Cyber Law in Hyderabad: IT Act Offences, CERT-In Reporting and the DPDP Act
Lost money to an online fraud? Call the national cyber fraud helpline 1930 immediately and report the transaction on cybercrime.gov.in. Speed matters. Our first 48 hours guide sets out the steps.
This guide explains the cyber law that applies in Hyderabad today: the offences under the Information Technology Act, 2000 and the Bharatiya Nyaya Sanhita, 2023, how to claim compensation, what businesses must do when a cyber incident happens, the duties of social media and other platforms, and the Digital Personal Data Protection Act, 2023, most of which is not yet in force.
Reporting cybercrime · Offences · Compensation · Business duties · Platforms · DPDP Act timeline · Bail and compounding
Where to report cybercrime
- 1930: the national helpline for victims of financial cyber fraud.
- cybercrime.gov.in: the Government of India’s National Cyber Crime Reporting Portal, for reporting all kinds of cybercrime online.
- Telangana Cyber Security Bureau (TGCSB): the state’s dedicated cybercrime agency, at tgcsb.tspolice.gov.in.
- Police station: information about a cognizable offence can be given at any police station, irrespective of where the offence took place, orally or electronically; electronic information must be signed within three days (Bharatiya Nagarik Suraksha Sanhita, section 173). See our guide to registering an FIR.
Straight after calling 1930, save screenshots of messages, the website or app, transaction IDs, bank SMS and emails, and the phone numbers or handles involved. Do not delete chats or uninstall apps until the evidence is preserved.
Cyber offences
Cyber offences are found mainly in the IT Act, with general offences such as cheating and forgery in the Bharatiya Nyaya Sanhita (BNS).
| Offence | Provision | Maximum punishment |
|---|---|---|
| Dishonestly or fraudulently doing any act in section 43 (unauthorised access, data theft, virus, damage) | IT Act s.66 | 3 years, or fine up to Rs 5 lakh, or both |
| Receiving or retaining a stolen computer resource or device | IT Act s.66B | 3 years, or fine up to Rs 1 lakh, or both |
| Identity theft: fraudulent use of another person’s electronic signature, password or unique identification feature | IT Act s.66C | 3 years and fine up to Rs 1 lakh |
| Cheating by personation using a communication device or computer resource | IT Act s.66D | 3 years and fine up to Rs 1 lakh |
| Capturing, publishing or transmitting an image of a person’s private area without consent, in circumstances violating their privacy | IT Act s.66E | 3 years, or fine up to Rs 2 lakh, or both |
| Publishing or transmitting obscene material electronically | IT Act s.67 | First conviction 3 years and Rs 5 lakh; subsequent 5 years and Rs 10 lakh |
| Publishing or transmitting sexually explicit material electronically | IT Act s.67A | First conviction 5 years and Rs 10 lakh; subsequent 7 years and Rs 10 lakh |
| Cheating | BNS s.318 | 3 years, or fine, or both; higher in the aggravated forms, up to 7 years and fine where property is delivered |
| Cheating by personation | BNS s.319 | 5 years, or fine, or both |
| Forgery, including of an electronic record | BNS s.336 | Depends on the purpose, higher where intended for cheating |
| Defamation | BNS s.356 | Simple imprisonment up to 2 years, or fine, or both, or community service |
Organised cybercrime. Section 111 of the BNS on organised crime expressly includes “cyber-crimes” committed by an organised crime syndicate. Where no death results, it is punishable with not less than five years up to life imprisonment and a fine of at least Rs 5 lakh; where death results, with death or life imprisonment and a fine of at least Rs 10 lakh.
Disclosure of personal information without consent or in breach of a lawful contract (section 72A). Older articles describe this as an offence punishable with imprisonment. Since 30 November 2023, under the Jan Vishwas (Amendment of Provisions) Act, 2023, section 72A instead provides for a penalty of up to Rs 25 lakh.
Claiming compensation
- Damage to a computer system (section 43). A person who, without the owner’s permission, accesses a computer or network, downloads or copies data, introduces a virus, damages or disrupts a system, denies authorised access, deletes or alters information, or steals source code, among the acts listed, is liable to pay damages by way of compensation to the person affected.
- Failure to protect sensitive personal data (section 43A). A body corporate that possesses, deals with or handles sensitive personal data or information in a computer resource it owns, controls or operates, and is negligent in implementing and maintaining reasonable security practices and procedures, thereby causing wrongful loss or wrongful gain to any person, is liable to pay damages by way of compensation. This section remains in force until section 44(2)(a) of the Digital Personal Data Protection Act, which omits it, takes effect on 13 May 2027.
- Who decides. Under section 46, claims for damage not exceeding Rs 5 crore are decided by an adjudicating officer appointed by the Central Government, not below the rank of a Director to the Government of India or an equivalent officer of a State Government. Claims above Rs 5 crore go to the competent court.
A compensation claim is separate from a criminal complaint. Both can be pursued where the facts support them.
What businesses must do: CERT-In Directions
The Indian Computer Emergency Response Team (CERT-In) is the national agency for cyber incidents under section 70B of the IT Act. Its Directions of 28 April 2022, issued under section 70B(6), apply to service providers, intermediaries, data centres, body corporates and government organisations:
- Report within 6 hours: cyber incidents of the types listed in Annexure I must be reported to CERT-In within 6 hours of noticing them or being told of them, by email to incident@cert-in.org.in or on 1800-11-4949. The list includes targeted scanning, unauthorised access, website defacement, malware and ransomware, identity theft and phishing, denial-of-service attacks, data breaches and data leaks, attacks on payment systems, fake mobile apps, and compromise of social media accounts.
- Keep logs for 180 days: logs of all ICT systems must be maintained securely for a rolling 180 days within Indian jurisdiction.
- Synchronise clocks: systems must connect to the Network Time Protocol servers of the National Informatics Centre or the National Physical Laboratory, or servers traceable to them.
- Subscriber records: data centres, virtual private server and cloud providers, and VPN providers must keep validated subscriber records for five years or longer. Virtual asset service providers must keep KYC and transaction records for five years.
Failing to provide information or comply with a CERT-In direction is an offence punishable with imprisonment up to one year, or fine up to Rs 1 crore, or both (section 70B(7), as amended by the Jan Vishwas Act, 2023). A court takes cognizance only on a complaint by an officer authorised by CERT-In (section 70B(8)).
Practical step: a written incident response plan that names who decides an incident has been “noticed” and who reports it to CERT-In helps meet the 6-hour window. Keep a record of when the incident was noticed and when it was reported.
Social media and other platforms
An intermediary, such as a social media platform, messaging service or online marketplace, is not liable for third-party information it hosts if it meets the conditions in section 79 of the IT Act, including observing due diligence. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 require a grievance mechanism:
- the grievance officer must acknowledge a complaint within 24 hours and resolve it within seven days (rule 3(2)(a)(i), as amended up to 10 February 2026);
- certain requests for removal of content are to be resolved within 36 hours of reporting (first proviso to rule 3(2)(a)(i));
- on a complaint about content that exposes a person’s private area, shows them in full or partial nudity or in a sexual act, or impersonates them, including morphed images, the platform must take all reasonable and practicable measures to remove or disable access within two hours (rule 3(2)(b)).
Complaining to the platform’s grievance officer, keeping the acknowledgement, and reporting on cybercrime.gov.in can run in parallel.
The Digital Personal Data Protection Act, 2023: what applies when
The DPDP Act is being brought into force in phases under notification G.S.R. 843(E), published on 13 November 2025, with the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)).
| From | What is in force |
|---|---|
| 13 November 2025 | Definitions (section 2), the Data Protection Board of India (sections 18 to 26), sections 35 and 38 to 43, and the amendments to the TRAI Act and to section 8(1)(j) of the RTI Act (section 44(1) and (3)). The Board was established from this date. |
| 13 November 2026 (one year after publication) | Section 6(9) and section 27(1)(d) (G.S.R. 843(E)), and rule 4 of the Rules (rule 1(3)), all on Consent Managers |
| 13 May 2027 (eighteen months after publication) | The main obligations: applicability (section 3), notice and consent (section 5 and section 6, except 6(9)), duties of Data Fiduciaries (section 8), children’s data (section 9), rights of Data Principals (sections 11 to 14), penalties (section 33), and the omission of IT Act section 43A |
What the main obligations require, from 13 May 2027:
- Notice and consent: every request for consent must be accompanied or preceded by a notice, and consent must be free, specific, informed, unconditional and unambiguous with a clear affirmative action (sections 5 and 6).
- Security and breach intimation: a Data Fiduciary must take reasonable security safeguards and, on a personal data breach, inform the Board and each affected Data Principal (section 8(5) and (6)). The Rules require the Board to be told without delay, with a detailed report within 72 hours of becoming aware of the breach or a longer period the Board allows, and each affected Data Principal to be told without delay (rule 7(1) and (2)).
- Rights of individuals: access to information, correction and erasure, grievance redressal and nomination (sections 11 to 14). A Data Principal must first use the Data Fiduciary’s grievance mechanism before approaching the Board (section 13(3)).
- Penalties: the Schedule provides penalties of up to Rs 250 crore for failing to take reasonable security safeguards, up to Rs 200 crore for failing to intimate a breach, up to Rs 200 crore for breaching obligations on children’s data, and up to Rs 150 crore for additional obligations of Significant Data Fiduciaries.
Until 13 May 2027, personal data obligations for body corporates continue to rest mainly on IT Act section 43A and the rules made under it. Businesses that handle personal data have until then to map the data they hold, prepare notices and consent flows, and set up breach response and grievance processes.
Bail and compounding of IT Act offences
- Cognizable and bailable: offences under the IT Act punishable with imprisonment of three years and above are cognizable, and an offence punishable with imprisonment of three years is bailable (section 77B).
- Compounding: a court may compound IT Act offences other than those punishable with life imprisonment or imprisonment exceeding three years. Compounding is not available where the accused, by reason of a previous conviction, is liable to enhanced punishment or punishment of a different kind, or where the offence affects the socio-economic conditions of the country or is committed against a child below 18 or a woman (section 77A).
Frequently asked questions
What should I do first if I lose money in an online fraud?
Call 1930, the national helpline for financial cyber fraud, and report on cybercrime.gov.in as quickly as possible. Save transaction IDs, bank messages, screenshots and the phone numbers or handles used.
Is identity theft a crime under the IT Act?
Yes. Section 66C of the IT Act punishes fraudulent or dishonest use of another person’s electronic signature, password or unique identification feature with imprisonment up to three years and a fine up to Rs 1 lakh.
Is the Digital Personal Data Protection Act in force?
Only partly. Definitions and the Data Protection Board took effect on 13 November 2025. The main obligations on notice, consent, security, breach intimation, individual rights and penalties take effect on 13 May 2027, under notification G.S.R. 843(E).
Is IT Act section 43A still in force?
Yes. Section 43A, on compensation for negligence in protecting sensitive personal data, continues until 13 May 2027, when section 44(2) of the DPDP Act, which omits it, takes effect.
How quickly must a company report a cyber incident to CERT-In?
Within 6 hours of noticing it or being told of it, for the incident types listed in Annexure I of the CERT-In Directions of 28 April 2022.
Is disclosing personal information without consent or in breach of a lawful contract still punishable with jail?
No. Since 30 November 2023, section 72A of the IT Act, as amended by the Jan Vishwas Act, 2023, provides for a penalty of up to Rs 25 lakh instead of imprisonment.
How fast must a social media platform act on a morphed or intimate image?
Under rule 3(2)(b) of the IT Rules, 2021, on a complaint about such content, the platform must take reasonable and practicable measures to remove or disable access within two hours (as amended up to 10 February 2026).
Who decides a compensation claim for damage to my computer systems?
Under section 46 of the IT Act, claims for damage not exceeding Rs 5 crore are decided by an adjudicating officer; larger claims go to the competent court.
For a discussion about a cyber law matter with Musab Hashmi & Associates, call +91 89771 24916 or send an enquiry with what happened, when, and any deadline. Do not send passwords, OTPs, full bank details or identity numbers in the first message.
General legal information for public awareness, not legal advice. Provisions checked on 22 October 2026 against the Information Technology Act, 2000 (gazette texts of 2000 and the 2008 amendment, with the Jan Vishwas (Amendment of Provisions) Act, 2023), the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 as amended up to 10 February 2026 (G.S.R. 120(E)), as consolidated by MeitY, the CERT-In Directions of 28 April 2022, the Digital Personal Data Protection Act, 2023 with notifications G.S.R. 843(E) and 844(E) and the DPDP Rules, 2025, the Bharatiya Nyaya Sanhita, 2023, and the official cybercrime.gov.in and TGCSB websites. Cyber law changes often; verify the current position before acting.