Cyber crime and data protection in cyberspace

1. Meaning of cyber crime

The IT Act does not define “cyber crime”. It is generally understood as any unlawful act in which a computer, computer system, computer network or communication device is either the target of the crime (hacking, viruses, denial of service) or the tool used to commit it (online fraud, cyber stalking, child sexual abuse material), or both. The Bharatiya Nyaya Sanhita, 2023 uses the term “cyber-crimes” in its definition of organised crime (section 111) without defining it.

2. Categories

• Against persons — cyber stalking and harassment, cyber defamation, identity theft, morphing and publishing private images, sextortion, child sexual abuse material, online threats.
• Against property — hacking, data theft, credit-card and banking fraud, phishing and vishing, ransomware, software piracy and other IP crimes, cyber squatting, salami attacks.
• Against the government and society — cyber terrorism, attacks on critical information infrastructure, spreading content that threatens public order, online gambling and trafficking.
• By method — unauthorised access, introduction of viruses, worms and trojans, denial of service, email spoofing and spamming, data diddling, web jacking.

3. Offences under the IT Act

• Section 43 (civil): unauthorised access, downloading, introducing a virus, damaging, disrupting, denying access, and similar acts. Liability is to pay compensation, adjudicated under section 46.
• Section 65: tampering with computer source documents — up to three years or fine up to two lakh rupees, or both.
• Section 66: any act in section 43 done dishonestly or fraudulently — up to three years or fine up to five lakh rupees, or both.
• Section 66B receiving stolen computer resources; 66C identity theft (fraudulent use of another’s electronic signature or password); 66D cheating by personation using a computer resource — each punishable with imprisonment up to three years and fine up to one lakh rupees (for 66B, imprisonment or fine or both).
• Section 66E: capturing or publishing images of a person’s private area without consent — up to three years or fine up to two lakh rupees.
• Section 66F: cyber terrorism — imprisonment which may extend to imprisonment for life.
• Sections 67, 67A and 67B: publishing or transmitting obscene material, sexually explicit material, and material depicting children in sexually explicit acts.
• Section 69A: power of the Central Government to block public access to information; section 70: protected systems.
• Sections 72 and 72A: breach of confidentiality by persons given access under the Act, and disclosure of personal information in breach of a lawful contract. The Jan Vishwas Act, 2023 converts both into civil penalties (up to five lakh and twenty-five lakh rupees respectively).
• Section 77B: offences punishable with three years are bailable; and section 78 empowers an Inspector to investigate.

Many cyber crimes are also offences under the BNS: cheating (section 318), cheating by personation (section 319), criminal intimidation (section 351), defamation (section 356), insulting the modesty of a woman by words or gestures (section 79), and organised crime including cyber-crimes (section 111).

4. Shreya Singhal and section 66A

Section 66A punished sending, by a computer resource or communication device, information that is grossly offensive or menacing; information known to be false sent persistently for the purpose of causing annoyance, inconvenience, insult or ill will; or e-mail sent to cause annoyance or to mislead about its origin. In Shreya Singhal v. Union of India, 2015 INSC 257, (2015) 5 SCC 1, the Supreme Court struck it down in its entirety as violating Article 19(1)(a) and not saved by Article 19(2). Terms like “annoying”, “inconvenient” and “grossly offensive” were vague and overbroad, had no proximate connection with public order, and would chill protected speech. The Court distinguished discussion and advocacy, which are protected, from incitement, which may be punished. It upheld section 69A and the blocking rules, and read down section 79 so that an intermediary must take down content only on a court order or government notification.

5. Problem

X sends false information through e-mail to his friend Y to cause annoyance. Has X committed any offence under the Information Technology Act? Decide. (February 2025)

Issue. Whether sending a false e-mail to cause annoyance is an offence under the IT Act.

Law. These facts fall exactly within section 66A(b) and (c). But section 66A was declared unconstitutional in Shreya Singhal (2015), and the Jan Vishwas Act, 2023 omitted it with effect from 30 November 2023. A void provision cannot found a prosecution; the Supreme Court has since directed that no one be prosecuted under it.

Application. No surviving section of the IT Act punishes a false e-mail merely because it annoys. The position would change if the facts showed more: if X impersonated someone else to deceive Y, section 66D (and section 319 BNS); if he used Y’s password, section 66C; if the content was obscene, section 67; if it threatened injury, criminal intimidation under section 351 BNS; if it harmed Y’s reputation in the eyes of others, defamation under section 356 BNS. Annoyance to a friend by a false message, without more, is not one of these.

Conclusion. X has committed no offence under the IT Act. Y may have a civil remedy only if he suffers some legal injury.

6. Data protection in cyberspace

• Privacy as a fundamental right. In Justice K.S. Puttaswamy (Retd.) v. Union of India, 2017 INSC 801, (2017) 10 SCC 1, a nine-judge bench held that privacy, including informational privacy, is a fundamental right under Article 21 and Part III, and asked the Government to enact a data protection law.
• IT Act, section 43A. A body corporate that is negligent in implementing reasonable security practices for sensitive personal data, causing wrongful loss or gain, must pay compensation. The 2011 rules on sensitive personal data set out those practices.
• Digital Personal Data Protection Act, 2023. It applies to digital personal data processed in India, and outside India if connected with offering goods or services in India. A Data Fiduciary may process personal data only for a lawful purpose on the consent of the Data Principal, which must be free, specific, informed, unconditional and unambiguous (section 6), or for certain legitimate uses (section 7). It must give notice, keep data accurate, take reasonable security safeguards, report breaches and erase data when the purpose is over (section 8). Data of children needs verifiable parental consent (section 9). Data Principals have rights of access, correction and erasure, grievance redressal and nomination (sections 11 to 14), and duties (section 15). The Data Protection Board of India enforces the Act, with penalties up to two hundred and fifty crore rupees (Schedule).

Commencement. By notification G.S.R. 843(E) of 13 November 2025, the provisions on the Board, rule-making and miscellaneous matters came into force on that date; the provisions on consent managers come into force one year later (13 November 2026); and the main obligations (sections 3 to 17, 27 to 34, 36, 37) and the amendment omitting section 43A of the IT Act (section 44(2)) come into force eighteen months after the notification. Until then, section 43A and the 2011 rules continue to govern compensation for data breaches.

How this is examined

January 2026 and February 2025 both asked “Define cyber crimes. Explain the different categories of cyber crimes”; February 2025 set the false e-mail problem; August 2024 a note on “cyber crimes”. For the essay, sections 1 to 3 with a paragraph on Shreya Singhal. Data protection is a syllabus item that suits a short note: Puttaswamy, section 43A, and the DPDP Act with its commencement dates.