AIBE 2026 PREP

⚖️ Cyber Laws in India

Complete Bare Act–Based Revision Resource for Bar Exam 2026

IT Act 2000 DPDP Act 2023 BSA 2023 IT Rules 2021

⚠️ Disclaimer: This resource is for educational purposes only and does not constitute legal advice.

📌 Important Note for AIBE Students

Cyber Law in India is not a single statute. It is spread across multiple laws and rules. For AIBE 2026, you must understand four primary frameworks:

Information Technology Act, 2000
The foundational cyber law — covers electronic records, digital signatures, offences, and intermediary liability.

Digital Personal Data Protection Act, 2023
India's new data privacy law — covers consent, data fiduciary obligations, rights of data principals, and penalties.

Bharatiya Sakshya Adhiniyam, 2023
Replaces the Indian Evidence Act — contains provisions on admissibility and proof of electronic/digital records.

IT (Intermediary Guidelines & Digital Media Ethics Code) Rules, 2021
Governs due diligence obligations for platforms, social media, and digital news media.

📚

Laws & Sections — Detailed Study

§ 1

Short Title, Extent, Commencement & Application

Plain Explanation: The Act is called the Information Technology Act, 2000. It extends to the whole of India. Importantly, it also applies to any offence or contravention committed outside India by any person — provided the act involves a computer, computer system, or computer network located in India.

What Does Not Apply: The Act does NOT apply to documents listed in the First Schedule:

Negotiable instruments (other than cheques)
Power of attorney
Trusts
Wills and testamentary dispositions
Contracts for sale/conveyance of immovable property

💡 Example: A person in the USA hacks into an Indian bank's server. Though he is physically outside India, Section 1(2) makes the IT Act applicable to him because the computer system targeted is located in India.

⚠️ Exam Trap: Students often think the IT Act applies to all documents. Remember — wills, powers of attorney, trust deeds, and contracts for immovable property are EXCLUDED from the Act's application.

✅ AIBE Takeaway: Extra-territorial application of the IT Act — the act applies outside India if a computer resource located in India is involved.

§ 2

Key Definitions (Section 2)

Section 2 contains over 25 important definitions. Key ones for AIBE:

Term	Definition (Simplified)
Access (§2a)	Gaining entry into the logical, arithmetical, or memory function resources of a computer/computer system/network
Computer (§2i)	Any electronic/magnetic/optical high-speed data processing device performing logic, arithmetic, and memory functions
Computer Resource (§2k)	Computer, computer system, computer network, data, computer database, or software
Cyber Security (§2nb)	Protecting information, equipment, devices, computers from unauthorized access, use, disclosure, disruption, modification, or destruction
Data (§2o)	Any representation of information/knowledge/facts/instructions prepared in formalized manner for processing in a computer
Digital Signature (§2p)	Authentication of electronic record by subscriber using asymmetric crypto system (as per Section 3)
Electronic Record (§2t)	Data, record, or data generated, image or sound stored, received or sent in electronic form or microfilm or computer generated microfiche
Electronic Signature (§2ta)	Authentication of electronic record using technique specified in the Second Schedule; includes digital signature
Intermediary (§2w)	Any person who receives, stores, or transmits electronic records on behalf of another; includes ISPs, web-hosting, search engines, online marketplaces, cyber cafes
Originator (§2za)	Person who sends, generates, stores, or transmits an electronic message; does NOT include an intermediary

⚠️ Exam Trap: "Digital signature" and "electronic signature" are NOT the same. Digital signature (§2p) uses only asymmetric crypto system (Section 3), whereas electronic signature (§2ta) includes digital signature and any other technique in the Second Schedule.

✅ AIBE Takeaway: Know the definitions of "intermediary," "electronic record," "computer resource," and "cyber security" — these appear in MCQs frequently.

§ 3

Authentication of Electronic Records (Digital Signature)

Plain Explanation: A subscriber may authenticate an electronic record by affixing a digital signature. Authentication uses an asymmetric crypto system and a hash function that transforms the original record. Anyone can verify it using the subscriber's public key.

The private key and public key are unique to the subscriber and form a functioning key pair.

⚠️ Exam Trap: Section 3 deals with digital signature only. Electronic signature (broader category) is in Section 3A.

§ 3A

Electronic Signature (Section 3A — inserted by 2008 Amendment)

Plain Explanation: A subscriber may authenticate any electronic record by such electronic signature or electronic authentication technique that is (a) considered reliable, and (b) specified in the Second Schedule.

Reliability Criteria:

Signature creation data is linked to the signatory only
Was under sole control of the signatory at time of signing
Any alteration after signing is detectable
Any alteration to the information after authentication is detectable

✅ AIBE Takeaway: Section 3A broadened authentication beyond asymmetric crypto to any reliable electronic technique listed in the Second Schedule.

§ 4

Legal Recognition of Electronic Records

Plain Explanation: Where any law requires information to be "in writing" or "in printed/typewritten form," that requirement is satisfied if the information is rendered in electronic form and is accessible for subsequent reference.

💡 Example: A notice required by law to be in writing can be served by email, as long as the email is accessible for future reference.

✅ AIBE Takeaway: Section 4 gives legal equivalence to electronic records vis-à-vis paper documents.

§ 5

Legal Recognition of Electronic Signatures

Plain Explanation: Where any law requires a document to be "signed" or to "bear the signature" of a person, an electronic signature affixed in the prescribed manner satisfies that requirement.

⚠️ Exam Trap: Section 5 says electronic signatures satisfy a legal requirement for a handwritten signature — but only if affixed in the manner prescribed by the Central Government.

§ 10A

Validity of Contracts Formed Through Electronic Means

Plain Explanation: A contract is NOT unenforceable merely because proposals, acceptances, or revocations were communicated in electronic form or by electronic records.

💡 Example: A software company accepts a client's proposal via email. This contract is valid — it cannot be challenged simply because it was formed electronically.

✅ AIBE Takeaway: Section 10A validates e-contracts — the electronic medium alone cannot render a contract unenforceable.

§§ 11–13

Attribution, Acknowledgement & Time/Place of Despatch

Section 11 — Attribution: An electronic record is attributed to the originator if: (a) sent by the originator himself; (b) sent by an authorized person; or (c) sent by an automated information system programmed by/on behalf of the originator.

Section 12 — Acknowledgement: If the originator stipulates that the record is binding only on receiving acknowledgement — and no acknowledgement is received — the record is deemed never sent.

Section 13 — Despatch & Receipt:

Despatch occurs when the record enters a computer resource outside the control of the originator.
Receipt (if addressee designates a computer resource) occurs when the record enters that designated resource.
Place of despatch = originator's place of business; Place of receipt = addressee's place of business.

⚠️ Exam Trap: Despatch does NOT occur when you click "send" — it occurs when the record leaves your computer resource. This is a frequently asked exam point.

§ 43

Penalty & Compensation for Damage to Computer, Computer System, etc.

Plain Explanation: If any person without permission of the owner or person in charge of a computer/computer system/computer network does any of the following acts, they shall be liable to pay damages by way of compensation:

(a) Accesses or secures access to the computer
(b) Downloads, copies, or extracts any data or database
(c) Introduces a computer contaminant or virus
(d) Damages or causes damage to the computer or data
(e) Disrupts or causes disruption
(f) Denies or causes denial of access to authorized persons (DoS)
(g) Assists any person to facilitate unauthorized access
(h) Charges services to account of another by manipulating the computer
(i) Destroys, deletes, or alters information in a computer resource
(j) Steals or destroys computer source code

Nature of Remedy: Section 43 is a civil remedy — it awards compensation, not criminal punishment. The criminal counterpart is Section 66.

⚠️ Exam Trap: Section 43 = civil liability (compensation). Section 66 = criminal liability (imprisonment + fine). Students often confuse these two.

§ 43A

Compensation for Failure to Protect Data (Corporate Data Protection)

Plain Explanation: Where a body corporate possessing, dealing with, or handling sensitive personal data or information (SPDI) in a computer resource is negligent in implementing reasonable security practices and procedures, and thereby causes wrongful loss or wrongful gain, it is liable to pay compensation.

Key Definitions:

Body corporate = any company; includes firm, sole proprietorship, or other association engaged in commercial/professional activities
Reasonable security practices = security practices designed to protect from unauthorized access, damage, use, modification, disclosure, or impairment
SPDI = such personal information as may be prescribed by the Central Government

💡 Example: An e-commerce company stores customers' credit card details without any encryption. A data breach exposes thousands of cards. The company is liable under Section 43A for negligence in not maintaining reasonable security practices.

✅ AIBE Takeaway: Section 43A imposes a data protection duty on body corporates handling SPDI. This is the IT Act's data protection provision (now complemented by the DPDP Act, 2023).

§ 46

Power to Adjudicate

Plain Explanation: The Central Government appoints an adjudicating officer (not below the rank of Director to GoI or equivalent State officer) to adjudicate contraventions under Chapter IX.

Jurisdiction Limit: Adjudicating officer has jurisdiction only where the claim does not exceed ₹5 crore. Claims above ₹5 crore go to the competent court.

⚠️ Exam Trap: Above ₹5 crore = court jurisdiction. Also, Section 61 bars civil courts from entertaining matters that the adjudicating officer or Appellate Tribunal is empowered to decide.

§ 65

Tampering with Computer Source Documents

Whoever knowingly or intentionally conceals, destroys, or alters any computer source code (required to be kept by law) is punishable with imprisonment up to 3 years or fine up to ₹2 lakh, or both.

💡 Example: A software developer deliberately deletes the source code of a government-mandated application to hide evidence of fraud.

⚠️ Exam Trap: Section 65 requires the source code to be one "required to be kept or maintained by law." Random deletion of source code doesn't automatically attract this section.

§ 66

Computer Related Offences (Criminal Counterpart of Section 43)

If any person dishonestly or fraudulently does any act referred to in Section 43, they are punishable with imprisonment up to 3 years or fine up to ₹5 lakh, or both.

Key Point: "Dishonestly" (IPC S.24) and "fraudulently" (IPC S.25) as defined in the Indian Penal Code are imported into this section.

⚠️ Exam Trap: Section 43 = civil liability for unauthorized access without mens rea element specified. Section 66 = criminal liability — requires "dishonestly or fraudulently." Same acts, different mental element and remedy.

§ 66A

Sending Offensive Messages [STRUCK DOWN]

Section 66A provided punishment for sending grossly offensive/menacing messages through computer resources or communication devices.

⚡ Note: Section 66A was STRUCK DOWN by the Supreme Court in Shreya Singhal v. Union of India (2015) as unconstitutional for violating Article 19(1)(a). It is no longer enforceable.

⚠️ Exam Trap: Section 66A appears in the statute book but is NOT operative law. No person can be prosecuted under it after March 24, 2015.

§ 66B

Dishonestly Receiving Stolen Computer Resource or Communication Device

Punishment: Imprisonment up to 3 years or fine up to ₹1 lakh, or both.

Key element: Requires knowledge or reason to believe the resource is stolen.

§ 66C

Identity Theft

Whoever fraudulently or dishonestly makes use of the electronic signature, password, or any other unique identification feature of another person is punishable with imprisonment of either description for a term up to 3 years AND fine up to ₹1 lakh.

💡 Example: Raju steals Priya's internet banking password and uses it to log in as her. This is identity theft under Section 66C.

⚠️ Exam Trap: Section 66C = identity theft (using another's identification feature). Section 66D = cheating by personation (pretending to be someone else). Both are different offences.

§ 66D

Cheating by Personation Using Computer Resource

Whoever by means of any communication device or computer resource cheats by personation shall be punished with imprisonment up to 3 years AND fine up to ₹1 lakh.

💡 Example: A person creates a fake profile of a senior bank official and sends emails asking employees to transfer money. This is cheating by personation under Section 66D.

§ 66E

Violation of Privacy (Voyeurism/Non-Consensual Recording)

Whoever intentionally or knowingly captures, publishes, or transmits the image of the private area of any person without their consent, under circumstances violating their privacy, shall be punished with imprisonment up to 3 years or fine up to ₹2 lakh, or both.

Key Terms: "Private area" = genitals, pubic area, buttocks, or female breast (naked or undergarment-clad).

⚠️ Exam Trap: Section 66E covers voyeurism and non-consensual image capture/publication. It is NOT the same as Section 67 (obscene material). Section 66E focuses on the VICTIM's right to privacy.

§ 66F

Cyber Terrorism

Two types of cyber terrorism under Section 66F:

Type A: Acts done with intent to threaten unity, integrity, security, or sovereignty of India or to strike terror — by (i) denying access to computer resources, (ii) unauthorized penetration/access, or (iii) introducing computer contaminants — that cause or are likely to cause death, injuries, property damage, or disruption of essential services or critical information infrastructure.

Type B: Knowingly or intentionally penetrating/accessing a computer resource without authorization and obtaining restricted information that may be used to cause injury to sovereignty, integrity, security, friendly relations with foreign states, public order, decency/morality, or to benefit a foreign nation.

Punishment: Imprisonment which may extend to life imprisonment.

⚠️ Exam Trap: Section 66F carries the harshest penalty in the IT Act — life imprisonment. This distinguishes it from all other offences in the Act which carry lesser punishments.

§§ 67, 67A, 67B

Obscenity, Sexually Explicit Material & Child Pornography

Section	Offence	1st Conviction	2nd/Subsequent
§ 67	Publishing/transmitting obscene material (lascivious, appeals to prurient interest)	Up to 3 yrs + ₹5 lakh fine	Up to 5 yrs + ₹10 lakh fine
§ 67A	Publishing/transmitting sexually explicit material	Up to 5 yrs + ₹10 lakh fine	Up to 7 yrs + ₹10 lakh fine
§ 67B	Child pornography (material depicting children in sexually explicit acts); child = below 18 years	Up to 5 yrs + ₹10 lakh fine	Up to 7 yrs + ₹10 lakh fine

⚠️ Exam Trap: Section 67 = obscene (tests whether it deprave and corrupts). Section 67A = sexually explicit (stricter — no need to check effect). Section 67B covers children even in non-sexual obscene contexts.

✅ AIBE Takeaway: Penalty escalation — 67A and 67B carry heavier punishment than 67. Section 67B also covers browsing, downloading, promoting such material.

§ 69

Power to Issue Directions for Interception / Monitoring / Decryption

Plain Explanation: The Central Government or a State Government (through specially authorized officers) may, for reasons recorded in writing, direct any agency to intercept, monitor, or decrypt any information generated, transmitted, received, or stored in any computer resource — on grounds of:

Sovereignty or integrity of India
Defence of India
Security of the State
Friendly relations with foreign states
Public order
Prevention of incitement to a cognizable offence
Investigation of any offence

Duty: Subscribers, intermediaries, or persons in charge must provide all facilities and technical assistance when called upon.

Penalty for failure to assist: Imprisonment up to 7 years + fine.

⚠️ Exam Trap: Section 69 allows lawful interception — but requires reasons to be recorded in writing. This is different from Section 69A (blocking) and Section 69B (traffic data monitoring). Know these distinctions.

§ 70

Protected System (Critical Information Infrastructure)

Plain Explanation: The appropriate Government may, by notification, declare any computer resource that directly or indirectly affects Critical Information Infrastructure (CII) as a protected system.

CII Definition: Computer resource the incapacitation or destruction of which shall have a debilitating impact on national security, economy, public health, or safety.

Punishment for unauthorized access to protected system: Imprisonment up to 10 years + fine.

§ 70A

National Nodal Agency for CII Protection

The Central Government may designate any Government organization as the national nodal agency for Critical Information Infrastructure Protection. This agency is responsible for all measures including R&D relating to CII protection.

§ 70B

Indian Computer Emergency Response Team (CERT-In)

The Central Government shall appoint an agency called the Indian Computer Emergency Response Team (CERT-In) to serve as the national agency for cyber security incident response.

Functions of CERT-In include:

Collection, analysis, and dissemination of information on cyber incidents
Forecast and alerts of cyber security incidents
Emergency measures for handling cyber security incidents
Issue guidelines, advisories, vulnerability notes
Coordination of cyber incident response activities

Penalty for non-compliance: Imprisonment up to 1 year or fine up to ₹1 lakh, or both.

§ 72

Breach of Confidentiality and Privacy

Any person who, in pursuance of powers conferred under the IT Act, has secured access to any electronic record, book, register, correspondence, information, or document — and discloses such material to any other person without consent — shall be punished with imprisonment up to 2 years or fine up to ₹1 lakh, or both.

⚠️ Exam Trap: Section 72 applies only to persons who access information while exercising powers under the IT Act (e.g., police officers, adjudicating officers). It is not a general data-breach provision.

§ 72A

Disclosure of Information in Breach of Lawful Contract

Any person including an intermediary who, while providing services under a lawful contract, has secured access to personal information about another person, and — with intent to cause wrongful loss or gain — discloses such material without consent or in breach of contract, shall be punished with imprisonment up to 3 years or fine up to ₹5 lakh, or both.

⚠️ Exam Trap: Section 72A applies to intermediaries too — not just individuals. The intent element (wrongful gain/loss) is crucial.

§ 85

Offences by Companies

Two-tier liability under Section 85:

(1) General Rule: Where the contravening person is a company, every person who was in charge of and responsible for the company's business at the time of the contravention is guilty — UNLESS they prove the contravention occurred without their knowledge or that they exercised all due diligence to prevent it.

(2) Senior Officer Liability: Where a contravention has been committed with the consent/connivance of, or is attributable to negligence of, any director, manager, secretary, or other officer — such officer is also liable.

💡 Example: An IT company's data is breached due to negligence. Both the company and its CEO (if in charge) are liable. The CEO can escape liability only if he proves he had no knowledge and exercised due diligence.

✅ AIBE Takeaway: Section 85 mirrors corporate criminal liability provisions found in many Indian statutes. "Company" includes firms and associations. "Director" in relation to a firm means a partner.

§ 79

Exemption from Liability of Intermediary — Safe Harbour Provision

Plain Explanation: An intermediary shall NOT be liable for any third-party information, data, or communication link made available or hosted by it — IF all the following conditions are satisfied:

Conditions for Safe Harbour:

(a) The intermediary's function is limited to providing access / storage of information transmitted by third parties
(b) The intermediary does NOT initiate the transmission, select the receiver, or modify the information
(c) The intermediary observes due diligence as prescribed

When Safe Harbour is LOST:

(a) If the intermediary has conspired, abetted, aided, or induced the unlawful act
(b) Upon receiving actual knowledge or government notice that information on its platform is being used to commit an unlawful act — and the intermediary fails to expeditiously remove or disable access to that material

💡 Example: YouTube is an intermediary. It is not liable for defamatory videos uploaded by users as long as it doesn't initiate or modify content. But once YouTube is notified that a specific video is defamatory and it fails to remove it, it loses safe harbour protection.

⚠️ Exam Trap: Safe harbour is NOT absolute. It is lost upon (i) active participation in unlawful act, or (ii) failure to act after receiving actual knowledge or government notice.

§ 69A

Power to Block Public Access to Information

Central Government (or authorized officers) may direct any agency or intermediary to block public access to information on grounds similar to Section 69. Penalty for non-compliance by intermediary: imprisonment up to 7 years + fine.

§ 69B

Power to Monitor and Collect Traffic Data for Cyber Security

Central Government may authorize any agency to monitor and collect traffic data from any computer resource for cyber security purposes. Penalty for intermediary non-compliance: imprisonment up to 3 years + fine.

Traffic data = data identifying persons, computer systems, networks, or communication details (origin, destination, route, time, size, duration, type of service).

§§ 77A, 77B

Compounding of Offences & Bail

Section 77A: A court of competent jurisdiction may compound offences EXCEPT those punishable with life imprisonment or imprisonment exceeding 3 years. Offences affecting socio-economic conditions or committed against a child below 18 or a woman cannot be compounded.

Section 77B: Offences punishable with imprisonment of 3 years and above are cognizable. Offences punishable with exactly 3 years imprisonment are bailable.

⚠️ Exam Trap: Three years = bailable (under Section 77B). More than three years = non-bailable and cognizable. This is counterintuitive — study carefully.

§ 78

Power to Investigate Offences

Notwithstanding the CrPC, a police officer not below the rank of Inspector shall investigate any offence under the IT Act. (This was changed from "Deputy Superintendent of Police" by the 2008 Amendment.)

⚠️ Exam Trap: The minimum rank for investigation under IT Act is Inspector — NOT DSP. This is a very common MCQ point.

§ 80

Power of Police Officer to Enter, Search, and Arrest

A police officer not below the rank of Inspector, or any authorized officer of the Central/State Government, may enter any public place and search and arrest (without warrant) any person reasonably suspected of having committed, committing, or about to commit an offence under the IT Act.

Object

Object & Purpose of DPDP Act, 2023

The Act provides for the processing of digital personal data in a manner that recognizes (a) the right of individuals to protect their personal data, and (b) the need to process personal data for lawful purposes. It strikes a balance between privacy and legitimate use of data.

Applicability:

Processing of digital personal data within India — where data is collected online or digitized from offline sources
Processing of digital personal data outside India — if it involves offering goods or services to data principals within India

Not Applicable to:

Personal data processed for personal or domestic purposes
Personal data that is made publicly available by the data principal themselves or under any law

⚠️ Exam Point: DPDP Act applies to processing of digital personal data only — not offline physical records (unless digitized). Extra-territorial application exists if goods/services are offered to persons in India.

Definitions

Term	Meaning (Simplified)
Personal Data	Any data about an identifiable individual
Data Principal	The individual to whom the personal data relates (the person whose data is being processed)
Data Fiduciary	Any person who alone or in conjunction with others determines the purpose and means of processing personal data
Data Processor	Any person who processes personal data on behalf of a Data Fiduciary
Processing	Wholly or partly automated operation on digital personal data — includes collection, storage, use, sharing, transfer, deletion, etc.
Consent Manager	A person registered with the Data Protection Board, acting as a single point for data principal to give, manage, review, or withdraw consent
Significant Data Fiduciary	A Data Fiduciary or class thereof notified by Central Government based on volume/sensitivity of data processed, national security risk, etc.
Data Protection Board	Independent statutory body established by Central Government to adjudicate breaches and impose penalties

⚠️ Exam Trap: Data Fiduciary (decides purpose + means) ≠ Data Processor (only processes on behalf of fiduciary). A single entity can be both in different contexts.

Notice

Notice Requirement

Before or at the time of collecting personal data, the Data Fiduciary must provide a clear and plain language notice to the Data Principal about:

The personal data proposed to be collected
The purpose of processing
The manner in which the data principal may exercise their rights
The manner in which the data principal may make a complaint to the Board

The notice must be in English or any language specified in the Eighth Schedule to the Constitution.

Consent

Consent Requirements

Consent must be:

Free (not coerced)
Specific (for a specific purpose)
Informed (after notice)
Unconditional
Unambiguous (a clear affirmative action)

Consent can be withdrawn at any time. Withdrawal does not affect the legality of processing done before withdrawal.

⚠️ Exam Trap: Withdrawal of consent is prospective — it does not invalidate processing already done. This is an important exam nuance.

Legitimate Use

When Consent is NOT Required (Legitimate Uses)

Personal data may be processed for certain legitimate uses without consent, such as:

Processing by the State for providing or issuing subsidies, benefits, services, certificates, licences, or permits
Processing in the interest of sovereignty, security, or public order
Processing in response to a medical emergency
Processing to take measures to provide medical treatment or health services during epidemic, outbreak of disease, or other threats to public health
Processing required under any law for the time being in force
Processing for employment-related purposes

⚠️ Confusion to Avoid: Legitimate use is NOT unlimited. The fiduciary must still use only the data necessary for the specific legitimate purpose (data minimization principle applies).

Obligations

General Obligations of Data Fiduciary

Purpose Limitation: Process data only for the specified purpose for which consent was obtained
Data Minimization: Collect only data that is necessary for the purpose
Data Accuracy: Make reasonable efforts to ensure data is accurate and updated
Storage Limitation: Retain data only as long as necessary; erase it once the purpose is fulfilled
Security Safeguards: Implement reasonable security safeguards to prevent personal data breach
Personal Data Breach: Notify the Data Protection Board and each affected Data Principal in the event of a breach
Grievance Redressal: Provide an effective mechanism for Data Principals to address grievances

💡 Example: An online food delivery app collects users' addresses for delivery. Once the delivery is complete and no ongoing service relationship exists, it should erase the address data (storage limitation).

Rights

Rights of Data Principal

Right to Access Information: Summary of personal data being processed and details of Data Fiduciaries who have been given access
Right to Correction & Erasure: Right to correct inaccurate/misleading data; right to erase data no longer needed for the original purpose
Right to Grievance Redressal: Right to a readily available means for redressal of grievances
Right to Nominate: Right to nominate another individual to exercise rights on the data principal's behalf in case of death or incapacity

⚠️ Exam Point: The DPDP Act does NOT include a standalone "right to data portability" — unlike GDPR. Be careful when comparing with GDPR for MCQs.

Duties

Duties of Data Principal

Along with rights, the DPDP Act uniquely imposes duties on the Data Principal:

Must not register a false/frivolous grievance or complaint with the Data Fiduciary or Board
Must not impersonate another person while providing personal data
Must not suppress any material information while providing personal data for any document, service, or benefit
Must not provide false particulars

✅ AIBE Takeaway: The DPDP Act is unique in imposing duties on individuals too — not just organizations. This reflects a responsibility-based framework, not just a rights-based one.

Penalties

Penalties Under DPDP Act, 2023

Violation	Maximum Penalty
Breach of obligations for Significant Data Fiduciary	Up to ₹250 crore
Failure to take security safeguards (leading to breach)	Up to ₹250 crore
Failure to notify Data Principal and Board of breach	Up to ₹200 crore
Non-fulfilment of obligations regarding children's data	Up to ₹200 crore
Non-fulfilment of additional obligations of Significant Data Fiduciary	Up to ₹150 crore
Breach of duties by Data Principal	Up to ₹10,000
Any other provision of the Act or Rules	Up to ₹50 crore

Data Protection Board: An independent body that adjudicates breaches and imposes penalties. It is not a criminal court — penalties are civil in nature. Appeals from Board orders lie to the Appellate Tribunal.

⚠️ Exam Trap: DPDP Act penalties are civil penalties, not criminal punishments. The Act does not prescribe imprisonment for Data Fiduciaries — only monetary penalties.

§ 61

Relevance of Electronic Records

Plain Explanation: Section 61 of BSA provides that all information contained in an electronic record which is printed on paper, stored, recorded, or copied in optical or magnetic media produced by a computer — shall be deemed to be a "document" for the purposes of the Act, and shall be admissible in evidence, subject to the conditions in Section 63.

Key Point: Electronic records are given the same evidentiary status as paper documents under BSA 2023, replacing the earlier provisions in the Indian Evidence Act.

💡 Example: A WhatsApp message screenshot printed from a phone and produced before court is an electronic record treated as a "document" under Section 61 of BSA.

✅ AIBE Takeaway: Under BSA, electronic records are treated as documents admissible in evidence — expanding from IEA's more limited recognition.

§ 62

Proof as to Electronic Signature

Plain Explanation: Section 62 deals with the proof of electronic signatures. It provides that an electronic record, digitally signed or authenticated using an electronic signature, is presumed to have been signed by the person whose electronic signature or certificate accompanies it — subject to the presumptions in this section.

Key presumptions:

The subscriber's electronic signature certificate is genuine
The subscriber was in control of the signature creation data at the time of signing
The electronic record was not altered after signing

⚠️ Exam Trap: Section 62 creates a rebuttable presumption — it is not conclusive proof of authenticity. The opposing party can challenge the presumption.

§ 63

Admissibility of Electronic Records — Conditions

Plain Explanation: For an electronic record to be admissible as evidence, Section 63 requires a certificate from a person occupying a responsible official position regarding the computer that produced the record. The certificate must state:

(a) The computer was used regularly to store or process information in activities regularly carried on
(b) Information was fed into the computer in the ordinary course of such activities
(c) The computer was operating properly during the relevant period (or any malfunction did not affect the accuracy of the record)
(d) The information in the electronic record reproduces the information fed into the computer

Important: Under BSA 2023, the certificate requirement has been streamlined compared to the old Section 65B of the Indian Evidence Act. The person giving the certificate need only be in a "responsible official position" — which is broader than the old requirement.

💡 Example: A bank wishes to use its server logs as evidence of a fraudulent transaction. The bank's IT manager issues a Section 63 certificate attesting to the computer system's regular use and proper functioning. The log is then admissible.

⚠️ Exam Trap: Section 63 of BSA replaces Section 65B of the Indian Evidence Act, 1872. For AIBE 2026, know BSA's provisions — not IEA's old sections.

✅ AIBE Takeaway: Without a proper Section 63 certificate, an electronic record may not be admissible. This is crucial in cyber crime trials.

Purpose

Why Were These Rules Made?

The 2021 Rules replaced the 2011 Intermediary Guidelines. They were introduced to:

Strengthen accountability of social media intermediaries
Require faster grievance redressal for users
Enable tracing of originators of first message in case of serious crimes
Create an ethical code for digital news portals and OTT platforms
Address the absence of regulation for powerful Big Tech platforms

⚠️ Exam Point: The 2021 Rules distinguish between (a) ordinary intermediaries, (b) significant social media intermediaries (SSMIs — with registered users above a threshold), and (c) digital news/OTT publishers. Different obligations apply to each category.

Rule 2

Key Definitions Under Rule 2

Term	Meaning
Intermediary	As defined in Section 2(1)(w) of the IT Act — includes social media intermediaries, OTT platforms, and digital news publishers
Social Media Intermediary	Intermediary that primarily or solely enables interaction between two or more users and allows creating, uploading, sharing, disseminating, modifying, or accessing information via its services
Significant Social Media Intermediary (SSMI)	Social media intermediary having registered users in India above a threshold notified by Central Government (currently 50 lakh users)
Grievance Officer	A person designated to receive and address user grievances

Rule 3

Due Diligence to be Observed by All Intermediaries

Every intermediary must:

Publish rules, regulations, privacy policy, and user agreement on its platform — in English and each language specified in the Eighth Schedule
Inform users of: (a) types of content prohibited; (b) suspension/termination consequences; (c) right to file complaint before appropriate authority
Not knowingly host content that is patently false/misleading, threatens national security, is obscene, or violates any law
Remove or disable access to unlawful content within 36 hours of court order or government notification
Act on court orders or government notifications regarding unlawful content
Retain information for 180 days after user account closure or withdrawal, for investigation purposes
Provide user information to government/law enforcement upon legally authorized request within 72 hours
Designate a Grievance Officer and publish contact details
Grievance Officer must acknowledge a complaint within 24 hours and resolve within 15 days of receipt

⚠️ Exam Trap: Timelines are crucial in MCQs — 36 hours (remove unlawful content), 72 hours (provide user info to authorities), 24 hours (acknowledge grievance), 15 days (resolve grievance), 180 days (retain data after closure).

Rule 3A+

Obligations of Significant Social Media Intermediaries (SSMIs)

SSMIs (like Facebook, Twitter/X, YouTube) must comply with additional obligations including:

Appoint a Chief Compliance Officer (resident in India) responsible for compliance
Appoint a Nodal Contact Person for 24/7 coordination with law enforcement
Appoint a Resident Grievance Officer (India-based) to acknowledge complaints within 24 hours and resolve within 15 days
Publish a monthly compliance report — including number of complaints received, action taken, proactive monitoring done
For messaging platforms: enable traceability of the first originator of information that is required by court/government order (for offences against sovereignty, rape, CSAM, incitement to violence, etc.)
Add a visible mark on synthetic/AI-generated content to identify it
Develop and deploy automated tools to proactively identify child sexual abuse material (CSAM) and certain other unlawful content

💡 Example: WhatsApp (an SSMI) must, upon court order or government direction in cases involving national security crimes, reveal who originally sent a specific message — even in encrypted chats. This is the traceability obligation.

⚠️ Exam Trap: Traceability applies only to SSMIs, not all intermediaries. Also, it requires a specific court/government order — there is no automatic tracing.

Part III

Digital Media Ethics Code

Part III of the 2021 Rules governs Publishers of News & Current Affairs Content (digital news portals) and Publishers of Online Curated Content (OTT platforms like Netflix, Amazon Prime).

Three-Tier Grievance Redressal Mechanism:

Level I: Self-regulation by the publisher (Grievance Officer must address complaint within 15 days)
Level II: Self-regulatory body constituted by publishers (addresses appeals within 15 days)
Level III: Oversight mechanism — Inter-Departmental Committee under Ministry of I&B (final tier, can take binding decisions)

Content Classification: OTT platforms must classify content into age-based categories (U, U/A 7+, U/A 13+, U/A 16+, A) and implement access controls for adult content.

✅ AIBE Takeaway: The 2021 Rules brought OTT and digital news under a regulatory framework for the first time. The three-tier grievance structure is an important exam point.

📊

Key Reference Tables

Table 1: Cyber Laws Overview

Law	Year	Main Purpose	Key Sections/Rules	AIBE Importance
IT Act	2000 (Amended 2008)	Legal framework for e-commerce, electronic records, cyber offences, intermediary regulation	§§2, 4, 5, 43, 43A, 65, 66, 66C, 66F, 69, 70, 72, 79, 85	⭐⭐⭐ Very High
DPDP Act	2023	Data privacy — rights of individuals, obligations of organizations processing personal data	Notice, Consent, Rights of Data Principal, Data Protection Board, Penalties	⭐⭐⭐ Very High
BSA	2023	Law of evidence; admissibility and proof of electronic records in court	§§61, 62, 63	⭐⭐ High
IT Rules	2021	Due diligence for intermediaries; digital media ethics code; grievance mechanisms	Rules 3, 3A; Compliance timelines; SSMI obligations	⭐⭐ High

Table 2: IT Act — Key Offences & Penalties

Section	Offence	Punishment	Nature
§65	Tampering with computer source code	Up to 3 yrs + ₹2 lakh	Cognizable
§66	Computer related offences (dishonest/fraudulent acts under §43)	Up to 3 yrs + ₹5 lakh	Cognizable, Bailable
§66A	Offensive messages [STRUCK DOWN — Shreya Singhal 2015]	N/A	Not operative
§66B	Receiving stolen computer resource	Up to 3 yrs + ₹1 lakh	Cognizable, Bailable
§66C	Identity theft	Up to 3 yrs + ₹1 lakh	Cognizable, Bailable
§66D	Cheating by personation via computer	Up to 3 yrs + ₹1 lakh	Cognizable, Bailable
§66E	Privacy violation (non-consensual image capture/publish)	Up to 3 yrs + ₹2 lakh	Cognizable, Bailable
§66F	Cyber terrorism	Life imprisonment	Cognizable, Non-bailable
§67	Obscene material online	1st: 3 yrs + ₹5L \| 2nd+: 5 yrs + ₹10L	Cognizable
§67A	Sexually explicit material online	1st: 5 yrs + ₹10L \| 2nd+: 7 yrs + ₹10L	Cognizable
§67B	Child pornography online	1st: 5 yrs + ₹10L \| 2nd+: 7 yrs + ₹10L	Cognizable
§69	Failure to assist in interception/monitoring/decryption	Up to 7 yrs + fine	—
§70(3)	Unauthorized access to protected system	Up to 10 yrs + fine	Cognizable
§72	Breach of confidentiality by person having IT Act powers	Up to 2 yrs + ₹1 lakh	—
§72A	Disclosure of personal info in breach of lawful contract	Up to 3 yrs + ₹5 lakh	—

Table 3: DPDP Act 2023 — Concepts & Exam Points

Concept	Description	Key Exam Point
Data Principal	Individual whose data is being processed	Has rights: access, correction, erasure, nomination
Data Fiduciary	Entity determining purpose & means of processing	Has obligations: notice, consent, accuracy, security, breach notification
Consent	Free, specific, informed, unconditional, unambiguous, affirmative	Can be withdrawn; withdrawal is prospective only
Legitimate Use	Processing without consent for state functions, medical emergencies, employment, etc.	Does NOT mean unlimited processing — data minimization still applies
Significant Data Fiduciary	Notified by Central Government based on risk/volume	Additional obligations — DPO, periodic DPIA, audit
Data Protection Board	Adjudicatory body — civil, not criminal	Not a court; appeals to Appellate Tribunal; penalties civil in nature
Breach Notification	Notify Board AND affected Data Principals of any breach	No statutory time limit specified in the Act itself — to be prescribed by rules
Children's Data	Processing data of children requires verifiable parental consent	Children = below 18 years; no behavioral tracking/targeted advertising for children

Table 4: Electronic Evidence Under BSA 2023

BSA Section	Legal Effect	Practical Use in Cyber Trials
§61 (Electronic Records as Documents)	Electronic records printed/stored/copied from computer are admissible as documents, subject to §63 conditions	Used to admit CCTV footage, call records, emails, WhatsApp chats, banking transaction data as evidence
§62 (Proof of Electronic Signature)	Creates rebuttable presumption that digitally signed records are genuine; presumption that subscriber was in control of signature data	Used in e-contract disputes, digital banking fraud, identity theft cases to establish authenticity
§63 (Certificate of Admissibility)	Certificate from responsible official position is required for computer-generated evidence; conditions: regular use, proper functioning, accurate data reproduction	Required in virtually every cyber crime trial — without this certificate, electronic evidence may be rejected

Table 5: Key Distinctions for AIBE MCQs

Concept A	Concept B	Key Distinction
Hacking / Unauthorized Access (§43/66)	Identity Theft (§66C)	Hacking = unauthorized entry into system. Identity theft = using another person's credentials/signature. Overlap possible but conceptually distinct offences.
Identity Theft (§66C)	Cheating by Personation (§66D)	66C = fraudulent use of another's identification feature (password, e-sig, etc.). 66D = cheating by pretending to be someone else through computer. 66C focuses on stolen credentials; 66D on impersonation act.
Obscenity (§67)	Sexually Explicit Content (§67A)	§67 test: does material "deprave and corrupt"? §67A: any sexually explicit act or conduct — no depravity test required. §67A carries heavier penalty.
Data Protection Obligation — Data Fiduciary	Intermediary Due Diligence — IT Rules	DPDP Act obligations focus on lawful processing of personal data (consent, purpose, storage). IT Rules obligations focus on content moderation, user grievance, and government requests. Different statutory frameworks; can overlap.
Electronic Record	Electronic Evidence	Electronic record = any data in electronic form (§2t, IT Act). Electronic evidence = electronic record used in legal proceedings, subject to BSA §§61-63 admissibility conditions. All electronic evidence is electronic record but not vice versa.
Digital Signature (§2p / §3)	Electronic Signature (§2ta / §3A)	Digital Signature: specific — uses only asymmetric crypto + hash function. Electronic Signature: broader — includes digital signature and any other reliable technique in Second Schedule.
Section 43 (Civil — Compensation)	Section 66 (Criminal — Imprisonment + Fine)	§43 = civil remedy; no mens rea specified; compensation payable. §66 = criminal; requires dishonesty or fraud; imprisonment + fine. Same acts but different mental element and remedy.

Table 6: IT Rules 2021 — Critical Timelines for MCQs

Time Period	Action Required	Who
24 hours	Acknowledge user grievance	Grievance Officer
36 hours	Remove/disable access to unlawful content after government/court order	All intermediaries
72 hours	Provide user information to law enforcement upon authorized request	All intermediaries
15 days	Resolve user grievance (from receipt of complaint)	Grievance Officer
24 hours	Remove content depicting nudity/sexual act — upon complaint (for SSMIs)	SSMIs
180 days	Retain user information after account closure for investigation	All intermediaries
Monthly	Publish compliance report	SSMIs

🗺️

Visual Learning Aids

Flowchart: Indian Cyber Law Framework

Mind Map: Quick Revision of Cyber Laws

🗓️ AIBE 2026 Study Roadmap — Cyber Laws

Week 1: IT Act 2000 — Foundation

Read Chapters I, II, III, IV carefully. Master definitions under §2. Understand §§4, 5, 10A for e-governance and e-contracts. Learn the First Schedule exclusions.

Week 1-2: IT Act — Offences (Chapter XI)

Study Sections 65–85 systematically. Create a penalty table. Remember §66A is struck down. Master the §43 vs §66 distinction. Learn §66F (life imprisonment) separately.

Week 2: IT Act — Intermediary, §§69-70B, §79

Study the safe harbour (§79), interception (§69), blocking (§69A), traffic data (§69B), protected systems (§70), CERT-In (§70B). Note the 7-year vs 10-year penalty structure.

Week 3: DPDP Act 2023

Understand the entire framework: definitions → consent → notice → legitimate uses → fiduciary obligations → principal rights → Board → penalties. Focus on what distinguishes DPDP from GDPR for MCQs.

Week 3: BSA 2023 — §§61–63

Focus exclusively on Sections 61, 62, and 63. Understand the certificate requirement for electronic evidence admissibility. Practice MCQs on e-evidence and compare with old IEA §65B (for conceptual clarity only).

Week 4: IT Rules 2021 + Revision

Study Rule 3 timelines thoroughly. Understand SSMI obligations, traceability, and the three-tier digital media grievance mechanism. Then do a full revision pass of all four laws using the tables in this resource.

Week 5–6: MCQ Practice & Mock Tests

Attempt all 45 MCQs in this resource. Identify weak sections. Re-read bare text for missed questions. Attempt cross-law distinction MCQs. Simulate exam conditions: 15 cyber law questions in 15 minutes.

✏️

Short-Answer Questions (15 Questions)

1. What is the meaning of "access" as defined under Section 2(a) of the IT Act, 2000?

2. How does Section 4 of the IT Act give legal recognition to electronic records? Give one practical example.

3. Distinguish between "digital signature" and "electronic signature" under the IT Act, 2000.

4. What are the five types of documents excluded from the application of the IT Act, 2000 under its First Schedule?

5. Explain the concept of "safe harbour" under Section 79 of the IT Act. Under what two circumstances is this protection lost?

6. What is "cyber security" as defined under Section 2(nb) of the IT Act, 2000?

7. Briefly explain what Section 66F (cyber terrorism) covers and what is the maximum punishment under it.

8. What is the role of CERT-In under Section 70B of the IT Act? Name any three functions it performs.

9. What is a "Data Fiduciary" under the DPDP Act, 2023? How is it different from a "Data Processor"?

10. Under the DPDP Act, 2023, what are the rights of a Data Principal? List four rights.

11. What are the conditions required under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 for a computer-generated electronic record to be admissible in evidence?

12. What is the difference between Section 67 and Section 67A of the IT Act in terms of the offence and punishment?

13. What is the timeline for an intermediary to acknowledge and resolve a user grievance under IT Rules 2021?

14. What are "Significant Social Media Intermediaries" under IT Rules 2021? What is the threshold number of users?

15. What is the three-tier grievance redressal mechanism under the IT Rules 2021 for digital news portals and OTT platforms?

📄

Descriptive / Long-Answer Questions (8 Questions)

Q.1

Explain the framework of cyber law in India. Why is it described as a multi-statute framework? Identify the four primary laws/rules and briefly outline the subject matter covered by each.

Q.2

Critically explain the scheme of "intermediary liability" under the IT Act, 2000 (Section 79) and the IT (Intermediary Guidelines) Rules, 2021. When does an intermediary enjoy "safe harbour" protection and when is it lost? Support your answer with the relevant provisions.

Q.3

Explain the key offences under Chapter XI of the IT Act, 2000, with special focus on Sections 66C, 66D, 66E, and 66F. Distinguish between identity theft and cheating by personation, and between obscenity (§67) and sexually explicit material (§67A).

Q.4

Explain the framework for protection of personal data under the Digital Personal Data Protection Act, 2023. What are the obligations of a "Data Fiduciary"? What are the rights and duties of a "Data Principal"? What role does the Data Protection Board play?

Q.5

Discuss the admissibility of electronic records as evidence under the Bharatiya Sakshya Adhiniyam, 2023. What are the conditions specified under Section 63? What is the significance of a Section 63 certificate in a cyber crime trial?

Q.6

Explain the powers of the Central Government under Sections 69, 69A, and 69B of the IT Act, 2000. What is the difference between these three powers? What are the grounds on which these powers can be exercised and what are the consequences of non-compliance?

Q.7

Write a note on the adjudication and appellate mechanism under the IT Act, 2000. Who is the adjudicating officer, what are the limits of his jurisdiction, and what is the hierarchy of appeals under the Act?

Q.8

Explain the obligations of "Significant Social Media Intermediaries" (SSMIs) under the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. How do these obligations differ from those applicable to ordinary intermediaries? What is the "traceability" obligation and what concerns has it raised?

🔑

Answer Key

Section-Wise MCQs (Q.1–Q.15)

Q.1(c) Section 4

Section 4 gives legal recognition to electronic records — where any law requires information to be "in writing," electronic form satisfies it.

Q.2(c) Section 10A

Section 10A (inserted by 2008 Amendment) validates contracts formed through electronic means — a contract cannot be rendered unenforceable merely because the electronic medium was used.

Q.3(b) Civil compensation

Section 43 is a civil remedy — it provides for "damages by way of compensation." Criminal liability for the same acts is in Section 66.

Q.4(c) Life imprisonment

Section 66F(2) provides for imprisonment which may extend to life — the harshest penalty in the entire IT Act.

Q.5(b) Inspector

Section 78 (as amended in 2008) lowered the minimum rank from Deputy Superintendent of Police to Inspector.

Q.6(c) A will

The First Schedule explicitly excludes wills and testamentary dispositions from the IT Act's application.

Q.7(b) Negligence in protecting SPDI

Section 43A creates liability for body corporates that are negligent in implementing reasonable security practices for sensitive personal data, causing wrongful loss/gain.

Q.8(b) Identity theft

Section 66C deals with fraudulent or dishonest use of another person's electronic signature, password, or unique identification feature.

Q.9(c) Actual knowledge + failure to remove

Per §79(3)(b), the intermediary loses safe harbour if, after receiving actual knowledge (or government/agency notification), it fails to expeditiously remove or disable access to the unlawful material.

Q.10(b) ₹5 crore

Section 46(1A) limits the adjudicating officer's jurisdiction to claims not exceeding ₹5 crore; claims above that go to the competent court.

Q.11(c) ₹250 crore

The maximum penalty for breach of obligations relating to significant data fiduciaries and failure to implement security safeguards is ₹250 crore under the DPDP Act penalty schedule.

Q.12(c) Section 63

Section 63 of BSA 2023 lays down the conditions for admissibility of computer-generated electronic records, including the certificate requirement.

Q.13(b) 24 hours

Under IT Rules 2021 Rule 3, the Grievance Officer must acknowledge the complaint within 24 hours and resolve it within 15 days of receipt.

Q.14(b) Intent to cause or knowledge of likely wrongful loss/gain

Section 72A requires that the disclosure be made "with the intent to cause or knowing that he is likely to cause wrongful loss or wrongful gain" — this is the crucial mens rea element.

Q.15(b) No knowledge + due diligence

Section 85(1) provides the defence: the person was not liable if they prove (a) the contravention occurred without their knowledge, AND (b) they exercised all due diligence to prevent it. Both conditions must be met.

Argument-wise MCQs (Q.16–Q.30)

Q.16(b) Yes

Section 75 — the IT Act applies to offences committed outside India if the act involves a computer resource in India. Nationality is irrelevant.

Q.17(b) Employer incorrect

Section 10A expressly validates e-contracts — a contract cannot be held unenforceable solely because it was formed electronically.

Q.18(c) Both §66 and §72A

§66 for unauthorized dishonest/fraudulent access and data theft; §72A for disclosure of personal information in breach of lawful contract with intent to cause wrongful gain/loss. Both can apply simultaneously.

Q.19(b) Section 66D

Creating a fake profile and pretending to be someone else to cheat people is cheating by personation using a computer resource — exactly what §66D covers.

Q.20(c) §66F — life imprisonment

While §70 also applies (10 years for protected system access), §66F carries life imprisonment, which is the severest. If intent to threaten sovereignty + CII disruption is present, §66F applies.

Q.21(b) Purpose + Storage Limitation

Using data for advertising after the original delivery purpose is fulfilled violates both purpose limitation (processing only for specified purpose) and storage limitation (retaining data longer than necessary).

Q.22(b) Yes — §63 satisfied

The IT manager holds a "responsible official position" and has certified the conditions in §63 — regular use, proper functioning, accurate data. This satisfies BSA §63 for admissibility.

Q.23(c) 36 hours

Rule 3 of IT Rules 2021 mandates removal/disabling of unlawful content within 36 hours of a court order or government notification.

Q.24(c) Section 66E

Section 66E criminalizes the intentional capture, publication, or transmission of a private area image without consent under circumstances violating privacy. This is the relevant section for non-consensual recording.

Q.25(c) Both Board AND Data Principals

DPDP Act imposes breach notification obligations on the Data Fiduciary to notify BOTH the Data Protection Board AND each affected Data Principal in the event of a personal data breach.

Q.26(b) No — primarily marketplace

An SSMI is specifically a social media intermediary that primarily enables user-to-user interaction and content creation/sharing. Amazon India primarily facilitates commerce, not social interaction.

Q.27(b) May lose safe harbour

Section 79(3)(b) requires removal "without vitiating the evidence." If an intermediary's actions vitiate evidence, it does not strictly comply with the provision. This is a nuanced but important distinction.

Q.28(b) Section 66C

An OTP is a "unique identification feature." Using another person's OTP fraudulently to access their account is identity theft under §66C.

Q.29(b) Section 69

Section 69 empowers the Central Government to issue directions for interception, monitoring, or decryption of information through computer resources for specified purposes including preventing/investigating offences.

Q.30(b) Yes — 20 days exceeds 15-day limit

Rule 3 of IT Rules 2021 mandates resolution of grievances within 15 days of receipt. 20 days is a breach of this obligation. Note: The obligation applies to all intermediaries, not just SSMIs.

Statement-wise MCQs (Q.31–Q.45)

Q.31(b) Only I

Statement I: Correct — §10A validates e-contracts. Statement II: Incorrect — wills are excluded under the First Schedule.

Q.32(c) Both correct

Both statements are accurate — §43 provides civil compensation without requiring dishonesty, while §66 criminalizes the same acts when done dishonestly or fraudulently.

Q.33(b) Only II

Statement I: Incorrect — §66A is struck down and no longer operative. Statement II: Correct — Shreya Singhal v. UOI (2015) declared §66A unconstitutional.

Q.34(b) Only I

Statement I: Correct — consent must be free, specific, informed, unconditional, unambiguous. Statement II: Incorrect — consent can be withdrawn at any time (withdrawal is prospective only).

Q.35(a) Both correct

Statement I: Correct — digital signature is a specific type of electronic signature. Statement II: Correct — §3A and the Second Schedule allow broader electronic authentication techniques.

Q.36(c) Only II

Statement I: Incorrect — safe harbour is conditional, not absolute. Statement II: Correct — §79(3)(b) withdraws protection when the intermediary ignores actual knowledge of unlawful use.

Q.37(b) Only I

Statement I: Correct — BSA §61 treats computer-generated electronic records as documents. Statement II: Incorrect — §63 certificate applies only to electronic records, not physical documents.

Q.38(b) Only I

Statement I: Correct — §67B (5 yrs) is heavier than §67 (3 yrs) on first conviction. Statement II: Incorrect — §70 = 10 years; §66F = life imprisonment. They carry different punishments.

Q.39(a) Only I

Statement I: Correct — 72 hours applies to all intermediaries. Statement II: Incorrect — 180-day retention obligation applies to ALL intermediaries under Rule 3, not just SSMIs.

Q.40(c) Only II

Statement I: Incorrect — the Board is a civil adjudicatory body, not a criminal court. It cannot impose imprisonment. Statement II: Correct — appeals lie to the Appellate Tribunal.

Q.41(b) Only I

Statement I: Correct — §85 defines "company" to include firms and associations. Statement II: Incorrect — §85(2) specifically allows prosecution of directors and officers who consented, connived, or were negligent.

Q.42(a) Only I

Statement I: Correct — extra-territorial application under §1(2) and §75. Statement II: Incorrect — wills, PoA, trusts, negotiable instruments (other than cheques), and immovable property contracts are excluded.

Q.43(b) Only I

Statement I: Correct — DPDP Act uniquely imposes duties on Data Principals. Statement II: Incorrect — filing false/frivolous complaints is specifically prohibited and punishable under the Act.

Q.44(b) Only I

Statement I: Correct — §46(1) specifies "not below the rank of Director to Government of India." Statement II: Incorrect — §61 bars civil court jurisdiction for matters that the adjudicating officer or Appellate Tribunal is empowered to decide.

Q.45(a) Only I

Statement I: Correct — OTT platforms must classify content into U, U/A 7+, U/A 13+, U/A 16+, and A categories. Statement II: Incorrect — the three-tier mechanism applies to both digital news publishers AND OTT publishers under Part III of the Rules.

🔁

Quick Revision Cards — 60-Second Memory Aids

§43 vs §66

§43 = Civil compensation (no crime). §66 = Criminal punishment (dishonestly/fraudulently). Same acts — different mental element and remedy.

§66C vs §66D

§66C = Using another's password/e-sig/ID feature (identity theft). §66D = Pretending to be someone else to cheat (personation). 66C = stolen credentials; 66D = impersonation.

§66F = Life

Cyber terrorism under §66F is the only IT Act offence with life imprisonment. All others: max 3–10 years. §70 protected system = 10 years.

First Schedule Exclusions

Wills | Trusts | Power of Attorney | Negotiable instruments (except cheque) | Contracts for immovable property — ALL excluded from IT Act.

Investigation: Inspector

Section 78 — Minimum rank = Inspector (NOT DSP). Changed by 2008 Amendment. §80 — Inspector can also enter public place and arrest without warrant.

§79 Safe Harbour Lost When

1. Intermediary conspired/abetted/aided unlawful act. 2. Received actual knowledge of unlawful content but failed to expeditiously remove it "without vitiating evidence."

Adjudication Limit

§46: Adjudicating officer = ≤ ₹5 crore claims. Court = > ₹5 crore claims. §61: Civil courts BARRED from entertaining IT Act matters adjudicated under the Act.

DPDP Act Consent

Must be: Free | Specific | Informed | Unconditional | Unambiguous. Can be WITHDRAWN (but withdrawal is prospective — doesn't affect past processing).

DPDP Penalties

Breach causing data loss = ₹250 Cr. Failure to notify breach = ₹200 Cr. Children's data violation = ₹200 Cr. Data Principal breach of duties = ₹10,000 only.

BSA §63 Certificate

4 Conditions: (1) Regular use of computer. (2) Info fed in ordinary course. (3) Computer working properly. (4) Record accurately reproduces the input. Replaces old IEA §65B.

IT Rules 2021 Timelines

24h → Acknowledge grievance. 36h → Remove unlawful content (court/govt order). 72h → Give user info to law enforcement. 15 days → Resolve grievance. 180 days → Retain data after closure.

§66A Struck Down

Shreya Singhal v. UOI (2015) — SC declared §66A unconstitutional (Article 19(1)(a) violation). Section exists in statute book but is NOT enforceable. No prosecution after March 24, 2015.

⚠️ Disclaimer: This resource is for educational purposes only and does not constitute legal advice. All content is based on the Bare Act text of the Information Technology Act, 2000 (as amended), Digital Personal Data Protection Act, 2023, Bharatiya Sakshya Adhiniyam, 2023, and IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. Please refer to the official Gazette publications for authoritative text. Prepared for AIBE 2026 examination preparation.