Section 1. The word "then" omitted by notification No. S.O. 1015(E) (w.e.f. 19-9-2002)

CHAPTER XIII MISCELLANEOUS 80. Power of police officer and other officers to enter, search, etc. 81. Act to have overriding effect. - 81A. Application of the Act to electronic cheque and truncated cheque. 82. Chairperson, Members, officers and employees to be public servants. 83. Power to give directions. SECTIONS 84. Protection of action taken in good faith. - 84A. Modes or methods for encryption. - 84B. Punishment for abetment of offences. - 84C. Punishment for attempt to commit offences. 85. Offences by companies. 86. Removal of difficulties. 87. Power of Central Government to make rules. 88. Constitution of Advisory Committee. 89. Power of Controller to make regulations. 90. Power of State Government to make rules. 91. [ Omitted ]. 92. [ Omitted ]. 93. [ Omitted ]. 94. [ Omitted ]. THE FIRST SCHEDULE. THE SECOND SCHEDULE. THE THIRD SCHEDULE. [ Omitted. ] CHAPTER IX 5[PENALTIES, COMPENSATION AND ADJUDICATION] 43.[6] [Penalty and compensation] for damage to computer, computer system, etc. -If any person without permission of the owner or any other person who is in charge of a computer, computer system or computer network,- (a) accesses or secures access to such computer, computer system or computer network 7[or computer resource]; 1. The word "then" omitted by notification No. S.O. 1015(E) (w.e.f. 19-9-2002). 2. Subs. ibid., for "the key" (w.e.f. 19-9-2002). 3. Ins. by Act 10 of 2009, s. 19 (w.e.f. 27-10-2009). 4. The words "to a person not authorised to affix the digital signature of the subscriber" omitted by notification No. S.O.1015(E) (w.e.f. 19-9-2002). 5. Subs. by Act 10 of 2009, s. 20, for "PENALTIES AND ADJUDICATION" (w.e.f. 27-10-2009). 6. Subs. by s. 21, ibid ., for "Penalty" (w.e.f. 27-10-2009). 7. Ins. by s. 21, ibid. (w.e.f. 27-10-2009). (b) downloads, copies or extracts any data, computer data base or information from such computer, computer system or computer network including information or data held or stored in any removable storage medium; (c) introduces or causes to be introduced any computer contaminant or computer virus into any computer, computer system or computer network; (d) damages or causes to be damaged any computer, computer system or computer network, data, computer data base or any other programmes residing in such computer, computer system or computer network; (e) disrupts or causes disruption of any computer, computer system or computer network; (f) denies or causes the denial of access to any person authorised to access any computer, computer system or computer network by any means; (g) provides any assistance to any person to facilitate access to a computer, computer system or computer network in contravention of the provisions of this Act, rules or regulations made thereunder; (h) charges the services availed of by a person to the account of another person by tampering with or manipulating any computer, computer system, or computer network; 1[(i) destroys, deletes or alters any information residing in a computer resource or diminishes its value or utility or affects it injuriously by any means; (j) steal, conceal, destroys or alters or causes any person to steal, conceal, destroy or alter any computer source code used for a computer resource with an intention to cause damage;] 2[he shall be liable to pay damages by way of compensation to the person so affected.] Explanation .-For the purposes of this section,- (i) "computer contaminant" means any set of computer instructions that are designed- CHAPTER 1 ==> picture [67 x 13] intentionally omitted <== 1. Short title, extent, commencement and application.- (1) This Act may be called the Information Technology Act, 2000. (2) It shall extend to the whole of India and, save as otherwise provided in this Act, it applies also to any offence or contravention thereunder committed outside India by any person. (3) It shall come into force on such date[1] as the Central Government may, by notification, appoint and different dates may be appointed for different provisions of this Act and any reference in any such provision to the commencement of this Act shall be construed as a reference to the commencement of that provision. 2[(4) Nothing in this Act shall apply to documents or transactions specified in the First Schedule: Provided that the Central Government may, by notification in the Official Gazette, amend the First Schedule by way of addition or deletion of entries thereto. (5) Every notification issued under sub-section (4) shall be laid before each House of Parliament.] (ob) the reasonable security practices and procedures and sensitive personal data or information under section 43A;] (p) the manner in which the adjudicating officer shall hold inquiry under sub-section (1) of section 46; (q) the qualification and experience which the adjudicating officer shall possess under sub-section (3) of section 46; 1. Subs. by Act 10 of 2009, s. 46, for clause (a) (w.e.f. 27-10-2009). 2. Ins. by s. 46, ibid. (w.e.f. 27-10-2009). 3. Subs. by s. 2, ibid. , for "digital signature" (w.e.f. 27-10-2009). 4. Subs. by s. 46, ibid., for clause (e) (w.e.f. 27-10-2009). 5. Subs. by s. 46, ibid., for "and Assistant Controllers" (w.e.f. 27-10-2009). 6. Clause (g) omitted by s. 46, ibid. (w.e.f. 27-10-2009). 1* * * * (u) the form in which appeal may be filed and the fee thereof under sub-section (3) of section 57; (v) any other power of a civil court required to be prescribed under clause (g) of sub-section (2) of section 58; and 2 3 [(w) the powers and functions of the Chairperson of the [Appellate Tribunal] under section 52A; (x) the information, duration, manner and form of such information to be retained and preserved under section 67C; (y) the procedures and safeguards for interception, monitoring or decryption under sub-section (2) of section 69A; (a) to modify, destroy, record, transmit data or programme residing within a computer, computer system or computer network; or (b) by any means to usurp the normal operation of the computer, computer system, or computer network; (ii) "computer data-base" means a representation of information, knowledge, facts, concepts or instructions in text, image, audio, video that are being prepared or have been prepared in a formalised manner or have been produced by a computer, computer system or computer network and are intended for use in a computer, computer system or computer network; (iii) "computer virus" means any computer instruction, information, data or programme that destroys, damages, degrades or adversely affects the performance of a computer resource or attaches itself to another computer resource and operates when a programme, data or instruction is executed or some other event takes place in that computer resource; (iv) "damage" means to destroy, alter, delete, add, modify or rearrange any computer resource by any means. 1 [(v) "computer source code" means the listing of programme, computer commands, design and layout and programme analysis of computer resource in any form.] (z) the procedures and safeguards for blocking for access by the public under sub-section (3) of section 69 B; (za) the procedure and safeguards for monitoring and collecting traffic data or information under sub-section (3) of section 69B; (zb) the information security practices and procedures for protected system under section 70; (zc) manner of performing functions and duties of the agency under sub-section (3) of section 70 A; (zd) the officers and employees under sub-section (2) of section 70B; (ze) salaries and allowances and terms and conditions of service of the Director General and other officers and employees under sub-section (3) of section 70B; (zf) the manner in which the functions and duties of agency shall be performed under sub-section (5) of section 70B; (zg) the guidelines to be observed by the intermediaries under sub-section (2) of section 79; (zh) the modes or methods for encryption under section 84 A.] 3[43A. Compensation for failure to protect data. -Where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate shall be liable to pay damages by way of compensation to the person so affected. 1. Ins. by Act 10 of 2009, s. 21 (w.e.f. 27-10-2009). 2. Subs. by s. 21, ibid ., for certain words (w.e.f. 27-10-2009). 3. Ins. by s. 22, ibid. (w.e.f. 27-10-2009). Explanation .-For the purposes of this section,- (i) "body corporate" means any company and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities; (ii) "reasonable security practices and procedures" means security practices and procedures designed to protect such information from unauthorised access, damage, use, modification, disclosure or impairment, as may be specified in an agreement between the parties or as may be specified in any law for the time being in force and in the absence of such agreement or any law, such reasonable security practices and procedures, as may be prescribed by the Central Government in consultation with such professional bodies or associations as it may deem fit; (3)[4] [Every notification made by the Central Government under sub-section (1) of section 70A and every rule made by it] shall be laid, as soon as may be after it is made, before each House of Parliament, while it is in session, for a total period of thirty days which may be comprised in one session or in two or more successive sessions, and if, before the expiry of the session immediately following the session or the successive sessions aforesaid, both Houses agree in making any modification in[5] * the rule or both Houses agree that[5] * the rule should not be made,[5] * the rule shall thereafter have effect only in such modified form or be of no effect, as the case may be; so, however, that any such modification or annulment shall be without prejudice to the validity of anything previously done under that notification or rule. (iii) "sensitive personal data or information" means such personal information as may be prescribed by the Central Government in consultation with such professional bodies or associations as it may deem fit.] (y) "law" includes any Act of Parliament or of a State Legislature, Ordinances promulgated by the President or a Governor, as the case may be, Regulations made by the President under article 240, Bills enacted as President's Act under sub-clause (a) of clause (1) of article 357 of the Constitution and includes rules, regulations, bye-laws and orders issued or made thereunder; (z) "licence" means a licence granted to a Certifying Authority under section 24; (za) "originator" means a person who sends, generates, stores or transmits any electronic message or causes any electronic message to be sent, generated, stored or transmitted to any other person but does not include an intermediary; (zb) "prescribed" means prescribed by rules made under this Act; (zc) "private key" means the key of a key pair used to create a digital signature; 1. Ins. by Act 10 of 2009, s. 4 (w.e.f. 27-10-2009). 2. Subs. by s. 4, ibid., for "data, text" (w.e.f. 27-10-2009). 3. Subs. by s. 4, ibid., for clause (w) (w.e.f. 27-10-2009). (zd) "public key" means the key of a key pair used to verify a digital signature and listed in the Digital Signature Certificate; - (ze) "secure system" means computer hardware, software, and procedure that- - (a) are reasonably secure from unauthorised access and misuse; - (b) provide a reasonable level of reliability and correct operation; - (c) are reasonably suited to performing the intended functions; and (d) adhere to generally accepted security procedures; (zf) "security procedure" means the security procedure prescribed under section 16 by the Central Government; (zg) "subscriber" means a person in whose name the[1] [electronic signature] Certificate is issued; (zh) "verify", in relation to a digital signature, electronic record or public key, with its grammatical variations and cognate expressions, means to determine whether- (a) the initial electronic record was affixed with the digital signature by the use of private key corresponding to the public key of the subscriber; (b) the initial electronic record is retained intact or has been altered since such electronic record was so affixed with the digital signature. (2) Any reference in this Act to any enactment or any provision thereof shall, in relation to an area in which such enactment or such provision is not in force, be construed as a reference to the corresponding law or the relevant provision of the corresponding law, if any, in force in that area.