The Information Technology Act, 2000: salient features, e-commerce, e-contracts and internet policy

1. Salient features of the IT Act

• Commencement and reach. In force from 17 October 2000; extends to the whole of India and applies to offences and contraventions committed outside India by any person (section 1(2)), where the act involves a computer system or network located in India (section 75).
• Exclusions (section 1(4) and First Schedule). The Act does not apply to negotiable instruments other than cheques, powers of attorney, trusts, wills, and contracts for the sale or conveyance of immovable property.
• Legal recognition of electronic records and signatures (sections 4 and 5): where a law requires writing or a signature, an electronic record or electronic signature satisfies it.
• Electronic governance (sections 6 to 10): filing, payments and publication in the Electronic Gazette.
• Attribution, acknowledgment, despatch and receipt of electronic records (sections 11 to 13), which supply the rules for e-contracts.
• Secure electronic records and signatures (sections 14 to 16).
• Regulation of Certifying Authorities by a Controller (Chapter VI) and issue of electronic signature certificates (Chapter VII).
• Penalties and adjudication (Chapter IX): compensation for damage to computer systems (section 43) and for failure to protect sensitive personal data (section 43A), decided by an adjudicating officer (section 46), with appeal to the Telecom Disputes Settlement and Appellate Tribunal (section 48, as amended by the Finance Act, 2017).
• Offences (Chapter XI, sections 65 to 78).
• Intermediaries: safe harbour under section 79 on due diligence, and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.
• Overriding effect (section 81), with a proviso preserving rights under the Copyright Act and the Patents Act.

2. Digital and electronic signatures

A digital signature authenticates an electronic record by an asymmetric crypto system and hash function (section 3). The subscriber has a pair of keys: a private key known only to him, with which he signs, and a public key, with which anyone can verify. The hash function converts the record into a fixed “hash result”; any alteration to the record after signing changes the hash, so tampering is detected. A digital signature therefore proves who signed and that the record has not been altered.

The 2008 amendment made the Act technology-neutral by adding the wider category of electronic signature (section 3A): any reliable authentication technique notified in the Second Schedule, such as e-sign based on Aadhaar authentication, as well as digital signatures. A signature is reliable if the signature creation data is linked to the signatory alone and under his control, and alterations are detectable.

Signatures are certified by a Certifying Authority licensed by the Controller (section 21), which issues an Electronic Signature Certificate to the subscriber (section 35).

3. The Controller of Certifying Authorities

The Central Government appoints the Controller (section 17). His functions under section 18 include: supervising Certifying Authorities; certifying their public keys; laying down standards they must maintain; specifying qualifications of their staff and conditions of their business; specifying the form and content of certificates and keys; specifying the manner of accounts; resolving conflicts between Authorities and subscribers; and maintaining a public database of their disclosure records. He may also:

• recognise foreign Certifying Authorities with the Central Government’s approval (section 19);
• grant, renew, suspend and revoke licences (sections 21 to 26);
• investigate contraventions with the powers of income-tax authorities (section 28), and have access to computers and data (section 29);
• give directions to a Certifying Authority to ensure compliance (section 68).

4. E-commerce and e-contracts

E-commerce is buying and selling goods and services over electronic networks: business-to-business, business-to-consumer, consumer-to-consumer, and government procurement. It needs legally valid electronic contracts, electronic payment and protection of consumers. In India it is governed by the IT Act, the Indian Contract Act, 1872, the Consumer Protection Act, 2019 with the Consumer Protection (E-Commerce) Rules, 2020, the Payment and Settlement Systems Act, 2007 and the foreign investment policy, which allows foreign investment in marketplace but not inventory models.

E-contracts. Section 10A provides that where the communication of proposals, acceptance and revocation is expressed in electronic form or by an electronic record, the contract shall not be deemed unenforceable solely on that ground. The ordinary rules of the Contract Act on offer, acceptance, consideration, capacity and free consent apply. The forms are:

• click-wrap contracts, accepted by clicking “I agree”;
• browse-wrap contracts, where terms are linked on a website and use is treated as acceptance (enforceability is weaker because consent is doubtful);
• shrink-wrap licences for software, accepted on opening or installing;
• contracts by e-mail exchange.

Sections 11 to 13 fix the details that would otherwise be disputed:

• Attribution (section 11). A record is attributed to the originator if sent by him, by a person authorised by him, or by an information system programmed by him to operate automatically.
• Acknowledgment (section 12). If the originator stipulated that the record is binding only on acknowledgment, it is deemed never sent until acknowledgment is received.
• Time and place (section 13). Despatch occurs when the record enters a computer resource outside the originator’s control. Receipt occurs when it enters the computer resource the addressee has designated; if it is sent to some other computer resource of his, when he retrieves it; and if he has designated none, when it enters his computer resource. A record is deemed despatched and received at the place of business of the originator and addressee respectively, which decides jurisdiction.

Proof of an e-contract in court is by electronic record. Under section 63 of the Bharatiya Sakshya Adhiniyam, 2023 (formerly section 65B of the Evidence Act), secondary electronic evidence must be accompanied by the prescribed certificate: Anvar P.V. v. P.K. Basheer, 2014 INSC 645, (2014) 10 SCC 473; Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, 2020 INSC 453, (2020) 7 SCC 1.

5. IPR provisions in the IT Act

• Section 81, proviso: nothing in the Act restricts any person from exercising any right under the Copyright Act, 1957 or the Patents Act, 1970. The IT Act thus works alongside, not in place of, IP law.
• Section 43: downloading, copying or extracting data, a database or information from a computer without permission, and stealing or destroying source code, attract compensation.
• Section 65: tampering with or concealing computer source code required to be kept by law is an offence; section 66 punishes the dishonest or fraudulent doing of the section 43 acts.
• Section 79 and the 2021 Rules: intermediaries must inform users not to host content that infringes any patent, trade mark, copyright or other proprietary right, and must act on court orders or government directions to remove such content.

6. Internet policy of the Government of India

There is no single “internet policy” document. The policy is found in a series of measures: the opening of internet service provision to private operators in 1998; the National Telecom Policy, 1999; the IT Act, 2000 and its 2008 amendment; the National e-Governance Plan (2006); the National Cyber Security Policy, 2013 and CERT-In as the national nodal agency for cyber incidents (section 70B); the Digital India programme (2015) for digital infrastructure, services and literacy; the Intermediary Guidelines and Digital Media Ethics Code Rules, 2021; the Telecommunications Act, 2023; and the Digital Personal Data Protection Act, 2023. The common aims are universal access, e-governance, a secure cyberspace, growth of the digital economy and protection of users.

How this is examined

January 2026: “Elucidate the salient features of the Information Technology Act, 2000.” February 2025: “What are the powers and functions of the Controller under the Information Technology Act, 2000?” and a note on “E-Commerce”. August 2024: a note on “digital signature”. Section 1 answers the first, section 3 the second, section 4 the note on e-commerce, and section 2 the note on digital signature (explain the key pair and the hash function in two or three sentences; that is what the examiner looks for).