Amendments to the Information Technology Act, 2000

2002

19 Sep 2002Notification

The Information Technology (Removal of Difficulties) Order, 2002

Five small wording corrections across four sections, made in the two-year window Parliament gave itself under section 86 to fix drafting slips.

6 provisions affected

The Act commenced 17-10-2000. Within the two-year removal-of-difficulties window Parliament gave itself in section 86, the Central Government used this order to fix a handful of small drafting problems in the freshly enacted text rather than waiting for the next amending Bill.

Five small wording corrections across four sections: dropped a stray "then", replaced an internal cross-reference to "the key" language, removed words limiting who a digital-signature-affixing offence could be committed against, and fixed a clause-letter cross-reference in section 89 that pointed at the wrong lettered clause.

Instrument: Central Government order under section 86(1) (Removal of difficulties)
Legal basis: Section 86 of the Act itself: "If any difficulty arises in giving effect to the provisions of this Act, the Central Government may, by order published in the Official Gazette, make such provisions not inconsistent with the provisions of this Act as appear to it to be necessary or expedient for removing the difficulty", exercisable only within two years of commencement (17-10-2000 + 2 years = 17-10-2002). This order is dated 19-9-2002, inside that window.
Issued by: Central Government (Ministry of Communications and Information Technology)

Every provision this touched — 6 in all

Provision	Change	Citation, as the Act prints it
25	substituted	Subs. by notification No. S.O. 1015(E) (w.e.f. 19-9-2002).
40	omitted	The word “then” omitted by notification No. S.O. 1015(E) (w.e.f. 19-9-2002).
40	substituted	Subs. ibid., for “the key” (w.e.f. 19-9-2002).
42	omitted	The words “to a person not authorised to affix the digital signature of the subscriber” omitted by notification No. S.O.1015(E) (w.e.f. 19-9-2002).
63	substituted	Subs. by notification No. S.O. 1015(E) (w.e.f. 19-9-2002).
89	substituted	Subs. by notification No. S.O. 1015(E), for “(m)” (w.e.f. 19-9-2002).

2003

26 Feb 2003Act 55 of 2002

The Negotiable Instruments (Amendment and Miscellaneous Provisions) Act, 2002

Inserted section 81A, extending the Act to electronic and truncated cheques for the RBI’s Cheque Truncation System.

2 provisions affected

Enacted chiefly to give the Negotiable Instruments Act, 1881 the "truncated cheque" and "electronic cheque" concepts needed for the Reserve Bank of India's Cheque Truncation System, so that a scanned image of a cheque, rather than the paper instrument itself, could be exchanged in clearing. Because a cheque is itself a species of electronic record once truncated, Parliament used the same Act to make two small consequential changes to the IT Act, 2000.

Two changes to the IT Act, only one of which is still visible in the Act's printed text today: (1) section 12 of this Act substituted IT Act section 1(4)(a) so that "a negotiable instrument (other than a cheque)" -- rather than all negotiable instruments -- was excluded from the IT Act's reach, i.e. it carved cheques back INTO the IT Act's coverage so they could be handled electronically; that specific wording was entirely superseded six years later when the Information Technology (Amendment) Act, 2008 substituted the whole of section 1(4) afresh, so no trace of the 2002 wording survives in the Act as it reads today. (2) section 13 of this Act inserted an all-new section 81A into the IT Act, which remains in force verbatim: it extends the IT Act to electronic cheques and truncated cheques, subject to modifications the Central Government may notify in consultation with RBI, any such notification to be laid before Parliament for 30 days.

Assent: 17 December 2002
Ministry: Ministry of Finance (Department of Economic Affairs) -- probable but not fully confirmed, see ministryNote — Two independent research passes disagree on confidence here. One found that the Negotiable Instruments Act, 1881 is administered by the Department of Economic Affairs, and that the predecessor Bill (Negotiable Instruments (Amendment) Bill, 2001) was referred to the Standing Committee on Finance (reported November 2001) -- the departmentally-related committee for Finance Ministry bills, which is meaningful circumstantial evidence. A second, independent pass could not find a primary source (Lok Sabha bulletin, PRS, gazette) directly naming the piloting ministry, and separately found the Bill traced to an RBI-convened working group -- also circumstantial, also pointing toward Finance/RBI rather than away from it, but likewise not a direct confirmation. Net: probably correct, not certain.
Effective from: The Act as a whole was brought into force in stages by separate notifications for different provisions; the IT Act insertion (its own section 13) took effect 26-2-2003.

Every provision this touched — 2 in all

Provision	Change	Citation, as the Act prints it
81A	inserted	Ins. by Act 55 of 2002, s. 13 (w.e.f. 26-2-2003).
1(4)(a)	substituted, later superseded	Substituted by this Act’s own section 12: "(a) a negotiable instrument (other than a cheque) as defined in section 13 of the Negotiable Instruments Act, 1881 (26 of 1881);" -- since overwritten in full by Act 10 of 2009, s. 3, and so absent from the IT Act's current text and from its footnote apparatus.

2009

27 Oct 2009Act 10 of 2009

The Information Technology (Amendment) Act, 2008

The near-total recodification — technology-neutral “electronic signature,” section 43A, the 66A–72A cybercrime suite, CERT-In, intermediary safe harbour.

88 provisions affected

The most consequential amendment to the Act: a near-total recodification driven by two pressures that had built up since 2000 -- the original Act tied electronic authentication to one specific technology ("digital signature", i.e. asymmetric cryptography), which the industry wanted made technology-neutral, and the rise of cybercrime (data theft, phishing, cyberterrorism, obscenity, identity theft) for which the original Act had no offence provisions. Passed with minimal floor debate weeks after the Mumbai attacks, it is frequently criticised in retrospect for both the haste of its passage and for introducing section 66A, later struck down as unconstitutional (see the judicial-shreya-singhal-2015 entry below). A commonly repeated claim that it was one of eight bills passed by the Lok Sabha in that single sitting could not be independently confirmed from a primary source and should be treated as unverified.

Touched roughly 70 sections and both Schedules. Renamed "digital signature" to the technology-neutral "electronic signature" throughout and inserted section 3A to allow other authentication techniques; added corporate data-protection duties (new section 43A, compensation for a body corporate’s negligent handling of sensitive personal data); replaced the old sections 66 and 67 with a full suite of cybercrime offences (identity theft, cheating by personation, violation of privacy, cyberterrorism, publishing sexually explicit material, child pornography -- sections 66A through 67C, 72A); rewrote the government’s interception/blocking/monitoring powers (substituted section 69, inserted new sections 69A and 69B); inserted intermediary safe-harbour rules (substituted section 79) and CERT-In’s statutory basis (inserted sections 70A, 70B); made most offences compoundable and bailable (new section 77A, 77B) and gave the police power to investigate without a warrant (substituted section 78); repealed sections 91-94, the now-spent provisions that had made one-off consequential amendments to the Indian Penal Code, the Indian Evidence Act, the Bankers’ Books Evidence Act and the RBI Act back in 2000, along with the Third and Fourth Schedules that had carried the text of two of those amendments; and substituted both remaining Schedules outright.

Bill history: Introduced in the Lok Sabha as Bill No. 96 of 2006 on 15 December 2006; referred the same week (19 December 2006) to the Department-related Parliamentary Standing Committee on Information Technology, which gave its 50th Report around September 2007. The Bill was then passed by the Lok Sabha on 22 December 2008 (after roughly 21 minutes of debate) and by the Rajya Sabha the next day, 23 December 2008, without debate, on the last day of the winter session -- weeks after the 26 November 2008 Mumbai terror attacks.
Assent: 5 February 2009
Commencement notice: S.O. 2689(E), dated 27 October 2009, Gazette of India, Extraordinary, Part II, section 3(ii).
Ministry: Ministry of Communications and Information Technology, Department of Information Technology (renamed Ministry of Electronics and Information Technology in 2016)

Every provision this touched — 88 in all

Provision	Change	Citation, as the Act prints it
1	substituted	Subs. by Act 10 of 2009, s. 3, for sub-section (4) (w.e.f. 27-10-2009).
2	substituted	Subs. by Act 10 of 2009, s. 2, for “digital signature” (w.e.f. 27-10-2009).
2	inserted	Ins. by 10 of 2009, s. 4 (w.e.f. 27-10-2009).
2	substituted	Subs. by s. 4, ibid., for clause (j) (w.e.f. 27-10-2009).
2	inserted	Ins. by Act 10 of 2009, s. 4 (w.e.f. 27-10-2009).
2	substituted	Subs. by s. 4, ibid., for “data, text” (w.e.f. 27-10-2009).
2	substituted	Subs. by s. 4, ibid., for clause (w) (w.e.f. 27-10-2009).
2	substituted	Subs. by Act 10 of 2009, s. 2, for “digital signature” (w.e.f. 27-10-2009).
3A	inserted	Ins. by s. 6, ibid. (w.e.f. 27-10-2009).
5	substituted	Subs. by Act 10 of 2009, s. 2, for “digital signatures” (w.e.f. 27-10-2009).
6	substituted	Subs. by Act 10 of 2009, s. 2, for “digital signatures” (w.e.f. 27-10-2009).
6A	inserted	Ins. by Act 10 of 2009, s. 7 (w.e.f. 27-10-2009).
7A	inserted	Ins. by s. 8, ibid. (w.e.f. 27-10-2009).
10	substituted	Subs. by Act 10 of 2009, s. 2, for “digital signature” (w.e.f. 27-10-2009).
10A	inserted	Ins. by s. 9, ibid. (w.e.f. 27-10-2009).
12	substituted	Subs. by s. 10, ibid., for “agreed with the addressee” (w.e.f. 27-10-2009).
15	substituted	Subs. by s 11, ibid., for sections 15 and 16 (w.e.f. 27-10-2009).
16	substituted	Subs. by s 11, ibid., for sections 15 and 16 (w.e.f. 27-10-2009).
17	substituted	Subs. by s.12, ibid., for “and Assistant Controllers” (w.e.f. 27-10-2009).
17	substituted	Subs. by Act 10 of 2009, s. 12, for “Assistant Controllers” (w.e.f. 27-10-2009).
18	substituted	Subs. by s. 2, ibid., for “digital signature” (w.e.f. 27-10-2009).
19	substituted	Subs. by s. 2, ibid., for “digital signature” (w.e.f. 27-10-2009).
20	omitted	20. [Controller to act as repository.] Omitted by the Information Technology (Amendment) Act, 2008 (10 of 2009), s. 13 (w.e.f. 27-10-2009).
21	substituted	Subs. by Act 10 of 2009, s. 2, for “digital signature” (w.e.f. 27-10-2009).
25	substituted	Subs. by Act 10 of 2009, s. 2, for “digital signature” (w.e.f. 27-10-2009).
29	substituted	Subs. by s. 14, ibid., for “any contravention of the provisions of this Act, rules and regulations made thereunder” (w.e.f. 27-10-2009).
30	substituted	Subs. by Act 10 of 2009, s. 2, for “digital signature” (w.e.f. 27-10-2009).
30	omitted	The word “and” omitted by s. 15, ibid. (w.e.f. 27-10-2009).
30	inserted	Ins. by s. 15, ibid. (w.e.f. 27-10-2009).
34	substituted	Subs. by Act 10 of 2009, s. 2, for “digital signature” (w.e.f. 27-10-2009).
34	omitted	Certain words omitted by s. 16, ibid. (w.e.f. 27-10-2009).
35	substituted	Subs. by Act 10 of 2009, s. 2, for “digital signature” (w.e.f. 27-10-2009).
35	omitted	The first proviso omitted by s. 17, ibid. (w.e.f. 27-10-2009).
35	substituted	Subs. by s. 17, ibid., for “Provided further” (w.e.f. 27-10-2009).
36	inserted	Ins. by Act 10 of 2009, s. 18 (w.e.f. 27-10-2009).
40A	inserted	Ins. by Act 10 of 2009, s. 19 (w.e.f. 27-10-2009).
43	substituted	Subs. by s. 21, ibid., for “Penalty” (w.e.f. 27-10-2009).
43	inserted	Ins. by s. 21, ibid. (w.e.f. 27-10-2009).
43	inserted	Ins. by Act 10 of 2009, s. 21 (w.e.f. 27-10-2009).
43	substituted	Subs. by s. 21, ibid., for certain words (w.e.f. 27-10-2009).
43A	inserted	Ins. by s. 22, ibid. (w.e.f. 27-10-2009).
46	substituted	Subs. by Act 10 of 2009, s. 23, for “direction or order made thereunder” (w.e.f. 27-10-2009).
46	inserted	Ins. by s. 23, ibid. (w.e.f. 27-10-2009).
46	inserted	Ins. by Act 10 of 2009, s. 23 (w.e.f. 27-10-2009).
55	substituted	Subs. by Act 10 of 2009, s. 29, ibid., for “Presiding Officer” (w.e.f. 27-10-2009).
64	substituted	Subs. by Act 10 of 2009, s. 31, for marginal heading (w.e.f. 27-10-2009).
64	substituted	Subs. by s. 31, ibid., for “penalty imposed” (w.e.f. 27-10-2009).
64	substituted	Subs. by s. 2, ibid., for “digital signature” (w.e.f. 27-10-2009).
66	substituted	Subs. by Act 10 of 2009, s. 32, for sections 66 and 67 (w.e.f. 27-10-2009).
68	substituted	Subs. by Act 10 of 2009, s. 33, for sub-section (2) (w.e.f. 27-10-2009).
69	substituted	Subs. by s. 34, ibid., for section 69 (w.e.f. 27-10-2009).
70	substituted	Subs. by Act 10 of 2009, s. 35, for sub-section (1) (w.e.f. 27-10-2009).
70	inserted	Ins. by s. 35, ibid. (w.e.f. 27-10-2009).
70A	inserted	Ins. by s. 36, ibid. (w.e.f. 27-10-2009).
71	substituted	Subs. by Act 10 of 2009, s. 2, for “digital signature” (w.e.f. 27-10-2009).
72A	inserted	Ins. by Act 10 of 2009, s. 37, (w.e.f. 27-10-2009).
73	substituted	Subs. by Act 10 of 2009, s. 2, for “digital signature” (w.e.f. 27-10-2009).
74	substituted	Subs. by Act 10 of 2009, s. 2, for “digital signature” (w.e.f. 27-10-2009).
77	substituted	Subs. by s. 38, ibid., for section 77 (w.e.f. 27-10-2009).
78	substituted	Subs. by Act 10 of 2009, s. 39, for “Deputy Superintendent of Police” (w.e.f. 27-10-2009).
79	substituted	Subs. by, s. 40, ibid., for Chapter XII (w.e.f. 27-10-2009).
79A	substituted	Subs. by, s. 40, ibid., for Chapter XII (w.e.f. 27-10-2009).
80	substituted	Subs. by Act 10 of 2009, s. 41, for “Deputy Superintendent of Police” (w.e.f. 27-10-2009).
81	inserted	Ins. by s. 42, ibid. (w.e.f. 27-10-2009).
84A	inserted	Ins. by 10 of 2009, s. 45 (w.e.f. 27-10-2009).
87	substituted	Subs. by Act 10 of 2009, s. 46, for clause (a) (w.e.f. 27-10-2009).
87	inserted	Ins. by s. 46, ibid. (w.e.f. 27-10-2009).
87	substituted	Subs. by s. 2, ibid., for “digital signature” (w.e.f. 27-10-2009).
87	substituted	Subs. by s. 46, ibid., for clause (e) (w.e.f. 27-10-2009).
87	substituted	Subs. by s. 46, ibid., for “and Assistant Controllers” (w.e.f. 27-10-2009).
87	omitted	Clause (g) omitted by s. 46, ibid. (w.e.f. 27-10-2009).
87	substituted	Subs. by Act 10 of 2009, s. 46, for clause (w) (w.e.f. 27-10-2009).
87	substituted	Subs. by Act 10 of 2009, s. 46, for certain words, brackets, letter and figures (w.e.f. 27-10-2009).
87	omitted	The words “the notification or” omitted by s. 46, ibid. (w.e.f. 27-10-2009).
90	omitted	Clause (c) omitted by Act 10 of 2009, s. 47 (w.e.f. 27-10-2009).
91	omitted	91. [Amendment of Act 45 of 1860.]—Omitted by the Information Technology (Amendment) Act, 2008 (10 of 2009), s. 48 (w.e.f. 27-10-2009).
92	omitted	92. [Amendment of Act 1 of 1872.]—Omitted by s. 48, ibid. (w.e.f. 27-10-2009).
93	omitted	93. [Amendment of Act 18 of 1891.]—Omitted by s. 48, ibid. (w.e.f. 27-10-2009).
94	omitted	94. [Amendment of Act 2 of 1934.]—Omitted by s. 48, ibid. (w.e.f. 27-10-2009).
First	substituted	Subs. by Act 10 of 2009, s. 49, for the First Schedule and the Second Schedule (w.e.f. 27-10-2009).
Fourth Schedule	omitted	[THE FOURTH SCHEDULE.] Omitted by the Information Technology (Amendment) Act, 2008 (10 of 2009), s. 50 (w.e.f. 27-10-2009).
II	substituted	Subs. by s. 5, ibid., for the heading “DIGITAL SIGNATURE” (w.e.f. 27-10-2009).
IX	substituted	Subs. by Act 10 of 2009, s. 20, for “PENALTIES AND ADJUDICATION” (w.e.f. 27-10-2009).
Second	substituted	Subs. by Act 10 of 2009, s. 49, (w.e.f. 27-10-2009).
Third Schedule	omitted	[THE THIRD SCHEDULE.] Omitted by the Information Technology (Amendment) Act, 2008 (10 of 2009), s. 50 (w.e.f. 27-10-2009).
V	substituted	Subs. by Act 10 of 2009, s. 2, for “digital signatures” (w.e.f. 27-10-2009).
VII	substituted	Subs. by Act 10 of 2009, s. 2, for “digital signature” (w.e.f. 27-10-2009).
XII	substituted	Subs. by, s. 40, ibid., for Chapter XII (w.e.f. 27-10-2009).

2015

28 Jan 2015Notification

G.S.R. 61(E) — Aadhaar e-KYC electronic-signature technique

Added Aadhaar e-KYC as a recognised way to authenticate a Digital Signature Certificate applicant.

1 provision affected

Added Aadhaar-based e-KYC as a recognised way to authenticate an electronic record, so a Digital Signature Certificate could be issued after verifying the applicant’s identity through Aadhaar rather than only through the original paper/physical verification route.

Inserted a first entry (Sl. No. 1) into the Second Schedule: "e-authentication technique using Aadhaar e-KYC services", together with the procedure a Certifying Authority must follow -- e-authentication, hashing and an asymmetric crypto system, an optional "trusted third party" model for generating and holding the subscriber’s key pair, and Aadhaar e-KYC-verified particulars in the certificate application.

Instrument: Central Government notification under section 3A(1) (electronic signature or authentication technique)
Issued by: Central Government (Ministry of Electronics and Information Technology)

Every provision this touched — 1 in all

Provision	Change	Citation, as the Act prints it
Second Schedule, Sl. No. 1	inserted	Ins. by G.S.R. 61(E), dated 27-1-2015 (w.e.f. 28-1-2015).

24 Mar 2015Supreme Court

Shreya Singhal v. Union of India

Section 66A struck down as unconstitutional; section 69A upheld as valid; section 79(3)(b) read down.

AIR 2015 SC 1523; (2015) 5 SCC 1

Petitions were filed after section 66A -- which criminalised sending, by computer or communication device, any information that was "grossly offensive", had "menacing character", or was known to be false but sent to cause annoyance/inconvenience/danger/insult/injury/enmity/hatred/ill-will -- was repeatedly used against ordinary social-media posts, most visibly the 2012 arrest of two young women in Palghar, Maharashtra for a Facebook post about a shutdown following a political leader’s death.

Holding. The Court struck down section 66A in its entirety as unconstitutional, holding its language too vague and overbroad to fall within the reasonable restrictions on free speech permitted by Article 19(2) of the Constitution -- it could criminalise speech having no proximate connection to public disorder. Section 69A (blocking of information) was, by contrast, upheld as constitutionally VALID -- not struck down, not read down -- since it comes with defined grounds and a documented procedure. Only section 79(3)(b) specifically (the intermediary safe-harbour provision’s notice-and-takedown clause, not section 79 as a whole) was read down, along with the parallel Rule 3(4) of the Intermediary Guidelines: an intermediary’s obligation to remove content on a private party’s notice only arises once a court or government order under the proper procedure is in place, not on receiving a bare complaint.

Effect. Section 66A became void and unenforceable from 24-3-2015, but Parliament did not touch the printed text of the Act at that time -- it was widely reported afterwards that police continued to file cases citing 66A for years, since the section still physically appeared in the statute book. The provision was only formally removed from the Act’s text eight years later, by the Jan Vishwas (Amendment of Provisions) Act, 2023 (see that entry below).

Court: Supreme Court of India
Bench: Justices J. Chelameswar and Rohinton Fali Nariman
Citation: AIR 2015 SC 1523; (2015) 5 SCC 1

Every provision this touched — 1 in all

Provision	Change	Citation, as the Act prints it
66A	struck down as unconstitutional (void), text formally omitted only in 2023	Section 66A has been struck down by supreme Court's Order dated 24-3-2015 in the Shreya Singhal Vs. Union of India, AIR 2015 SC. 1523.

6 Jul 2015Notification

G.S.R. 539(E) — hardware-security-module requirement dropped

Loosened the hardware requirement for storing a subscriber’s key pair.

1 provision affected

Loosened the six-month-old Aadhaar e-KYC authentication procedure by removing a hardware requirement, presumably to widen the range of systems on which key generation/storage could be certified.

Omitted the words "on hardware security module" from the Second Schedule Sl. No. 1 procedure (the clause about storing the subscriber’s key pair), so key-pair storage was no longer required to specifically be on a hardware security module.

Instrument: Central Government notification under section 3A(1)
Issued by: Central Government (Ministry of Electronics and Information Technology)

Every provision this touched — 1 in all

Provision	Change	Citation, as the Act prints it
Second Schedule, Sl. No. 1	omitted	The words “on hardware security module” omitted by G.S.R. 539(E), dt. 30-6-2015 (w.e.f. 6-7-2015).

2016

27 Apr 2016Notification

G.S.R. 446(E) — tied to the Digital Signature (End Entity) Rules, 2015

Tied Aadhaar e-KYC authentication to the newly notified Digital Signature (End Entity) Rules, 2015.

1 provision affected

Tied the Aadhaar e-KYC authentication procedure to the Digital Signature (End Entity) Rules, 2015, which had been notified after the 2015 Schedule entries and needed to be referenced from them.

Substituted clause (g) of the Second Schedule Sl. No. 1 procedure so that the manner of authenticating information by digital signature must comply with rules 3 to 12 of the Digital Signature (End Entity) Rules, 2015.

Instrument: Central Government notification under section 3A(1)
Issued by: Central Government (Ministry of Electronics and Information Technology)

Every provision this touched — 1 in all

Provision	Change	Citation, as the Act prints it
Second Schedule, Sl. No. 1	substituted	Subs. by G.S.R. 446(E), for “(g)” dated 27-4-2016 (w.e.f. 27-4-2016).”

2017

26 May 2017Act 7 of 2017

The Finance Act, 2017

Dissolved the Cyber Appellate Tribunal and merged its jurisdiction into TDSAT.

30 provisions affected

Part XIV of the Finance Act, 2017 rationalised roughly eight sector-specific tribunals across different Acts into fewer, merged bodies, as a cost-and-consistency reform of India’s tribunal system. The IT Act’s own Cyber Appellate Tribunal -- which had gone without a sitting Chairperson for years and had a large backlog -- was one of the tribunals dissolved and merged into the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), which now hears appeals under the IT Act as well as telecom, broadcasting and airport-tariff matters. This same Part of the Finance Act, 2017 was directly challenged in Rojer Mathew v. Union of India (2019): the Supreme Court struck down the accompanying s. 184 rules on tribunal members’ qualifications and service conditions as excessive delegation and a threat to judicial independence, and referred the deeper question of whether tribunal reorganisation could validly be pushed through as a Money Bill to a larger bench (still pending as of this file’s compilation). The tribunal mergers themselves, including the folding of the Cyber Appellate Tribunal into TDSAT, were not undone -- only the rules governing members’ service conditions were, and those have since been replaced more than once (2020 Rules, then the Tribunal (Conditions of Service) Rules, 2021 under the Tribunals Reforms Act, 2021, which was itself partly struck down in November 2025).

Dissolved the standalone Cyber Appellate Tribunal: omitted the ten sections (49 through 56, including 52A-52C) that had set out its composition, member qualifications, tenure, salary, superintendence powers, bench distribution, case-transfer power, filling of vacancies, resignation/removal and staff; renamed Chapter X from "THE CYBER APPELLATE TRIBUNAL" to "THE APPELLATE TRIBUNAL"; replaced the section 2 definition of "Cyber Appellate Tribunal" with one for "Appellate Tribunal"; and, throughout the Act (sections 55, 58, 62, 82, 84, 87), substituted every remaining reference to "Cyber Appellate Tribunal" and "Presiding Officer" with the generic "Appellate Tribunal" language now pointing at TDSAT.

Section cited: section 169 (and the Eighth Schedule to that Act)
Assent: 31 March 2017
Commencement notice: S.O. 1696(E), fixing 26 May 2017 as the commencement date for Part XIV, Chapter VI (the tribunal-merger provisions, including s.169) under s.156 of the Finance Act, 2017.
Ministry: Ministry of Finance

Every provision this touched — 30 in all

Provision	Change	Citation, as the Act prints it
2	inserted	Ins. by 7 of 2017, s. 169 (w.e.f. 26-5-2017).
2	omitted	Clause (n) omitted by 7 of 2017, s.169 (w.e.f. 26-5-2017)
46	substituted	Subs. by Act 7 of 2017, s. 169, for “Cyber Appellate Tribunal” (w.e.f. 26-5-2017)
48	substituted	Subs. by Act 7 of 2017, s. 169, for “Cyber Appellate Tribunal” (w.e.f. 26-5-2017)
48	substituted	Subs. by s. 169, ibid., for sub-section (1) (w.e.f. 26-5-2017).
48	substituted	Subs. by s, 169, ibid., for “shall also specify, in the notification referred to in sub-section (1)” (w.e.f. 26-5-2017).
49	omitted	49. [Composition of Cyber Appellate Tribunal.]—Omitted by the Finance Act, 2017 (7 of 2017), s. 169 (w.e.f. 26-5-2017).
50	omitted	50. [Qualifications for appointment as Chairperson and Members of Cyber Appellate Tribunal.]—Omitted by s. 169, ibid. (w.e.f. 26-5-2017).
51	omitted	51. [Term of office, conditions of service, etc., of Chairperson and Members.]—Omitted by s. 169, ibid. (w.e.f. 26-5-2017).
52	omitted	52. [Salary, allowances and other terms and conditions of service of Chairperson and Members.]—Omitted by s. 169, ibid. (w.e.f. 26-5-2017).
52A	omitted	52A. [Powers of superintendence, direction, etc.]—Omitted by s. 169, ibid. (w.e.f. 26-5-2017).
52B	omitted	52B. [Distribution of business among Benches.]—Omitted by s. 169, ibid. (w.e.f. 26-5-2017).
52C	omitted	52C. [Power of Chairperson to transfer cases.]—Omitted by s. 169, ibid. (w.e.f. 26-5-2017).
52D	substituted	Subs. by Act 7 of 2017, s. 169, for “Cyber Appellate Tribunal” (w.e.f. 26-5-2017)
53	omitted	53. [Filling up of vacancies.]—Omitted by the Finance Act, 2017 (7 of 2017), s. 169 (w.e.f. 26-5-2017).
54	omitted	54. [Resignation and removal.]—Omitted by s. 169, ibid. (w.e.f. 26-5-2017).
55	substituted	Subs. by 7 of 2017, s, 169, for “Cyber Appellate Tribunal” (w.e.f. 26-5-2017).
56	omitted	56. [Staff of the Cyber Appellate Tribunal.]—Omitted by the Finance Act, 2017 (7 of 2017), s. 169 (w.e.f. 26-5-2017).
57	substituted	Subs. by 7 of 2017, s, 169, for “Cyber Appellate Tribunal” (w.e.f. 26-5-2017).
58	substituted	Subs. by 7 of 2017, s, 169, for “Cyber Appellate Tribunal” (w.e.f. 26-5-2017).
58	substituted	Subs. by 7 of 2017, s. 169, for “Cyber Appellate Tribunal” (w.e.f. 26-5-2017).
59	substituted	Subs. by 7 of 2017, s. 169, for “Cyber Appellate Tribunal” (w.e.f. 26-5-2017).
60	substituted	Subs. by 7 of 2017, s. 169, for “Cyber Appellate Tribunal” (w.e.f. 26-5-2017).
61	substituted	Subs. by 7 of 2017, s. 169, for “Cyber Appellate Tribunal” (w.e.f. 26-5-2017).
62	substituted	Subs. by 7 of 2017, s. 169, for “Cyber Appellate Tribunal” (w.e.f. 26-5-2017).
82	substituted	Subs. by 7 of 2017, s. 169, for section 82 (w.e.f. 26-5-2017).
84	substituted	Subs. by Act 7 of 2017, s. 169, for “the Chairperson Members, adjudicating officers and the staff of the Cyber Appellate Tribunal” (w.e.f. 26-5-2017).
87	omitted	Clauses (r), (s) and (t) omitted by Act 7 of 2017, s. 169 (w.e.f. 26-5-2017).
87	substituted	Subs. by Act 7 of 2017, s. 169, for “Cyber Appellate Tribunal”(w.e.f. 26-5-2017).
X	substituted	Subs. by Act 7 of 2017, s. 169, for Chapter heading (w.e.f. 26-5-2017).

2019

1 Mar 2019Notification

S.O. 1119(E) — widened to “Aadhaar or other” e-KYC services

Widened the Aadhaar e-KYC signature technique to “Aadhaar or other” e-KYC services.

3 provisions affected

Further refinement of the Aadhaar e-KYC electronic-signature procedure inserted in 2015, generalising it beyond Aadhaar specifically so other, functionally equivalent e-KYC services could also be used.

Three narrow word-insertions into the existing Second Schedule Sl. No. 1 entry, all broadening "Aadhaar" to "Aadhaar or other e-KYC": in the entry’s title/column (2), after "Aadhaar" insert "or other" (so it reads "e-authentication technique using Aadhaar or other e-KYC services"); in procedure item (c), after "Aadhaar" insert "or other"; in procedure item (e), after "subscriber’s key pair" insert "and other e-KYC services".

Instrument: Central Government notification under section 3A(1)
Gazette: Gazette of India No. 985, Part II, Section 3(ii); notification dated 1-3-2019, published 5-3-2019; signed by Pankaj Kumar, Additional Secretary (F. No. 12(10)/2018-CCA).
Issued by: Central Government (Ministry of Electronics and Information Technology, Controller of Certifying Authorities)

Every provision this touched — 3 in all

Provision	Change	Citation, as the Act prints it
Second Schedule, Sl. No. 1	inserted	Ins. by S.O. 1119(E), dated 1-3-2019.
Second Schedule, Sl. No. 1	inserted	Ins. by S.O. 1119(E), dated 1-3-2019.
Second Schedule, Sl. No. 1	inserted	Ins. by S.O. 1119(E), dated 1-3-2019.

2020

29 Sep 2020Notification

S.O. 3472(E) — trusted-third-party signature technique

Added a second electronic-signature route: a trusted-third-party technique for creating and accessing a subscriber’s signature key.

1 provision affected

Recognised a second, independent electronic-signature route alongside the Aadhaar e-KYC technique added in 2015: a trusted-third-party model for generating and accessing a subscriber’s own signature key, without that key generation being tied to a Certifying Authority’s Aadhaar e-KYC process.

Inserted a wholly new Sl. No. 2 entry into the Second Schedule: "e-authentication technique and procedure for creating and accessing subscriber’s signature key facilitated by trusted third party", with a nine-clause (a)-(i) procedure covering identity verification, the trusted third party’s duties, key/signature storage requirements, and compliance with Rule 6 of the Certifying Authorities Rules and the Digital Signature (End Entity) Rules, 2015.

Instrument: Central Government notification under section 3A(1)
Gazette: Gazette of India No. 3091; notification dated 29-9-2020, published 6-10-2020; signed by Dr Rajendra Kumar, Additional Secretary (F. No. 12(8)/2020-CCA).
Issued by: Central Government (Ministry of Electronics and Information Technology, Controller of Certifying Authorities)

Every provision this touched — 1 in all

Provision	Change	Citation, as the Act prints it
Second Schedule, Sl. No. 2	inserted	Ins. by S.O. 3472(E), dated 29-9-2020.

2022

26 Sep 2022Notification

S.O. 4720(E) — First Schedule: cheques, powers of attorney, real estate

Freed regulated-entity cheques and powers-of-attorney for electronic use, and dropped real-estate sale contracts from the exclusion list.

3 provisions affected

Narrowed the First Schedule’s list of documents/transactions the IT Act does NOT apply to -- i.e. widened what can lawfully be done electronically -- for two categories of paper-only instruments, and removed real-estate sale/conveyance contracts from the exclusion list altogether.

Three changes to the First Schedule: substituted Sl. No. 1 (the negotiable-instrument exclusion) in full, so it no longer excludes a demand promissory note or bill of exchange issued in favour of, or endorsed by, an entity regulated by RBI, NHB, SEBI, IRDAI or PFRDA -- those can now be handled electronically; amended the existing Sl. No. 2 (power-of-attorney exclusion, which already existed) by inserting an equivalent regulated-entity carve-out clause after its existing wording, rather than creating Sl. No. 2 from nothing; and omitted Sl. No. 5 outright, which had excluded "any contract for the sale or conveyance of immovable property or any interest in such property" -- such contracts can now be executed electronically under the Act.

Instrument: Central Government notification under section 1(4) proviso
Gazette: Gazette of India No. 4510, published 4-10-2022; signed by Dr Rajendra Kumar, Additional Secretary (F. No. 1(3)/2022-CL).
Issued by: Central Government (Ministry of Electronics and Information Technology)

Every provision this touched — 3 in all

Provision	Change	Citation, as the Act prints it
First Schedule, Sl. No. 1	substituted	Subs. by notification No S.O. 4720(E), for serial number 1 and the entries relating thereto, Dated 26-9-2022.
First Schedule, Sl. No. 2	inserted	Ins. by S.O. 4720(E), Dated 26-9-2022.
First Schedule, Sl. No. 5	omitted	Serial number 5 and the entries relating thereto Omitted by S.O. 4720(E), Dated 26-9-2022.

2023

30 Nov 2023Act 18 of 2023

The Jan Vishwas (Amendment of Provisions) Act, 2023

Decriminalised nine penalty provisions into pure fines, and finally omitted section 66A’s text — eight years after it was struck down.

16 provisions affected

An "ease of doing business / ease of living" decriminalisation exercise: a single Act whose Schedule amended 42 other central Acts administered by 19 different ministries/departments, converting roughly 183 provisions from criminal offences (or high fines) to civil penalties, lower fines, or administrative determinations, on the theory that minor/technical lapses should not carry the threat of imprisonment or a criminal record.

Its Schedule (Sl. No. 32, for "2000, 21, The Information Technology Act, 2000") decriminalised most of the penalty provisions it touched, replacing imprisonment-or-fine offences with a pure monetary "penalty" that a Central-Government adjudicating officer imposes under section 46, rather than a fine a criminal court imposes alongside possible imprisonment -- true of sections 33(2), 67C(2), 68(2), 72 and 72A. Section 70B(7) is the one exception in this Act: only its fine was raised (Rs 1 lakh to Rs 1 crore), while its "imprisonment up to 1 year, or fine, or both" structure was left untouched. Section 46(1) itself was widened in the same Schedule entry, from adjudicating contraventions "under this Chapter" to contraventions "under this Act", so the adjudicating officer has jurisdiction to impose all of these new penalties. This Act is also the one that finally omitted section 66A’s text outright, eight years after the Supreme Court had already held it void in Shreya Singhal.

Bill history: Passed by the Lok Sabha on 27 June 2023 and by the Rajya Sabha on 2 August 2023.
Assent: 11 August 2023
Commencement notice: S.O. 4745(E), dated 31 October 2023: "the Central Government hereby appoints the 30th day of November, 2023 as the date on which the provisions of the said Act, insofar as it relates to serial number 32... relating to the Information Technology Act, 2000... shall come into force."
Ministry: Department for Promotion of Industry and Internal Trade (DPIIT), Ministry of Commerce and Industry (nodal ministry for the Bill as a whole -- the Bill was introduced by Minister Piyush Goyal; individual Schedule items, including the IT Act ones, were drafted with the administering ministry of each Act)

Before & after, word for word

§ 33(2)

Beforeimprisonment up to 6 months, or fine up to Rs 10,000, or both

Afterpenalty up to Rs 5,00,000

§ 44(a)

Beforefine up to Rs 1,50,000

Afterfine up to Rs 15,00,000

§ 44(b)

Beforefine up to Rs 5,000

Afterfine up to Rs 50,000

§ 44(c)

Beforefine up to Rs 10,000

Afterfine up to Rs 1,00,000

§ 45

Beforecontravention of "rules or regulations"; compensation up to Rs 25,000 or penalty up to Rs 25,000

Aftercontravention of "rules, regulations, directions or orders"; penalty up to Rs 1,00,000 PLUS compensation up to Rs 10,00,000 (intermediary/company) or Rs 1,00,000 (any other person) -- compensation made additive to the penalty, not an alternative to it

§ 46(1)

Beforeadjudicating officer’s jurisdiction limited to contraventions "under this Chapter" (Chapter IX)

Afterjurisdiction extended to contraventions "under this Act" as a whole

§ 46(1A)

Beforecompensation available for "injury or" [loss/damage]

Afterthe words "injury or" omitted -- narrows what compensation can be claimed for

§ 66A

Beforefull text of the offence (already unenforceable since Shreya Singhal, 2015)

Afteromitted from the Act entirely

§ 67C(2)

Beforeimprisonment up to 3 years and fine (both, for an intermediary who knowingly fails to preserve required information)

Afterpenalty up to Rs 25,00,000, imprisonment removed

§ 68(2)

Beforeimprisonment up to 2 years, or fine up to Rs 1,00,000, or both

Afterpenalty up to Rs 25,00,000, imprisonment removed

§ 69B(4)

Beforeimprisonment up to 3 years AND fine (both mandatory)

Afterimprisonment up to 1 year, or fine up to Rs 1,00,00,000, or both -- ceiling cut from 3 years to 1, "and" changed to "or"

§ 70B(7)

Beforeimprisonment up to 1 year, or fine up to Rs 1,00,000, or both

Afterimprisonment up to 1 year, or fine up to Rs 1,00,00,000, or both -- unlike the other rows in this table, imprisonment was NOT removed here, only the fine amount was raised 100x

§ 72

Beforeimprisonment up to 2 years, or fine up to Rs 1,00,000, or both

Afterpenalty up to Rs 5,00,000, imprisonment removed

§ 72A

Beforeheading "Punishment"; imprisonment up to 3 years, or fine up to Rs 5,00,000, or both

Afterheading "Penalty"; penalty up to Rs 25,00,000, imprisonment removed

Every provision this touched — 16 in all

Provision	Change	Citation, as the Act prints it
33	substituted	Subs. by Act 18 of 2023, s. 2 and Schedule for certain words (w.e.f. 30-11-2023).
44	substituted	Subs. by Act 18 of 2023, s. 2 and Schedule, for “one lakh and fifty thousand” (w.e.f. 30-11-2023).
44	substituted	Subs. by ibid., s. 2 and Schedule, for “five thousand” (w.e.f. 30-11-2023).
44	substituted	Sub. by ibid., s. 2 and Schedule, for “ten thousand” (w.e.f. 30-11-2023).
45	substituted	Subs. by ibid., s. 2 and Schedule, for “rules or regulations” (w.e.f. 30-11-2023).
45	substituted	Subs. by ibid., s. 2 and Schedule, for certain words (w.e.f. 30-11-2023).
46	substituted	Subs. by ibid., s. 2 and Schedule, for “under this Chapter” (w.e.f. 30-11-2023).
46	omitted	Words omitted “injury or” omitted by Act 18 of 2023, s. 2 and Schedule (w.e.f. 30-11-2023).
66A	omitted	66A. [Punishment for sending offensive messages through communication service, etc.]–Omitted by the Jan Vishwas (Amendment of Provisions) Act, 2023 (18 of 2023), s. 2 and Schedule (w.e.f. 30-11-2023).
67C	substituted	Subs. by Act 18 of 2023, s. 2 and Schedule for certain words (w.e.f. 30-11-2023).
68	substituted	Subs. by Act 18 of 2023, s. 2 and Schedule for certain words (w.e.f. 30-11-2023).
69B	substituted	Subs. by Act 18 of 2023, s. 2 and Schedule for “three years and shall also be liable to fine” (w.e.f. 30-11-2023).
70B	substituted	Subs. by Act 18 of 2023, s. 2 and Schedule, for “one lakh” (w.e.f. 30-11-2023).
72	substituted	Subs. by Act 18 of 2023, s. 2 and Schedule, for certain world (w.e.f. 30-11-2023).
72A	substituted	Subs. by Act 18 of 2023, s. 2 and Schedule, for “Punishment” (w.e.f. 30-11-2023).
72A	substituted	Subs. by Act 18 of 2023, s. 2 and Schedule, for certain word (w.e.f. 30-11-2023).

2027

13 May 2027 · not yet in forcePending

The Digital Personal Data Protection Act, 2023

Will omit section 43A entirely once notified, handing data-protection enforcement to the new DPDP Board.

3 provisions affected

The DPDP Act, 2023 will supersede the IT Act’s own data-protection regime -- which currently rests on section 43A (compensation for a body corporate’s negligent handling of sensitive personal data) and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 made under it -- with a purpose-built data-protection law and its own Data Protection Board. Section 44(2) is the DPDP Act’s own repeal-and-amend clause for that transition.

Once notified, section 44(2) will: (a) omit section 43A from the IT Act entirely; (b) insert, in the proviso to section 81 (Act to have overriding effect), a reference to the Digital Personal Data Protection Act, 2023 alongside the existing Copyright Act and Patents Act carve-outs; and (c) omit clause (ob) of section 87(2) (the Central Government’s rule-making power for section 43A’s reasonable-security-practices rules, which becomes redundant once 43A itself is gone).

Section cited: section 44(2)
Assent: 11 August 2023
Ministry: Ministry of Electronics and Information Technology
Effective from: Not yet in force as of this file’s compilation date (2026-08-15). Confirmed against a single MeitY commencement notification, G.S.R. 843(E), dated 13-11-2025, which sets three tiers: (1) 13-11-2025, immediate -- ss. 1(2), 2, 18-26, 35, 38-43, 44(1)&(3); (2) 13-11-2026 -- s. 6(9), s. 27(1)(d); (3) 13-5-2027 -- ss. 3-17, 6(1)-(8)&(10), 27 (except (1)(d)), 28-34, 36, 37, and 44(2) -- the clause carrying the IT Act consequential amendments. Section 44(2) is therefore confirmed still not in force as of this file’s compilation date, and not due until 13-5-2027.

Every provision this touched — 3 in all

Provision	Change	Citation, as the Act prints it
43A	to be omitted	Shall be omitted -- DPDP Act, 2023 (22 of 2023), s. 44(2)(a), effective 13-5-2027.
81	to be amended	Proviso to be amended to add a reference to the Digital Personal Data Protection Act, 2023 -- DPDP Act, 2023 (22 of 2023), s. 44(2)(b), effective 13-5-2027.
87(2)(ob)	to be omitted	Clause (ob) to be omitted -- DPDP Act, 2023 (22 of 2023), s. 44(2)(c), effective 13-5-2027.

Amendments to the Information Technology Act, 2000

Every provision this touched — 6 in all

Every provision this touched — 2 in all

Every provision this touched — 88 in all

Every provision this touched — 1 in all

Every provision this touched — 1 in all

Every provision this touched — 1 in all

Every provision this touched — 1 in all

Every provision this touched — 30 in all

Every provision this touched — 3 in all

Every provision this touched — 1 in all

Every provision this touched — 3 in all

Before & after, word for word

Every provision this touched — 16 in all

Every provision this touched — 3 in all

Report a problem

Footnote