Section 85 IT Act: Personal Liability of Officers When an Institution Commits a Cyber Offence

Section 85 of the Information Technology Act, 2000 says that when a company commits a contravention or offence under the Act, or under any rule, direction or order made under it, every person who was “in charge of, and was responsible to” the company for the conduct of its business at that time is deemed guilty along with the company. That person escapes only by proving the contravention happened without their knowledge, or that they “exercised all due diligence to prevent” it. In practice, that defence is won or lost on what is already on the file: policies, training records, contracts and reports made on time.

What Section 85 actually says

Section 85 is a deeming provision. It asks whether the person was in charge of, and responsible to, the organisation for its business when the contravention happened. If yes, the burden shifts to the officer.

Sub-section (2) adds a second limb: any director, manager, secretary or other officer is liable if it is proved that the contravention happened with their consent or connivance, or is “attributable to any neglect” on their part. Here the prosecution must prove it.

Section 85 is also wider than most officers assume: it covers contraventions of rules, directions and orders under the Act, not just the main offences. Failing to follow the CERT-In Directions of 28 April 2022 (6-hour reporting, 180-day logs) is punishable under s.70B(7) with up to 1 year, or fine up to ₹1 lakh, or both, and s.85 can carry that exposure to the persons in charge.

Baazee.com and Aneeta Hada: the case every officer should know

In late 2004, a user listed an obscene video clip involving two Delhi schoolchildren for sale on Baazee.com, then a large auction website. Its chief executive, Avnish Bajaj, did not list it. Even so, he was arrested in December 2004 and proceeded against under s.67 of the IT Act read with s.85. In 2008 the Delhi High Court dropped the IPC charges but held that a prima facie case under s.67 read with s.85 survived.

The matter ended only in 2012. In Aneeta Hada v. Godfather Travels and Tours, (2012) 5 SCC 661, a three-judge bench of the Supreme Court held that where a statute makes officers liable for an offence by a company, the officers cannot be prosecuted unless the company itself is arraigned as an accused. The appeal arising from the Baazee.com prosecution was decided with it, and the case against him was quashed on that ground.

The lesson is not the technical point that saved him. It is that a senior officer spent close to eight years as an accused for content he never touched. The officer who can produce a file showing diligence is far stronger from day one.

Does Section 85 apply to government offices, universities and colleges?

The Explanation to s.85 defines “company” as “any body corporate” and says it “includes a firm or other association of individuals”. Whether a particular institution falls within that definition depends on how it is constituted:

• PSUs and private companies registered under company law are bodies corporate. Section 85 applies directly.
• Statutory corporations and many universities are made bodies corporate by their own Acts; whether s.85 reaches their officers turns on that Act and the facts.
• Private colleges, schools and hospitals run by societies or trusts: whether they are an “association of individuals” depends on the facts and governing documents.
• A government department as such is usually not a body corporate. Whether s.85 can reach its officers depends on the facts. Officers can still face direct liability for their own acts.

So for a government office, s.85 may or may not apply on the facts. The duties behind it apply anyway. The CERT-In Directions expressly cover government organisations, and the Digital Personal Data Protection Act, 2023 will apply to government bodies as Data Fiduciaries from 13 May 2027 unless they are specifically exempted. Documented diligence protects the officer in every setting.

What “due diligence on file” looks like

Due diligence is paper (or its digital equivalent) created before the incident. A registrar in Lucknow should be able to produce, within an hour:

1. A written cyber security policy approved by the competent authority, with the date of approval.
2. An office order naming a nodal officer for cyber incidents and the CERT-In point of contact.
3. A written incident procedure: isolate, preserve logs, report to CERT-In within 6 hours, restore.
4. Proof that logs are kept for 180 days within India, as the CERT-In Directions require.
5. A standing instruction that no financial request received only on a messaging app will be acted upon.
6. A vendor bank-change rule: signed request plus a call-back on the number already on file.
7. Vendor contracts with confidentiality, security and breach-notification clauses.
8. Training attendance sheets and the content used, with dates.
9. Incident records and backup-restore test notes, with dates.

Frequently asked questions

Can a director be prosecuted under s.85 without the company being made an accused?

No. Under Aneeta Hada (2012), the company must be arraigned for officers to be prosecuted under a vicarious liability provision of this kind.

Does s.85 cover breach of the CERT-In Directions?

Yes, where the contravention is by a company: s.85 covers contraventions of directions under the Act, and non-compliance with CERT-In directions is punishable under s.70B(7).

Is a government department a “company” under s.85?

Not automatically; it depends on the facts. The CERT-In and DPDP duties apply regardless.

Will a training certificate protect an officer?

It is one useful piece of the diligence file. It is a certificate of completion, not a legal immunity or a professional qualification.

Quick quiz

For a structured course on these duties for officers, see Cyber Crime Law for Offices and Institutions, ₹599.

Sources

• Information Technology Act, 2000: ss.67, 70B(6), 70B(7), 72A, 85
• CERT-In Directions under s.70B(6), dated 28 April 2022
• Aneeta Hada v. Godfather Travels and Tours Pvt Ltd, (2012) 5 SCC 661
• Avnish Bajaj v. State (NCT of Delhi), Delhi High Court, 2008
• Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025

This page is for education and general information, not legal advice for a specific case. Law as on 29 October 2026.