The Information Technology Act, 2000 and its amendments: intermediaries, the IT Rules 2021 and the DPDP Act 2023

Law of Intellectual Property and Information Technology · Unit IV · Topic 9 of 12 · 7 min read

The scheme of the IT Act and the 2008 amendment, section 79 safe harbour after Shreya Singhal, Digumarti, Visakha and MySpace, the IT Rules 2021 and their later amendments, electronic evidence under the BSA, and the Digital Personal Data Protection Act 2023 with the DPDP Rules 2025, all read for their bearing on IP enforcement online.

← All Law of Intellectual Property and Information Technology topics

On this page

1. The Act in outline
2. Provisions protecting software and data
3. Section 79: safe harbour
4. The IT Rules, 2021 and their amendments
5. Electronic evidence
6. The Digital Personal Data Protection Act, 2023
How this is examined

Cases checked to exist. Read the judgment before quoting a holding.

Every case cited here has been checked to exist — the citation resolves and names the right parties. The propositions attributed to each case have not been verified line by line against the judgment. Case names link through to the full judgment: read it before quoting a holding in an examination answer, and never carry a proposition from notes into court on trust.

The examinable core. The syllabus asks for the protection available under the IT Act “and amendment till date”. For IP purposes three things matter: the computer-misuse provisions that protect software and data (sections 43, 65, 66), the safe harbour in section 79 that decides when a platform answers for infringing content, and the Rules that set the platform’s duties. Data protection, now under the Digital Personal Data Protection Act, 2023, governs databases of personal data and is the latest change to the IT Act itself, because it omits section 43A.

1. The Act in outline

The Information Technology Act, 2000 was modelled on the UNCITRAL Model Law on Electronic Commerce (1996) and came into force on 17 October 2000. Its original purpose was e-commerce: legal recognition of electronic records (section 4) and digital signatures (section 3), secure electronic records, certifying authorities, and a limited set of penalties and offences.

The Information Technology (Amendment) Act, 2008, in force from 27 October 2009, changed it substantially:

“Electronic signature” replaced the technology-specific digital signature (section 3A).
Section 10A validated contracts formed by electronic means.
Section 43A made a body corporate liable to compensate for negligence in protecting sensitive personal data, with the SPDI Rules, 2011 under it.
Section 66 was recast as the offence corresponding to section 43; new offences were added (sections 66B to 66F, 67A, 67B), including identity theft, cheating by personation and cyber terrorism.
Section 69A empowered the Central Government to block public access to information, with the Blocking Rules, 2009.
Section 79 was rewritten as a general safe harbour, and section 81 received the proviso preserving rights under the Copyright Act and the Patents Act.

2. Provisions protecting software and data

Section 43: compensation where a person without permission accesses a computer system, downloads, copies or extracts data or programmes, introduces a virus, damages or disrupts it, denies access, or steals, conceals or alters source code to cause damage.
Section 65: tampering with computer source documents required to be kept by law.
Section 66: doing a section 43 act dishonestly or fraudulently.
Section 72A: disclosure of personal information in breach of a lawful contract.

Section 66A, on offensive messages, was struck down in Shreya Singhal v. Union of India, 2015 INSC 257, as vague and overbroad. The same case upheld section 69A and the Blocking Rules because of their procedural safeguards.

3. Section 79: safe harbour

An intermediary is not liable for third-party information hosted or transmitted by it (section 79(1)) if (section 79(2)) its function is limited to providing access to a communication system, it does not initiate the transmission, select the receiver or select or modify the information, and it observes due diligence and the government’s guidelines. The protection is lost (section 79(3)) if it conspired, abetted, aided or induced the unlawful act, or if on receiving actual knowledge or on being notified by the government it fails to remove or disable access expeditiously.

Shreya Singhal (2015) read “actual knowledge” in section 79(3)(b) as knowledge through a court order or a government notification, so that intermediaries are not made judges of legality of private complaints.
Super Cassettes v. MySpace (Delhi High Court Division Bench, 2016) held that section 79 applies to copyright despite the section 81 proviso, but that for copyright the Shreya Singhal reading should not be applied mechanically: a specific notice from the right holder identifying the infringing content gives actual knowledge.
Sharat Babu Digumarti v. Govt. of NCT of Delhi, 2016 INSC 1131: where the IT Act specifically deals with an act (obscene electronic content under section 67), its provisions, including section 79, prevail, given section 81.
Google India v. Visakha Industries, 2019 INSC 1352: before the 2009 amendment, section 79 protected intermediaries only against offences under the IT Act itself, so it gave no defence to a criminal defamation complaint for that period.
Active intermediaries: Christian Louboutin v. Nakul Bajaj (Delhi High Court, 2018) and Google v. DRS Logistics (Delhi High Court Division Bench, 2023) deny the harbour to platforms that take an active part in the infringing activity.

4. The IT Rules, 2021 and their amendments

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 replaced the Intermediaries Guidelines of 2011.

Due diligence (rule 3): publish rules and a privacy policy; make reasonable efforts to cause users not to host content that, among other things, infringes any patent, trade mark, copyright or other proprietary right; remove content on a court order or government notification within 36 hours; appoint a grievance officer who must acknowledge complaints within 24 hours and resolve them within 15 days.
Significant social media intermediaries (rule 4), those above the notified user threshold, must appoint a chief compliance officer, a nodal contact person and a resident grievance officer in India, publish compliance reports, and, for messaging services, enable identification of the first originator of a message on a court or government order. That traceability rule is under challenge.
Digital media ethics code (Part III) for news and online curated content publishers. Parts of it were stayed by High Courts in 2021.
2022 amendment: Grievance Appellate Committees, to which users can appeal from an intermediary’s grievance decision; and stronger obligations to ensure compliance.
2023 amendment: rules for online gaming intermediaries and a government fact check unit. The fact check provision was held unconstitutional by the Bombay High Court in Kunal Kamra v. Union of India (2024).
2025 amendment: tightened who may send government takedown intimations and required them to be reasoned and reviewed.

5. Electronic evidence

Infringement online is proved by screenshots, server logs and downloads. Section 65B of the Evidence Act required a certificate for secondary electronic evidence (Anvar P.V. v. P.K. Basheer, 2014 INSC 645; Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, 2020 INSC 453). From 1 July 2024 the Bharatiya Sakshya Adhiniyam, 2023 carries the rule forward in section 63, with a prescribed form of certificate.

6. The Digital Personal Data Protection Act, 2023

After Justice K.S. Puttaswamy v. Union of India, 2017 INSC 801, recognised privacy as a fundamental right, Parliament enacted the DPDP Act, 2023.

Scope: digital personal data processed in India, and processing outside India in connection with offering goods or services to persons in India. Personal data made publicly available by the data principal is outside the Act, which matters for web scraping and AI training.
Grounds: consent that is free, specific, informed, unconditional and unambiguous, preceded by notice; or specified “legitimate uses”.
Duties of data fiduciaries: accuracy, reasonable security safeguards, breach intimation to the Data Protection Board and affected persons, erasure when the purpose is served; verifiable parental consent for children and no tracking or targeted advertising to them; additional duties for significant data fiduciaries.
Rights of data principals: information, correction and erasure, grievance redressal and nomination.
Enforcement: the Data Protection Board of India, with monetary penalties up to two hundred and fifty crore rupees for the gravest breaches and appeals to the TDSAT. No compensation is payable to the individual, unlike section 43A.
Amendments to other law: the Act omits section 43A of the IT Act and amends section 8(1)(j) of the RTI Act.

The DPDP Rules, 2025 were notified in November 2025 with phased commencement: the Board first, consent managers after about a year, and the main duties of data fiduciaries after about eighteen months. They prescribe the form of notice, security safeguards, the procedure for breach reporting, methods of verifiable parental consent and the obligations of significant data fiduciaries. Until the provisions on fiduciaries’ duties take effect, section 43A and the SPDI Rules remain the operative regime.

Why data protection belongs in an IP paper. Databases of customers and users are among the most valuable assets of an IT business and are protected by copyright only if original and by confidence if secret. Data protection law does not give the database owner a property right; it gives the individual rights against the owner. The two regimes pull in opposite directions: IP encourages control and exploitation of data collections, data protection limits them. This is the link to the next note on databases.

How this is examined

Likely long questions: “Discuss the liability of intermediaries under section 79 of the IT Act, 2000 with reference to infringement of IP rights.” “Examine the salient features of the IT Act, 2000 and its amendments in relation to protection of intellectual property.” “Critically examine the IT Rules, 2021.”

Likely short notes: safe harbour; significant social media intermediary; Grievance Appellate Committee; section 65 of the IT Act; Data Protection Board; Shreya Singhal on section 79.