IT Act offences, explained simply: Sections 65 to 67 and what they mean

The Information Technology Act, 2000 punishes cyber offences through Sections 65 to 67B, 72 and 72A — covering source-code tampering, hacking, identity theft, online impersonation, privacy-violating images and obscene content — and most of these offences carry a maximum of three years’ imprisonment, making them cognizable but bailable under Section 77B. The Act also runs a separate civil track: Sections 43 and 43A give victims monetary compensation without any criminal trial. Section 66A, once the most invoked provision, no longer exists — the Supreme Court struck it down in 2015. This article walks through each section in plain language, with the exact punishments and how the sections combine with the Bharatiya Nyaya Sanhita in real FIRs.

Is the IT Act civil or criminal? What is the difference between Section 43 and Section 66?

Both. The IT Act, 2000 has two parallel tracks, and understanding the split explains most of its architecture.

The civil track is Chapter IX. Section 43 lists ten kinds of harm to a computer — unauthorised access, downloading data, introducing a virus, causing damage, denying access, and so on — and makes the wrongdoer liable to pay compensation to the victim. No police, no jail: the remedy is money. Claims up to five crore rupees go to the Adjudicating Officer appointed under Section 46 (usually the State IT Secretary); larger claims go to the competent civil court.

Section 43A makes a company that negligently fails to protect “sensitive personal data” liable to compensate the person harmed. It remains in force today, but it is scheduled to be omitted when Section 44(2) of the Digital Personal Data Protection Act, 2023 takes effect on 14 May 2027 — the date the DPDP regime’s core obligations become enforceable. Businesses tracking that transition can see the DPDP compliance timeline.

The criminal track is Chapter XI. Section 66 converts the civil wrongs of Section 43 into crimes — but only where the act was done dishonestly or fraudulently, terms borrowed from the Indian Penal Code and now defined in Sections 2(7) and 2(9) of the Bharatiya Nyaya Sanhita, 2023. The same hack can therefore produce both a compensation claim under Section 43 and a prosecution under Section 66. Section 77 of the Act says one does not bar the other.

What does each offence section of the IT Act actually cover?

Here is each provision of Chapter XI in the order it appears, with the punishment fixed by the statute. Section numbers and amounts below are taken from the consolidated text of the Act.

Section 65 — Tampering with computer source documents

Knowingly concealing, destroying or altering computer source code that the law requires to be kept or maintained. It is a narrow offence — the source code must be one required by law to be maintained, which is why it appears mostly in cases involving licensed software, telecom equipment or government systems. Punishment: up to three years’ imprisonment, or fine up to two lakh rupees, or both.

Section 66 — Computer-related offences

The general hacking provision. Any Section 43 act — unauthorised access, data theft, virus insertion, damage, denial of service, account manipulation — done dishonestly or fraudulently. Punishment: up to three years, or fine up to five lakh rupees, or both.

Section 66B — Dishonestly receiving stolen computer resource

Receiving or retaining a stolen computer resource or communication device, knowing or having reason to believe it is stolen. It reaches the buyer of a stolen phone or laptop, and investigators sometimes add it against those holding devices or SIM cards traced to a fraud. Punishment: up to three years, or fine up to one lakh rupees, or both.

Section 66C — Identity theft

Fraudulently or dishonestly using another person’s electronic signature, password or “any other unique identification feature”. In practice this is the OTP-and-credentials section: phished banking passwords, misused OTPs, SIM-swap frauds, cloned biometrics. Punishment: up to three years’ imprisonment and fine up to one lakh rupees.

Section 66D — Cheating by personation using a computer resource

Cheating by pretending to be someone else through any communication device or computer resource. This is the workhorse of Indian cyber-fraud FIRs: phishing sites, fake customer-care numbers, fake matrimonial and social-media profiles, “digital arrest” calls impersonating police or customs, fraudulent investment platforms. Punishment: up to three years and fine up to one lakh rupees. Victims of payment frauds under this section should act within hours — the steps are set out in how to complain about UPI fraud and recover money.

Section 66E — Violation of privacy

Intentionally capturing, publishing or transmitting an image of a person’s private area without consent, in circumstances where privacy is reasonably expected. It covers hidden-camera images and non-consensual sharing of intimate images. Punishment: up to three years, or fine up to two lakh rupees, or both. It is almost always paired with voyeurism under Section 77 of the BNS (formerly Section 354C IPC).

Section 66F — Cyber terrorism

The gravest offence in the Act: unauthorised access or denial-of-service attacks intended to threaten the unity, integrity, security or sovereignty of India or to strike terror, or accessing data restricted for reasons of State security. Punishment: imprisonment which may extend to imprisonment for life. It is rarely and cautiously invoked; ordinary hacking does not meet its threshold.

Sections 67, 67A and 67B — The obscenity cluster

• Section 67 punishes publishing or transmitting obscene material in electronic form: first conviction up to three years and fine up to five lakh rupees; a repeat conviction up to five years and fine up to ten lakh rupees.
• Section 67A covers material containing a sexually explicit act: five years and ten lakh rupees on first conviction, seven years and ten lakh rupees on repeat.
• Section 67B covers material depicting children in sexually explicit acts — creating, browsing, downloading, exchanging or facilitating it: five years and ten lakh rupees on first conviction, seven years on repeat. It operates alongside Sections 13 to 15 of the POCSO Act, 2012.

These three sections, usually with extortion under Section 308 of the BNS (formerly Sections 383–384 IPC), form the charge structure in sextortion cases. Sections 67 to 67B carry a public-good exception for scientific, literary, artistic or heritage material.

Sections 72 and 72A — Breach of confidentiality

Section 72 punishes officials who obtained access to records using powers under the IT Act and then disclose them without consent: up to two years, or fine up to one lakh rupees, or both. Section 72A is broader and more practical: any person — including an intermediary or service provider — who obtained personal information under a lawful contract and discloses it without consent, intending or knowing it will cause wrongful loss or gain, faces up to three years, or fine up to five lakh rupees, or both.

Is Section 66A still in force? Can an FIR be registered under it?

No. The Supreme Court struck down Section 66A in its entirety in Shreya Singhal v. Union of India, (2015) 5 SCC 1, by judgment dated 24 March 2015, holding that its vague terms — “grossly offensive”, “annoyance”, “inconvenience” — violated Article 19(1)(a) and were not saved by Article 19(2).

A struck-down provision is void; no FIR, charge sheet or conviction can rest on it. Because police stations kept invoking it anyway, the Supreme Court in People’s Union for Civil Liberties v. Union of India (order dated 12 October 2022) directed all states and police forces to stop registering 66A cases and to delete the section from pending prosecutions. If an FIR today cites Section 66A, that is a ground to seek deletion of the charge, and if the FIR rests on 66A alone, to seek quashing — the route is explained in filing a writ petition before the High Court of Kerala.

Note what Shreya Singhal did not do: it upheld the website-blocking power under Section 69A and read down intermediary liability under Section 79. Only 66A fell.

Which IT Act offences are cognizable and which are bailable?

Section 77B of the Act sets the rule: offences punishable with imprisonment of three years and above are cognizable (police can register an FIR and arrest without a warrant), and offences punishable with three years are bailable (bail is a right, granted at the police station or by the Magistrate). The practical result — most IT Act offences are both.

Two further procedural rules matter. Under Section 78, only a police officer of the rank of Inspector or above may investigate an IT Act offence — in Kerala that typically means the Cyber Police Station of the district or an Inspector at the local station. And under Section 75, the Act applies to offences committed outside India, by any person of any nationality, if the computer or network involved is located in India.

Can IT Act offences be compounded or settled?

Yes, within limits. Section 77A allows a competent court to compound any IT Act offence except those punishable with life imprisonment or with a term exceeding three years. Three further bars apply: no compounding where a previous conviction exposes the accused to enhanced punishment, where the offence affects the socio-economic conditions of the country, or where it was committed against a child below 18 or against a woman.

So a first-time Section 66 or 66C case between business rivals may realistically end in compounding, while Sections 66F, 67A and 67B never can, and a 66E case against a woman victim cannot either. The accused applies in the trial court under Section 77A(2), which adopts the plea-bargaining procedure of Sections 265B and 265C CrPC — provisions now carried into Sections 289 to 300 of the BNSS.

How do IT Act sections pair with BNS offences in a real FIR?

Cyber-crime FIRs almost never cite the IT Act alone. Since 1 July 2024, offences are charged under the Bharatiya Nyaya Sanhita, 2023 rather than the IPC, and the pairings run to a pattern:

The BNS sections matter for the accused because they can change the bail picture: cheating under Section 318(4) BNS carries up to seven years, so an FIR pairing 66D with 318(4) is effectively non-bailable even though 66D alone is bailable. They matter for victims because property traced under them can be seized and accounts frozen under Section 106 of the BNSS (formerly Section 102 CrPC) — the mechanism behind most frozen-account notices, explained in what to do when a cyber cell freezes your bank account.

How is electronic evidence proved in an IT Act case?

Every screenshot, server log, CDR and CCTV clip in these cases is an electronic record, and its admissibility is governed by Section 63 of the Bharatiya Sakshya Adhiniyam, 2023, which replaced Section 65B of the Indian Evidence Act on 1 July 2024.

Section 63(4) requires a certificate identifying the record, describing how it was produced, and confirming the device was working properly. The BSA tightened the old rule: the certificate must now be signed both by the person in charge of the device or activity and by an expert, in the form prescribed in the Schedule to the Adhiniyam, with a hash report of the record enclosed. The Supreme Court held in Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, (2020) 7 SCC 1, that the certificate is mandatory unless the original device itself is produced — reasoning that continues to govern Section 63. In practice, a prosecution or complaint that skips the certificate risks its core evidence being ruled inadmissible at trial.

What should a complainant or an accused do first?

For a victim, speed beats paperwork:

1. For financial fraud, call the national helpline 1930 immediately — within the first few hours banks can freeze the fraudster’s receiving accounts.
2. File a complaint on the National Cyber Crime Reporting Portal with transaction IDs, screenshots and numbers used.
3. Follow up with a written FIR at the local or Cyber Police Station. Under Section 173 of the BNSS (formerly Section 154 CrPC), the FIR can be given at any station regardless of where the offence occurred, and even by electronic communication.
4. Preserve original devices and records — they will be needed for the Section 63 BSA certificate.

For a person accused or named in a notice: do not delete accounts, chats or data — that can become a separate offence and destroys exculpatory material too. Check which sections the FIR actually cites, since bailability turns on them, and verify no struck-down provision like 66A appears. Respond to police notices in writing and take legal advice promptly; an advocate can assess whether the case is one for bail, compounding under Section 77A, or quashing. An overview of how these cases progress is at cyber crime practice.

Primary sources

• Information Technology Act, 2000 — India Code
• IT Act, 2000 — consolidated text with amendments (PDF)
• Shreya Singhal v. Union of India, (2015) 5 SCC 1 — Indian Kanoon
• Bharatiya Nyaya Sanhita, 2023 — India Code
• Bharatiya Sakshya Adhiniyam, 2023 — India Code
• National Cyber Crime Reporting Portal — cybercrime.gov.in