Cybercrime Law in India

Updated August 26, 2026

India’s cybercrime framework centres on the Information Technology Act, supported by general criminal law and a data-protection statute that only became fully operational in late 2025.

Key laws

Information Technology Act, 2000 (Act No. 21 of 2000, enacted 9 June 2000, in force from 17 October 2000 by notification G.S.R. 788(E); substantially amended by the Information Technology (Amendment) Act, 2008) — the primary statute, published by the Ministry of Electronics and Information Technology. Key provisions include s 43 (penalty and compensation for damage to a computer or computer system), s 43A (compensation for failure to protect data), s 66 (computer-related offences), s 66C (identity theft), s 66D (cheating by personation using a computer resource), s 66E (violation of privacy), s 66F (cyber terrorism) and ss 67–67B (obscene, sexually explicit and child sexual abuse material in electronic form).
Section 66A is no longer enforceable. It was struck down by the Supreme Court in Shreya Singhal v. Union of India by judgment dated 24 March 2015, and the footnote to s 66A in the official text records this. Charges are still occasionally laid under it in error.
Bharatiya Nyaya Sanhita, 2023 (Act No. 45 of 2023, enacted 25 December 2023, in force from 1 July 2024) — the general penal code that replaced the Indian Penal Code, used for offences such as cheating and forgery that often accompany cyber cases.
Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023, enacted 11 August 2023) — India’s data-protection law. It sat largely unimplemented until the Digital Personal Data Protection Rules, 2025 were notified on 14 November 2025, which brought the Act into operation with a phased compliance period and established the Data Protection Board of India.

Enforcement

State police cybercrime cells investigate, coordinated nationally by the Indian Cyber Crime Coordination Centre (I4C) under the Ministry of Home Affairs. Victims can report through the National Cyber Crime Reporting Portal. The Data Protection Board of India handles complaints under the DPDP framework.

Plain-language overview, not legal advice. Statutes change — read the current Acts and Rules linked above and consult a qualified lawyer for any specific question.

Sources verified 26 August 2026. India Code has migrated to indiacode.gov.in and its old indiacode.nic.in/handle/... addresses no longer resolve, so the Act texts above are cited to the responsible ministries (MeitY, MHA) and to the current India Code record; commencement dates were read from the India Code register and the DPDP Rules date from the Press Information Bureau.