Why Cyber Law Training Matters for Officers and Institutions

Cyber law training matters for officers because most cyber incidents in offices and institutions are now legal events with fixed deadlines and personal consequences: a 6-hour CERT-In report (non-compliance punishable with up to 1 year, or fine up to ₹1 lakh, or both), DPDP penalties up to ₹250 crore from 13 May 2027, deemed liability of persons in charge under s.85 of the IT Act, and up to 1 year for a head of institution who fails to report child sexual abuse under POCSO s.21(2). Training is also evidence: a record that the institution exercised due diligence before anything went wrong.

The risk map: five things an institution can lose

1. Money. A vendor’s “new” bank account, a gift card request in the Director’s name, a staff member held on a fake “digital arrest” video call. In a written reply in the Rajya Sabha on 12 March 2025, the Ministry of Home Affairs reported that amounts lost to digital arrest and related cyber crimes rose from about ₹91 crore in 2022 to about ₹1,935 crore in 2024.
2. Reputation. A forged office order goes viral; a look-alike admission website collects fees.
3. Students and children. Sextortion of a hostel resident, harassment through fake profiles, a minor student exploited online.
4. Systems. Ransomware locks the administrative server. In November 2022, the e-Hospital system of AIIMS, New Delhi was compromised and registration had to be run largely by hand for about two weeks.
5. Data. A hostel spreadsheet set to “anyone with the link” is forwarded beyond the group. Nobody hacked anything.

Each has a legal consequence most officers were never taught.

What non-compliance actually costs

• Missing the CERT-In window. The CERT-In Directions of 28 April 2022 require service providers, intermediaries, data centres, body corporates and government organisations to report listed incidents within 6 hours and keep logs for 180 days. Failure is punishable under s.70B(7).
• Negligent data handling. Until 13 May 2027, a body corporate handling sensitive personal data negligently pays compensation under s.43A, with claims up to ₹5 crore before the Adjudicating Officer. After that, the Data Protection Board can impose penalties up to ₹250 crore.
• Personal exposure under s.85. Where a company (including any body corporate, firm or association of individuals) commits an offence under the IT Act, every person in charge of and responsible for its business is deemed guilty, unless he proves the offence was committed without his knowledge or that he exercised all due diligence. Officers through whose consent, connivance or neglect it happened are also liable.
• Failure to report child abuse. POCSO s.19 obliges any person to report to the police or SJPU; s.21 punishes failure, with a higher exposure for the head of an institution.
• Paying twice. Payment to an impostor does not ordinarily discharge the debt to the real vendor.

Why training is documented due diligence

Section 85 recognises due diligence as a defence, and due diligence is what is on file. A court or regulator will ask: Was there a written incident procedure? A standing instruction on messaging-app payment requests? Security clauses in vendor contracts? Were officers trained?

The Baazee.com episode shows what is at stake. In December 2004, the CEO of an online auction site was arrested under s.67 of the IT Act over a clip a user had listed, and the case under s.67 read with s.85 ran until the Supreme Court’s 2012 ruling in Aneeta Hada v. Godfather Travels and Tours ended it on a technical point. The lesson: persons in charge must be ready to show diligence, and training records are among the simplest evidence of it.

Who should be trained

• Heads of offices, registrars, principals and directors: s.85 and POCSO s.21(2) speak to them directly.
• Accounts and finance staff: vendor bank-change fraud and impersonation target them.
• IT cells and nodal officers: CERT-In reporting, logs, ransomware response.
• HR and administrative officers: staff data, vendor contracts, POSH overlaps.
• Wardens, mentors and counsellors: sextortion, POCSO reporting, student confidentiality.
• Front-office and section staff: they receive the first phishing email.

What a good course should cover

1. The legal map: IT Act, BNS, BNSS, BSA and the DPDP Act, and how they fit together.
2. The main offences in institutional frauds: ss.66C, 66D and 72A of the IT Act, BNS cheating, extortion and forgery.
3. Fraud patterns: digital arrest, phishing, look-alike domains, vendor bank-change fraud, head-of-institution impersonation.
4. Content harms and the removal route under the IT Rules.
5. Student protection: the warden’s response to sextortion and mandatory POCSO reporting.
6. Systems and data: CERT-In 6 hours, 180-day logs, data leaks, the DPDP Act from 13 May 2027, s.85.
7. Evidence: preserving electronic records and the BSA s.63 certificate.
8. A toolkit: a standing instruction, a bank-change clause, an incident procedure and a warden’s checklist.

The Lexfolio course covers each of these in 18 lessons with situations drawn from offices and campuses. It is a certificate of completion issued by Lexfolio, not a degree, diploma or professional qualification, but it gives each officer a verifiable record that they were trained.

Frequently asked questions

Is cyber law training legally compulsory?

No general law names a training requirement for all officers. But the law punishes failures that training prevents, and s.85 makes due diligence a defence, so training is the cheapest form of protection.

Does the DPDP Act apply to government offices?

Yes, from 13 May 2027, unless a body or purpose is specifically exempted.

How should training be recorded?

Keep an office order directing it, a list of who completed it with dates, and copies of the certificates. Repeat it for new staff.

Quick quiz

Enrol your officers: Cyber Crime Law for Offices and Institutions, ₹599. See all courses at Certificate courses.

Sources

• Information Technology Act, 2000: ss.43A, 46, 66C, 66D, 67, 70B(6), 70B(7), 72A, 85
• CERT-In Directions under s.70B(6), dated 28 April 2022
• Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025
• Protection of Children from Sexual Offences Act, 2012: ss.19, 21
• Bharatiya Sakshya Adhiniyam, 2023: s.63
• Aneeta Hada v. Godfather Travels and Tours, (2012) 5 SCC 661
• Ministry of Home Affairs, written reply in the Rajya Sabha, 12 March 2025

This page is for education and general information, not legal advice for a specific case. Law as on 29 October 2026.