Cyber Security Law in India: Cybercrime, Digital Evidence, Compliance and Legal Remedies

Cyber security has a legal as well as a technical dimension. Hacking, unauthorised access, identity theft, online impersonation, phishing, ransomware, financial fraud, data breaches and misuse of digital accounts can create questions concerning criminal liability, civil remedies, evidence, regulatory compliance and the preservation of electronic records. The legal response depends on the nature of the incident, the persons involved, the affected systems and the evidence available.

What is cyber security law?

Cyber security law refers broadly to the legal rules governing the protection and lawful use of computer resources, communication devices, networks, information systems and digital data. In India, the Information Technology Act, 2000 remains a principal statute dealing with several computer-related offences and intermediary and cyber-security obligations. Other legislation can also become relevant depending on the conduct, including the Bharatiya Nyaya Sanhita, 2023 and the Bharatiya Sakshya Adhiniyam, 2023.

Cyber incidents may therefore involve more than one legal framework. A financial cyber fraud, for example, may involve computer-related offences under the Information Technology Act as well as offences concerning cheating, personation or forgery under the general criminal law, depending on the facts.

Common types of cybercrime

Cybercrime can take many forms. Common examples include:

• unauthorised access to computer systems or accounts;
• identity theft and misuse of passwords or digital credentials;
• online cheating and personation;
• phishing and malicious links;
• UPI, banking and payment fraud;
• ransomware and other malicious software attacks;
• unauthorised extraction or disclosure of data;
• website or social-media account compromise;
• cyberstalking and unlawful online harassment;
• domain-name and online impersonation disputes; and
• misuse of confidential business information.

The legal classification depends on the actual conduct. The fact that an incident occurred online does not by itself determine the applicable offence.

Important provisions of the Information Technology Act

The Information Technology Act contains several provisions relevant to cyber incidents. Section 43 addresses specified acts involving computer resources, including unauthorised access, downloading or copying data and disruption of computer systems, and provides for compensation in the circumstances covered by the provision.

Section 66 applies where an act referred to in Section 43 is done dishonestly or fraudulently and provides criminal punishment. Sections 66C and 66D address identity theft and cheating by personation using a computer resource or communication device. Section 67 and related provisions address certain categories of unlawful publication or transmission of material in electronic form.

Section 70B recognises the Indian Computer Emergency Response Team (CERT-In) as the national agency for incident response in the cyber-security field. The Act also contains provisions concerning intermediaries, protected systems and other aspects of electronic governance and cyber regulation.

Cybercrime and the Bharatiya Nyaya Sanhita

The Bharatiya Nyaya Sanhita, 2023 came into force as part of India’s new criminal-law framework. Cybercrime does not operate in a separate legal universe: conduct committed through digital systems may also satisfy offences under the general criminal law. Depending on the facts, investigation may therefore involve provisions concerning cheating, criminal breach of trust, personation, forgery, intimidation, conspiracy or other offences.

When a cyber complaint is made, the investigating agency generally has to identify the conduct, the digital trail, the persons involved and the applicable statutory provisions. The exact sections should be determined from the facts and evidence rather than from the use of a generic label such as “cybercrime”.

Digital evidence in cybercrime cases

Digital evidence may include emails, chats, call records, device data, server logs, bank transaction records, IP information, screenshots, CCTV footage, website records, social-media material, cloud records and electronic documents. Its usefulness depends not only on what it shows but also on how it was collected, preserved and produced.

The Bharatiya Sakshya Adhiniyam, 2023 contains provisions dealing with electronic and digital records. Parties and investigators should therefore pay attention to authenticity, integrity, source, continuity and the statutory requirements governing admissibility and proof.

A screenshot can be useful evidence, but a screenshot by itself may not answer every question concerning authenticity or origin. Where possible, the underlying electronic record, relevant metadata, account information and other corroborating material should also be preserved.

What should be done immediately after a cyber incident?

1. preserve the available electronic evidence without unnecessary alteration;
2. record the date, time and circumstances of the incident;
3. secure compromised accounts and change credentials where appropriate;
4. contact the relevant bank or payment service immediately in financial-fraud cases;
5. preserve transaction references, messages, phone numbers, email addresses and URLs;
6. avoid deleting potentially relevant chats, logs or files;
7. identify affected devices, accounts and systems;
8. consider whether internal incident-response and forensic assistance is required; and
9. make the appropriate complaint to the competent law-enforcement or cybercrime authority.

In a serious business incident, preservation should be coordinated so that remediation does not unnecessarily destroy evidence relevant to a later investigation or dispute.

Cyber fraud involving bank accounts and digital payments

Financial cyber fraud requires prompt action because funds may move through multiple accounts in a short period. Relevant records can include bank statements, transaction IDs, UTR numbers, beneficiary details, payment screenshots, communications with the fraudster and records of complaints made to the bank or authorities.

A person or business affected by fraud should preserve the complete transaction trail rather than relying only on screenshots. The legal response may involve banking channels, law-enforcement proceedings and, depending on the circumstances, applications before a competent court concerning disputed or frozen funds.

Digital arrest scams and impersonation

“Digital arrest” scams commonly involve impersonation of police, courts, regulators or other authorities through telephone or video communication. Victims may be threatened with arrest, account freezing or other consequences and pressured into transferring money or disclosing information.

The Supreme Court has taken cognisance of a “digital arrest” fraud matter in In Re: Victims of Digital Arrest Related to Forged Documents. In an order dated 17 October 2025, the Court recorded allegations involving forged judicial and government documents and substantial transfers made under threats. In a subsequent order dated 1 December 2025, the Court directed intermediaries to preserve specified data relating to mobile phones reportedly used in the cybercrimes. The proceedings illustrate the importance of preserving digital evidence and coordinating investigation across relevant authorities.

Cyber security obligations for businesses

Businesses should treat cyber security as part of legal and operational risk management. Depending on the organisation and sector, relevant measures may include access controls, password management, multi-factor authentication, vulnerability assessment, incident response, backup systems, vendor controls, employee training and documented security procedures.

CERT-In has continued to publish cyber-security guidance and sector-specific material. Its 2025-26 annual report records publications covering smart-city infrastructure, software and bill-of-materials security, cyber defence controls for MSMEs, cyber-security audits, ransomware and security practices for generative-AI solutions.

CERT-In directions and incident reporting

Entities covered by applicable CERT-In requirements should assess whether a cyber incident triggers reporting or record-retention obligations. The applicable directions and sector-specific requirements should be reviewed according to the organisation’s activities and the nature of the incident.

Cyber security compliance should not be treated as a one-time exercise. Businesses should maintain appropriate records, review access privileges, test incident-response arrangements and periodically assess whether contracts and technical controls remain suitable for their operations.

Data breaches and privacy

A cyber security incident may also become a data-protection issue where personal data is compromised. The legal assessment can involve the Digital Personal Data Protection Act, 2023 and applicable rules and commencement provisions, in addition to contractual, sectoral and other legal requirements.

Organisations should identify what data was affected, whose data was involved, how the incident occurred, what containment measures were taken and whether any notification or other statutory response is required. The applicable legal position should be checked as of the date of the incident because data-protection obligations and their commencement can depend on the relevant provisions.

Cyber security and employee misconduct

Employees, former employees, contractors and vendors may have access to business systems and confidential information. Unauthorised copying, deletion, disclosure or use of business data can raise employment, contractual, civil and criminal questions.

Businesses should maintain clear policies concerning acceptable use, access rights, confidential information, company devices, password management and exit procedures. When an employee leaves, access should be reviewed promptly and company data and devices should be returned in accordance with the applicable contract and policy.

Cyber security contracts and vendor risk

Outsourcing IT functions can create additional legal risks. Agreements with technology vendors, cloud providers, software developers and managed service providers should address confidentiality, security responsibilities, access, incident reporting, data handling, subcontracting, audit rights, preservation of records and termination arrangements where appropriate.

The allocation of responsibility should be practical. A contract that merely states that a vendor will “maintain security” may not adequately define what security measures, reporting timelines or cooperation obligations apply after an incident.

Website, domain and social-media security

Compromise of a website, domain account or social-media profile can create both cyber-security and intellectual-property consequences. An attacker may redirect visitors, impersonate a business, publish fraudulent material or use a brand to deceive customers.

Relevant evidence may include domain-registration records, account logs, screenshots, DNS information, emails, hosting records, payment records and communications with service providers. Where a trademark is involved, the dispute may additionally raise issues under trademark and passing-off law.

Ransomware and business interruption

Ransomware can affect business continuity, data availability and confidential information. An incident-response plan should address isolation of affected systems, preservation of forensic evidence, restoration from verified backups, communication with stakeholders and assessment of legal reporting obligations.

Payment of a demanded amount does not itself resolve every legal or technical issue. The circumstances, applicable law, sanctions or regulatory considerations, insurance arrangements and prospects of recovery should be assessed before significant decisions are taken.

Cybercrime investigation and preservation of evidence

Cyber investigations often depend upon records held by different persons or organisations, including banks, telecom operators, platforms, intermediaries, hosting providers and device users. Delay can create practical difficulties because logs or other information may have limited retention periods or may become harder to retrieve.

The Supreme Court’s digital-arrest proceedings demonstrate the importance placed on preservation of relevant intermediary data in appropriate cybercrime investigations. Preservation, however, does not automatically establish guilt or liability; the evidence must still be evaluated under the applicable law.

Civil remedies in cyber disputes

Not every cyber dispute is purely criminal. Depending on the facts, civil remedies may include injunctions, damages, contractual relief, protection of confidential information, recovery of property or other appropriate orders. A business may also need to address intellectual-property infringement, breach of confidentiality or misuse of personal data.

The appropriate forum and remedy depend upon the legal right involved, jurisdiction, limitation, evidence and the relief sought.

Cyber security compliance checklist for businesses

• Maintain an inventory of important information systems and data.
• Use strong authentication and appropriate access controls.
• Apply the principle of least privilege where practical.
• Maintain reliable and tested backups.
• Keep systems and software appropriately updated.
• Conduct vulnerability assessments and security reviews where appropriate.
• Train employees to identify phishing and social-engineering attacks.
• Maintain an incident-response procedure.
• Identify relevant reporting and record-retention obligations.
• Review cyber-security provisions in vendor and employment contracts.
• Preserve evidence after a significant incident.
• Periodically review business continuity and recovery arrangements.

Common mistakes after a cyber incident

• Deleting messages or files because they appear suspicious.
• Resetting or formatting a device before preserving relevant evidence.
• Failing to notify a bank promptly after payment fraud.
• Relying only on screenshots without preserving underlying records.
• Ignoring compromised email or cloud accounts after changing one password.
• Failing to record transaction and communication details.
• Assuming that every online dispute is governed only by the Information Technology Act.
• Ignoring contractual or data-protection consequences of a security incident.
• Failing to document internal investigation and containment steps.
• Waiting unnecessarily before making a complaint where immediate action may assist recovery or preservation.

When legal advice may become relevant

Legal assessment may become relevant where a cyber incident causes financial loss, involves confidential or personal data, affects a business system, involves an employee or vendor, creates an intellectual-property dispute, requires preservation of evidence, or results in criminal proceedings. The appropriate response should be based on the facts rather than on a standard template.

Documents and information that may be useful

Depending on the matter, useful material may include identity documents, bank statements, transaction records, UTR numbers, emails, chats, call details, screenshots, URLs, device information, login alerts, server logs, contracts, employment records, incident reports, forensic reports, correspondence with banks or platforms and copies of complaints or FIRs.

Frequently Asked Questions

1. What is cyber security law in India?

It is the collection of laws and legal obligations dealing with computer resources, digital systems, cyber offences, electronic evidence, security obligations and related civil or regulatory issues.

2. Which main statute deals with cybercrime in India?

The Information Technology Act, 2000 is a principal statute for several computer-related offences and cyber-law matters. Other criminal, evidentiary, contractual, data-protection and sector-specific laws may also apply.

3. What is identity theft under the IT Act?

Section 66C addresses fraudulent or dishonest use of another person’s electronic signature, password or other unique identification feature, subject to the statutory requirements.

4. What is online cheating by personation?

Section 66D addresses cheating by personation using a computer resource or communication device. The facts must be examined to determine whether its statutory ingredients are satisfied.

5. What should I do immediately after online banking fraud?

Preserve transaction details and communications, contact the bank or payment provider promptly, make the appropriate cybercrime complaint and preserve all available electronic evidence.

6. Can WhatsApp messages be used as evidence?

Electronic messages can be relevant evidence. Their admissibility and evidentiary value depend on authenticity, integrity, source and the requirements applicable to electronic records.

7. Should I format a hacked phone before giving it to investigators?

Unnecessary formatting can destroy potentially relevant evidence. Preservation and forensic handling should be considered before altering or wiping a device.

8. What is a digital arrest scam?

It is a fraud scheme in which persons impersonate authorities and use threats of arrest or legal action to pressure victims into transferring money or disclosing information.

9. Can a company be legally responsible after a data breach?

The answer depends on the applicable statute, contracts, sectoral requirements, security practices, circumstances of the breach and other facts. A breach should be assessed promptly rather than assuming liability or no liability automatically.

10. What is CERT-In?

CERT-In is the national agency recognised under Section 70B of the Information Technology Act for functions relating to cyber-security incident response.

11. Are cybercrime cases always filed under the IT Act?

No. Depending on the conduct, provisions of the Bharatiya Nyaya Sanhita and other laws may apply alongside or independently of the Information Technology Act.

12. Can a cybercrime victim seek recovery of money?

Recovery depends on the movement of funds, timely reporting, investigation, tracing, freezing or attachment measures where legally available and subsequent court or authority proceedings. Recovery is not automatic.

13. Can an employee’s unauthorised access create criminal liability?

Potentially, depending on the access, authorisation, intention, conduct and applicable statutory provisions. Employment contracts and company policies may also become relevant.

14. What evidence should a business preserve after hacking?

Relevant material may include logs, emails, alerts, screenshots, device images, account records, IP information, transaction records, communications, contracts and incident-response records.

15. Does cyber security involve only technical protection?

No. Technical controls are important, but legal compliance, contracts, policies, evidence preservation, incident reporting and governance can also be significant.

16. Can a website hack also become a trademark dispute?

Yes. If a compromised website or domain is used to impersonate a business or misuse its mark, trademark, passing-off or other intellectual-property issues may arise in addition to cybercrime issues.

17. What should a company include in a cyber-security vendor contract?

Depending on the services, the contract may address security controls, confidentiality, access, incident reporting, data handling, audit rights, subcontractors, cooperation and termination arrangements.

18. Can a cyber dispute be resolved through civil proceedings?

Yes. Depending on the facts, civil remedies such as injunctions, damages, contractual relief or protection of confidential information may be available in addition to criminal remedies.

19. Why is early evidence preservation important?

Digital records may be overwritten, deleted, altered or become difficult to obtain. Early preservation can assist investigation and later proceedings, subject to the applicable legal and technical process.

20. Is every suspicious online activity a cyber offence?

No. Legal liability depends on the specific conduct and statutory ingredients. Suspicious activity should be investigated and documented before drawing legal conclusions.

Key takeaways

Cyber security in India involves a combination of technology, criminal law, electronic evidence, contracts, data protection and sector-specific requirements. The Information Technology Act, 2000 remains an important part of the framework, while the Bharatiya Nyaya Sanhita, 2023 and Bharatiya Sakshya Adhiniyam, 2023 are relevant to criminal liability and electronic evidence in appropriate cases. Prompt preservation of evidence, timely reporting, appropriate technical containment and careful legal assessment can be important after a cyber incident.

Important Disclaimer

This article is provided solely for general legal information and public awareness. It is not legal advice, legal opinion, or a legal solution to any specific facts or circumstances. Laws and their interpretation may change, and the application of law depends upon the facts of each individual matter. Readers should not rely upon this article as a substitute for obtaining appropriate legal advice concerning their specific circumstances. Nothing contained in this article creates, establishes or constitutes an advocate-client relationship between the reader and Trident Legal Services, Advocate Nikhil Rathod, or any other person associated with the publication.