Penalties, compensation and adjudication under the IT Act - Cyber Law

On this page

1. Section 43: damage to computer, computer system, etc.
2. Section 43A: failure to protect data
3. Sections 44 and 45: other penalties
4. Adjudicating officer: section 46
5. Factors for compensation: section 47
6. Appellate Tribunal: section 48 and the TDSAT
7. Appeals and bar of jurisdiction
How AIBE asks this
Quick check

Cases checked to exist. Read the judgment before quoting a holding.

Every case cited here has been checked to exist — the citation resolves and names the right parties. The propositions attributed to each case have not been verified line by line against the judgment. Case names link through to the full judgment: read it before quoting a holding in an examination answer, and never carry a proposition from notes into court on trust.

Section 43 is civil; section 66 is criminal. The same acts (unauthorised access, downloading, introducing a virus and so on) make a person liable to pay compensation under section 43, decided by an adjudicating officer. If done dishonestly or fraudulently, they are also an offence under section 66, tried by a criminal court. Appeals from adjudicating officers go to the TDSAT, and then to the High Court.

1. Section 43: damage to computer, computer system, etc.

If any person, without permission of the owner or person in charge of a computer, computer system or computer network:

Clause	Act	Example
(a)	accesses or secures access to it or to a computer resource	logging into a colleague’s account
(b)	downloads, copies or extracts any data, database or information, including from a removable storage medium	copying a client list onto a pen drive
(c)	introduces or causes to be introduced any computer contaminant or computer virus	sending malware
(d)	damages or causes damage to any computer, system, network, data, database or programme	corrupting files
(e)	disrupts or causes disruption	crashing a server
(f)	denies or causes denial of access to an authorised person by any means	denial-of-service attack, ransomware lock
(g)	provides assistance to any person to facilitate access in contravention of the Act	sharing stolen login details
(h)	charges services availed by one person to the account of another by tampering with or manipulating a computer	billing your calls to another’s account
(i)	destroys, deletes or alters any information in a computer resource or diminishes its value or utility or affects it injuriously	defacing a website
(j)	steals, conceals, destroys or alters any computer source code, or causes another to do so, with intent to cause damage	deleting an employer’s source code on leaving

Consequence: he shall be liable to pay damages by way of compensation to the person so affected. The original Act capped compensation at one crore rupees; the 2008 Amendment removed the cap. Clauses (i) and (j) were added in 2008. The Explanation defines computer contaminant, computer database, computer virus, damage and computer source code.

Link to section 66. Section 43 needs no guilty mind. Section 66 punishes “any act referred to in section 43” done dishonestly or fraudulently (as defined in sections 24 and 25 IPC) with up to three years, or fine up to five lakh rupees, or both. See the note on offences under the IT Act.

2. Section 43A: failure to protect data

A body corporate possessing, dealing or handling sensitive personal data or information in a computer resource it owns, controls or operates, which is negligent in implementing and maintaining reasonable security practices and procedures, and thereby causes wrongful loss or wrongful gain to any person, must pay damages by way of compensation to the person affected.
“Body corporate” includes a company, firm, sole proprietorship or association engaged in commercial or professional activities. “Reasonable security practices” are those agreed between the parties, or specified by law, or else prescribed by the Central Government (the 2011 rules on sensitive personal data).
Coming omission. Section 44(2) of the Digital Personal Data Protection Act, 2023 omits section 43A. Under the commencement notification G.S.R. 843(E) dated 13 November 2025, section 44(2) comes into force eighteen months from that date, that is, in May 2027, together with the main obligations of the DPDP Act. Until then, section 43A remains in force. The DPDP regime is covered in the note on data protection.

3. Sections 44 and 45: other penalties

The Jan Vishwas (Amendment of Provisions) Act, 2023 raised these amounts with effect from 30 November 2023.

Section	Default	Penalty now	Before 30.11.2023
44(a)	Failure to furnish a document, return or report to the Controller or CA	up to fifteen lakh rupees per failure	one lakh fifty thousand
44(b)	Failure to file a return or furnish information in time	up to fifty thousand rupees per day	five thousand per day
44(c)	Failure to maintain books of account or records	up to one lakh rupees per day	ten thousand per day
45	Residuary: contravention of rules, regulations, directions or orders with no separate penalty	penalty up to one lakh rupees, plus compensation up to ten lakh rupees (by an intermediary, company or body corporate) or one lakh rupees (any other person)	compensation or penalty up to twenty-five thousand rupees

The same Act converted some former offences into penalties: section 33 (failure to surrender a CA licence, up to five lakh rupees), section 67C (intermediary failing to preserve information, up to twenty-five lakh rupees), section 68 (non-compliance with the Controller’s direction, up to twenty-five lakh rupees), section 72 (breach of confidentiality, up to five lakh rupees) and section 72A (disclosure in breach of lawful contract, up to twenty-five lakh rupees).

4. Adjudicating officer: section 46

Who. The Central Government appoints an officer not below the rank of Director to the Government of India, or an equivalent State officer, with the prescribed experience in information technology and legal or judicial experience. By a 2003 notification, the Secretary of the Department of Information Technology of each State and Union Territory was appointed adjudicating officer.
What. To adjudge whether a person has contravened the Act, rules, regulations, directions or orders so as to be liable to pay penalty or compensation. Since the Jan Vishwas Act the words are “under this Act” (earlier “under this Chapter”), so the officer also imposes the new penalties under sections 33, 67C, 68, 72 and 72A.
Pecuniary limit (section 46(1A)). Claims for damage not exceeding five crore rupees; above five crore, jurisdiction vests in the competent court.
Procedure. Inquiry in the prescribed manner after a reasonable opportunity of representation (section 46(2)).
Powers (section 46(5)). Powers of a civil court conferred on the Appellate Tribunal by section 58(2); proceedings are judicial proceedings for the offences of false evidence and insult to a public servant; deemed civil court for certain CrPC purposes and for execution under Order XXI CPC.

5. Factors for compensation: section 47

the amount of gain or unfair advantage, wherever quantifiable, made as a result of the default;
the amount of loss caused to any person as a result of the default;
the repetitive nature of the default.

6. Appellate Tribunal: section 48 and the TDSAT

The Act originally set up a Cyber Appellate Tribunal. The Finance Act, 2017 (section 169, w.e.f. 26 May 2017) substituted section 48(1): the Telecom Disputes Settlement and Appellate Tribunal, established under section 14 of the Telecom Regulatory Authority of India Act, 1997, is now the Appellate Tribunal under the IT Act. Sections 49 to 54 and 56 (composition, qualifications, staff) were omitted.

7. Appeals and bar of jurisdiction

Section	Rule
57(1)	Any person aggrieved by an order of the Controller or an adjudicating officer may appeal to the Appellate Tribunal.
57(2)	No appeal from an adjudicating officer’s order made with the consent of the parties.
57(3)	Appeal within 45 days from receipt of a copy of the order; delay condonable for sufficient cause.
57(4)–(6)	Tribunal may confirm, modify or set aside after hearing; endeavour to dispose of the appeal within six months.
58	Not bound by the CPC; guided by natural justice; civil court powers for summons, discovery, affidavits, commissions, review, ex parte decisions.
59–60	Appellant may appear in person or through legal practitioners; the Limitation Act, 1963 applies so far as may be.
61	No civil court has jurisdiction over any matter that an adjudicating officer or the Appellate Tribunal is empowered to determine, and no court or authority may grant an injunction against action taken under the Act.
62	Appeal to the High Court within 60 days of communication of the Tribunal’s decision, on any question of fact or law; extendable by a further period not exceeding 60 days for sufficient cause.
63	Contraventions may be compounded by the Controller, an authorised officer or the adjudicating officer, before or after adjudication begins, for a sum not exceeding the maximum penalty; not for the same or similar contravention within three years of an earlier compounding.
64	Unpaid penalty or compensation is recovered as arrears of land revenue; the licence or certificate stays suspended until payment.

Note the interplay of sections 46(1A) and 61: the civil court is barred only within the adjudicating officer’s field. A claim above five crore rupees goes to the competent court. Section 77 adds that compensation or penalty under the Act does not bar punishment or compensation under any other law.

How AIBE asks this

Expect numerical recall: the five crore limit of the adjudicating officer, the 45-day appeal to the Appellate Tribunal, the 60-day appeal to the High Court, and the rank of Director. A second type asks which tribunal now hears IT Act appeals (TDSAT, after the Finance Act, 2017). A third type describes a fact (copying data without permission, no dishonest intent) and asks whether it falls under section 43 or section 66.

Quick check

An adjudicating officer under section 46 has jurisdiction where the claim for damage does not exceed:
(A) one crore rupees
(B) five crore rupees
(C) ten crore rupees
(D) there is no limit
Answer
(B). Section 46(1A); claims above five crore go to the competent court.
Appeals against orders of an adjudicating officer now lie to:
(A) the Cyber Appellate Tribunal
(B) the National Company Law Appellate Tribunal
(C) the Telecom Disputes Settlement and Appellate Tribunal
(D) the District Court
Answer
(C). Section 48(1) as substituted by the Finance Act, 2017.
An appeal from the Appellate Tribunal to the High Court under section 62 must be filed within:
(A) 30 days
(B) 45 days
(C) 60 days
(D) 90 days
Answer
(C). Sixty days, extendable by a further sixty days for sufficient cause.
A, without permission, copies data from B’s computer onto a pen drive, without any dishonest or fraudulent intention. A is liable:
(A) to compensation under section 43(b)
(B) to imprisonment under section 66
(C) under section 66F
(D) under no provision
Answer
(A). Section 43 is a civil wrong; section 66 needs dishonest or fraudulent intent.
Which of these is NOT a factor under section 47?
(A) Gain of unfair advantage
(B) Loss caused to any person
(C) Repetitive nature of the default
(D) Income of the defaulter
Answer
(D). Section 47 lists only gain, loss and repetition.