Foreign researchers, students, and businesses dealing with Indian cyberlaw usually start from the Information Technology Act, 2000, and quickly discover it has been substantially reshaped by both amendment and the new criminal codes that took effect in 2024.
The IT Act’s core structure
The IT Act, 2000 (amended significantly in 2008) gives legal recognition to electronic records and digital signatures, criminalises offences like hacking, identity theft, and publishing obscene material electronically, and, in Section 79, provides a conditional “safe harbour” for intermediaries (platforms hosting third-party content) similar in spirit to Section 230 of the US Communications Decency Act, though narrower in scope and subject to specific due-diligence rules under the Intermediary Guidelines.
Interaction with the new criminal codes
Since the Bharatiya Nyaya Sanhita (BNS), Bharatiya Nagarik Suraksha Sanhita (BNSS), and Bharatiya Sakshya Adhiniyam (BSA) came into force in 2024, several conventional offences committed online (cheating, defamation, extortion) are prosecuted under the BNS rather than the IT Act, with the IT Act now functioning more narrowly around offences specific to computer systems and electronic evidence rules, a division foreign readers should map carefully rather than assume all “cybercrime” sits in one statute.
Data protection overlay
The Digital Personal Data Protection Act, 2023 (DPDP Act) now runs alongside the IT Act for anything involving personal data breaches, creating a two-statute landscape (IT Act for computer-related offences generally, DPDP Act for personal-data-specific obligations) that researchers comparing India’s cyberlaw architecture to the EU’s more consolidated GDPR-plus-NIS2 model often flag as a key structural difference.
Enforcement bodies
CERT-In (Indian Computer Emergency Response Team) handles cybersecurity incident reporting and directions, while cybercrime complaints are filed through the National Cyber Crime Reporting Portal, a relatively centralised complaint channel compared to some jurisdictions’ more fragmented reporting systems.
Lexfolio’s DPDP Act guide and Deepfakes and AI Scams course cover the data-protection and emerging-threats side of this framework in more depth.