible when things go wrong. Section 79 grants conditional “safe harbour” protection to intermediaries, such as internet service providers and online platforms, shielding them from liability for content posted by users, provided they observe due diligence and act on government directions. The definition of an intermediary is broad, covering telecom providers, web-hosting services, search engines, and online payment sites.

On data, Section 43A made companies handling sensitive personal data liable to pay compensation if their negligence in maintaining reasonable security practices caused wrongful loss. The detailed standards came through the SPDI Rules of 2011, which defined sensitive categories such as passwords, financial information, health records, and biometric data, and required organisations to obtain consent and publish privacy policies.

What the Act means for libraries and digital resources 🔗

The shift from physical to digital collections has placed libraries squarely within the scope of this law. The effects work in two directions: the Act both enables and regulates the digital work of libraries and information centres.

On the enabling side, the legal recognition of electronic records means that a library’s digital catalogues and bibliographic records carry the same standing as their paper equivalents. Libraries can also enter into licensing agreements for e-journals, databases, and e-books with legal certainty, because electronic contracts are now valid and enforceable.

On the regulatory side, libraries take on new obligations. When a library collects information about its members, it handles personal data and is expected to maintain reasonable security practices to protect it. A digital repository that hosts user-contributed content may also fall within the definition of an intermediary, which brings due diligence responsibilities about the material it stores and transmits.

Copyright is the area that demands the most care. The IT Act does not replace copyright law; it operates alongside the Copyright Act, 1957. A library digitising books, providing remote access, or building an institutional repository must respect reproduction and distribution rights under copyright law while also complying with the IT Act. This is why most established Indian digital archives, including older national digitisation efforts, restricted their freely accessible collections largely to works that were out of copyright.

Amendments and the evolving shape of cyber law 🔗

Technology moved faster than the original text, so the law has been revised and supplemented over time.

The 2008 amendment 🔗

The Information Technology (Amendment) Act, 2008 was the most significant overhaul. It introduced a cluster of specific offences through Sections 66A to 66F and 67A to 67C, covering identity theft, cheating by personation, violation of privacy, cyber terrorism, and child sexual abuse material. It also strengthened the intermediary framework under Section 79 and introduced Section 43A on corporate data protection. These provisions gave law enforcement far more precise tools than the broad-brush original sections.

One part of this amendment became infamous. Section 66A penalised the sending of “offensive” messages through communication services, but its vague wording led to widespread misuse and arrests over social media posts. In the landmark case of Shreya Singhal v. Union of India (2015), the Supreme Court struck down Section 66A entirely, holding that it violated the right to freedom of speech under Article 19(1)(a) of the Constitution.

Rules and the road ahead 🔗

More recent regulation has come through rules framed under the Act rather than fresh legislation. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 placed greater accountability on social media platforms, digital news media, and streaming services.

The data protection landscape is also changing fundamentally. The Digital Personal Data Protection Act, 2023 establishes a comprehensive, consent-based framework for handling personal data, backed by a Data Protection Board of India. As this regime is phased in, Section 43A and the SPDI Rules of the IT Act are set to be repealed, transferring data protection to a dedicated modern law. Looking further ahead, a proposed Digital India Act is being discussed to eventually replace the more than two-decade-old IT Act and address emerging issues such as artificial intelligence, deepfakes, and online safety.

Even with these changes, the core of the IT Act endures. Its offences relating to hacking and computer-related dishonesty continue to apply, and its provisions on lawful interception remain central to state access to information. The framework it built for electronic records, signatures, and e-governance still underpins daily digital life for hundreds of millions of people.

What do you think? As libraries digitise more of their collections, where should the line fall between making knowledge freely accessible and respecting the data protection and copyright duties the law imposes? And as the IT Act gradually gives way to newer legislation, what lessons from its twenty-five-year journey should shape the laws that replace it?

References

1. https://uncitral.un.org/en/texts/ecommerce/modellaw/electronic_commerce
2. https://www.indiacode.nic.in/bitstream/123456789/13116/1/it_act_2000_updated.pdf
3. https://www.geeksforgeeks.org/ethical-hacking/information-technology-act-2000-india/
4. https://www.legalservicesindia.com/article/1263/Cyber-Terrorism—Quick-glance.html
5. https://sujith-eag.in/mca/cs/u52
6. https://copyright.gov.in/documents/handbook.html
7. https://www.scobserver.in/cases/shreya-singhal-union-of-india-section-66a-it-act-case-background/
8. https://www.meity.gov.in/
9. https://www.meity.gov.in/data-protection-framework