Law relating to Information Technology

First Schedule of the Information Technology Act, 2000(the Act) provides the list of documents or transactions to which the act shall not apply. The documents or transactions mentioned in first schedule and their importance are as under:

(1)A negotiable instrument (other than a cheque) as defined in section 13 of the Negotiable Instruments Act, 1881 : Negotiable instruments are used for purposes of payment or credit and as security.

(2)A power-of-attorney as defined in section 1A of the Powers-of-Attorney(POA)

Act, 1882 : POA document is an extremely important part of estate planning. It is considered expedient and necessary to have someone else act for you when there is an advancement in the business and commerce transactions.

(3)A trust as defined in section 3 of the Indian Trust Act, 1882 : A Trust is a relationship in which a person or entity holds a valid legal title to a certain property which is known as the Trust property. The Trust is bound by a fiduciary duty to exercise that legal title for the benefit of any one or more individuals or group of individuals or organisations, who are known as the Beneficiaries.

(4)A will as defined in clause (h) of section 2 of the Indian Succession Act, 1925, including any other testamentary disposition by whatever name called : A Will helps in avoiding any lengthy processes and delay in the distribution of your assets. Having a Will eases the way for nominees/legal heirs to get easier access to assets of the deceased.

(5)Any contract for the sale or conveyance of immovable property or any interest in such property : A Sale Deed is required to make sure that the buyer of the property has full ownership rights and can keep or sell it as they see fit. After executing the Sale Deed for a proper monetary price, the seller transfers entire legal ownership of the property.

Source⁠​‌​‌‌​‌​⁠: ICSI Guideline Answers, December 2022, Q. 3(c) (Syllabus 2017).

Nothing in Information Technology Act, 2000, shall apply to documents or transactions specified in the First Schedule. The documents or transactions mentioned in first schedule are as under:

1.A negotiable instrument (other than a cheque) as defined in section 13 of the Negotiable Instruments Act, 1881.

2.A power-of-attorney as defined in section 1A of the Powers-of-Attorney Act, 1882.

3.A trust as defined in Section 3 of the Indian Trust Act, 1882.

4.A will as defined in clause (h) of section 2 of the Indian Succession Act, 1925, including any other testamentary disposition by whatever name called.

5.Any contract for the sale or conveyance of immovable property or any interest in such property.

Alternate Answer

Nothing in Information Technology Act, 2000(the Act), shall apply to documents or transactions specified in the First Schedule. Documents or Transactions to which the Act will not apply are as follows:

1.A negotiable instrument (other than a cheque, a Demand Promissory Note or a Bill of Exchange issued in favour of or endorsed by an entity regulated by the Reserve Bank of India, National Housing Bank, Securities and Exchange Board of India, Insurance Regulatory and Development Authority of India and Pension Fund Regulatory and Development Authority)

as defined in Section 13 of the Negotiable Instrument Act, 1881.

2.A power-of-attorney as defined in section 1A of the Powers-of-Attorney Act, 1882 but excluding those power-of-attorney that empower an entity regulated by the Reserve Bank of India, National Housing Bank, Securities and Exchange Board of India, Insurance Regulatory and Development Authority of India and Pension Fund Regulatory and Development Authority to act for, on behalf of, and in the name of the person executing them.

3.A trust as defined in section 3 of the Indian Trust Act, 1882.

4.A will as defined in clause (h) of section 2 of the Indian Succession Act, 1925, including any other testamentary disposition by whatever name called.

Source⁠​‌​‌‌​‌​⁠: ICSI Guideline Answers, December 2024, Q. 3(d) (Syllabus 2017).

The provisions in Information Technology Act, 2000, does not apply to documents or transactions specified in the First Schedule. The documents or transactions mentioned in the First Schedule are as under:

(i)A negotiable instrument (other than a cheque) as defined in Section 13 of the Negotiable Instruments Act, 1881.

(ii)A power-of-attorney as defined in Section 1A of the Powers-of-Attorney Act, 1882.

(iii)A trust as defined in Section 3 of the Indian Trust Act, 1882.

(iv)A will as defined in clause (h) of Section 2 of the Indian Succession Act, 1925, including any other testamentary disposition by whatever name called.

(v)Any contract for the sale or conveyance of immovable property or any interest in such property.

Alternate Answer 6(a)

The provisions in Information Technology Act, 2000, does not apply to documents or transactions specified in the First Schedule. The documents or transactions mentioned in the First Schedule are as under:

1.A negotiable instrument (other than a cheque, a Demand Promissory Note or a Bill of Exchange issued in favour of or endorsed by an entity regulated by the Reserve Bank of India, National Housing Bank, Securities and Exchange Board of India, Insurance Regulatory and Development Authority of India and Pension Fund Regulatory and Development Authority)

as defined in Section 13 of the Negotiable Instrument Act, 1881.

2.A power-of-attorney as defined in section 1A of the Powers-of-Attorney Act, 1882 but excluding those power-of-attorney that empower an entity regulated by the Reserve Bank of India, National Housing Bank, Securities and Exchange Board of India, Insurance Regulatory and Development Authority of India and Pension Fund Regulatory and Development Authority to act for, on behalf of, and in the name of the person executing them.

3.A trust as defined in section 3 of the Indian Trust Act, 1882.

4.A will as defined in clause (h) of section 2 of the Indian Succession Act, 1925, including any other testamentary disposition by whatever name called.

Source⁠​‌​‌‌​‌​⁠: ICSI Guideline Answers, June 2024, Q. 6(a) (Syllabus 2017).

An information provider is a person who provides information to the body corporate and under these rules, he has certain rights over the sensitive personal information, this information cannot be collected without the providers’ consent and he or she has the right to abstain from giving consent and can withdraw the consent by writing to the body corporate.

i.Privacy Policy Rule 4 requires a body corporate to provide a privacy policy on their website, which is easily accessible, provides for the type and purpose of personal, sensitive personal information collected and used, and reasonable security practices and procedures.

ii.Consent Rule 5 requires that prior to the collection of sensitive personal data, the body corporate must obtain consent, either in writing or through fax regarding the purpose of usage before collection of such information.

iii.Collection Limitation Rule 5 (2) requires that a body corporate should only collect sensitive personal data if it is connected to a lawful purpose and is considered necessary for that purpose.

iv.Notice Rule 5(3) requires that while collecting information directly from an individual, the body corporate must provide the following information:

(a)The fact that information is being collected

(b)The purpose for which the information is being collected

(c)The intended recipients of the information.

(d)The name and address of the agency that is collecting the information

(e)The name and address of the agency that will retain the information v. Retention Limitation Rule 5(4) requires that body corporate must retain sensitive personal data only for as long as it takes to fulfil the stated purpose or otherwise required under law.

vi.Purpose Limitation Rule 5(5) requires that information must be used for the purpose that it was collected for.

vii.Right to Access and Correct Rule 5(6) requires a body corporate to provide individuals with the ability to review the information they have provided and access and correct their personal or sensitive personal information.

viii.Right to ‘Opt Out’ and Withdraw Consent Rule 5(7) requires that the individual must be provided with the option of ‘opting out’ of providing data or information sought by the body corporate. Also, they must have the right to withdraw consent at any point of time.

ix.Grievance Officer Rule 5(9) requires that body corporate must designate a grievance officer for redressal of grievances, details of which must be posted on the body corporate’s website and grievances must be addressed within a month of receipt.

x.Disclosure with Consent, Prohibition on Publishing and Further Disclosure Rule 6 requires that body corporate must have consent before disclosing sensitive personal data to any third person or party, except in the case with Government agencies for the purpose of verification of identity, prevention, detection, investigation, on receipt of a written request. Also, the body corporate or any person on its behalf shall not publish the sensitive personal information and the third party receiving the sensitive personal information from body corporate or any person on its behalf shall not disclose it further.

xi.Requirements for Transfer of Sensitive Personal Data Rule 7 requires that body corporate may transfer sensitive personal data into another jurisdiction only if the country ensures the same level of protection and may be allowed only if it is necessary for the performance of the lawful contract between the body corporate or any person on its behalf and provider of information or where such person has consented to data transfer.

xii.Security of Information Rule 8 requires that the body corporate must secure information in accordance with the ISO 27001 standard or any other best practices notified by Central Government, which must be audited annually or when the body corporate undertakes a significant up gradation of its process and computer resource.

Source⁠​‌​‌‌​‌​⁠: ICSI Guideline Answers, June 2025, Q. 6A(iii) (Syllabus 2022).

Documents or Transactions to which the Information Technology Act shall not apply:

1.A negotiable instrument (other than a cheque) as defined in section 13 of the Negotiable Instruments Act, 1881.

2.Power-of-attorney as defined in section 1A of the Powers-of-Attorney Act, 1882.

3.A trust as defined in section 3 of the Indian Trust Act, 1882.

4.A will as defined in clause (h) of section 2 of the Indian Succession Act, 1925, including any other testamentary disposition by whatever name called.

5.Any contract for the sale or conveyance of immovable property or any interest in such property.

Source⁠​‌​‌‌​‌​⁠: ICSI Guideline Answers, December 2020, Q. 6(b) (Syllabus 2017).

Following documents or transactions to which the Information Technology Act, 2002 shall not apply:

1.A negotiable instrument (other than a Cheque) as defined in section 13 of the Negotiable Instruments Act, 1881.

2.A power-of-attorney as defined in section 1A of the Powers-of-Attorney Act, 1882.

3.A trust as defined in section 3 of the Indian Trust Act, 1882.

4.A will as defined in clause (h) of section 2 of the Indian Succession Act, 1925, including any other testamentary disposition by whatever name called.

5.Any contract for the sale or conveyance of immovable property or any interest in such property.

Source⁠​‌​‌‌​‌​⁠: ICSI Guideline Answers, December 2019, Q. 6(a) (Syllabus 2017).

The Information Technology Act, 2000, was enacted to make, in the main, three kinds of provisions, as under:

(a)It provides legal recognition for transactions carried out by means of electronic data interchange and other means of electronic communication, usually referred to, as "electronic Commerce".

(b)It facilitates the electronic filing of documents with the Government agencies, (and also with the publication of rules etc., in the electronic form).

(c)It amends the, Indian Penal Code, the Indian Evidence Act, 1872, the Bankers' Book Evidence Act, 1891, and the Reserve Bank of India Act, 1934, so as to bring in electronic documentation within the purview of the respective enactments.

Source⁠​‌​‌‌​‌​⁠: ICSI Guideline Answers, December 2022, Q. 6(a) (Syllabus 2017).

Sections 65-78 of Chapter XI of the Information Technology Act, 2000 deal with offences relating to computers etc. and connected matters. These offences include:

Tampering with computer source documents Whoever knowingly or intentionally conceals, destroys or alters or intentionally or knowingly causes another to conceal, destroy, or alter any computer source code used for a computer, computer programme, computer system or computer network, when the computer source code is required to be kept or maintained by law for the time being in force, shall be punishable with imprisonment up to three years, or with fine which may extend up to two lakh rupees, or with both.

Computer related offences If any person, dishonestly or fraudulently, does any act referred to in section 43, he shall be punishable with imprisonment for a term which may extend to three years or with fine which may extend to five lakh rupees or with both. (Section 66)

The offences listed in Information Technology Act, 2000 are as under:

(a)Dishonestly receiving stolen computer resource or communication device

(b)Identity theft

(c)Cheating by personation by using computer resource

(d)Violation of privacy

(e)Cyber terrorism

(f)Publishing or transmitting obscene material in electronic form

(g)Publishing or transmitting of material containing sexually explicit act, etc., in electronic form

(h)Publishing or transmitting of material depicting children in sexually explicit act, etc., in electronic form

(i)Misrepresentation (j) Breach of confidentiality and privacy (k) Disclosure of information in breach of lawful contract (l) Publishing electronic signature Certificate false in certain particulars (m) Publication for fraudulent purpose.

Source⁠​‌​‌‌​‌​⁠: ICSI Guideline Answers, June 2021, Q. 5(a) (Syllabus 2017).

The 2008 amendment to the Information Technology Act, 2000 introduced Sec 10A, which provides for a greater acceptance to the electronic contract, establishing without question its validity in the eyes of the law.

Since, in an electronic record, the maker remains behind the curtain, it was considered desirable to make a provision for “attribution” of the record. An electronic record is attributed to the “originator”. [Defined in Section 2(1) (za)]. Broadly, the “originator” is the person at whose instance it was sent in the following cases -

(a)if it was sent by the originator himself; or

(b)if it was sent by a person authorised to act on behalf of the originator in respect of that electronic record; or

(c)if it was sent by an information system programmed by or on behalf of the originator to operate automatically. (Section 11)

Regarding acknowledgement of receipt of electronic records, the Act provides that where there is no agreement that the acknowledgment be given in a particular form etc. then the acknowledgement may be given by:

(a)any communication by the addressee (automated or otherwise); or

(b)any conduct of the addressee which is sufficient to indicate to the originator that the electronic record has been received. [Section 12(1)] Subject to agreement between the parties, the dispatch of an electronic record occurs, when it enters a “computer resource” outside the control of the originator. [Section 13 (1)] In this case, Prabhu sent an email quotation to Meera offering to sell goods at a discounted price. Meera’s system automatically sent an email showing acceptance of the offer due to a technical glitch, even though she did not intend to accept it. Prabhu, relied on the email, dispatched the goods which Meera refused to accept claiming that she did not send the acceptance personally and the email was sent due to an automated system error. As per the provisions mentioned above, the communication originated from an information system programmed by or on behalf of Meera to operate automatically. So, this acceptance of offer can be said to be valid and attributable to Meera and the dispatch occurs when it enters a “computer resource” outside her control.

Alternate Answer The 2008 amendment to the Information Technology Act, 2000 introduced Sec 10A, which provides for a greater acceptance to the electronic contract, establishing without question its validity in the eyes of the law.

Since, in an electronic record, the maker remains behind the curtain, it was considered desirable to make a provision for “attribution” of the record. An electronic record is attributed to the “originator”. [Defined in Section 2(1) (za)]. Broadly, the “originator” is the person at whose instance it was sent in the following cases -

(a)if it was sent by the originator himself; or

(b)if it was sent by a person authorised to act on behalf of the originator in respect of that electronic record; or

(c)if it was sent by an information system programmed by or on behalf of the originator to operate automatically. (Section 11)

Regarding acknowledgement of receipt of electronic records, the Act provides that where there is no agreement that the acknowledgment be given in a particular form etc. then the acknowledgement may be given by:

(a)any communication by the addressee (automated or otherwise); or

(b)any conduct of the addressee which is sufficient to indicate to the originator that the electronic record has been received. [Section 12(1)] Subject to agreement between the parties, the dispatch of an electronic record occurs, when it enters a “computer resource” outside the control of the originator. [Section 13 (1)] In this case, Prabhu sent an email quotation to Meera offering to sell goods at a discounted price. Meera’s system automatically sent an email showing acceptance of the offer due to a technical glitch, even though she did not intend to accept it. Prabhu, relied on the email, dispatched the goods which Meera refused to accept claiming that she did not send the acceptance personally and the email was sent due to an automated system error.

Although Section 11 attributes automated messages to the originator, the issue of actual consent remains relevant under the Indian Contract Act, 1872. If, Meera proves that the acceptance was generated solely due to a technical malfunction and did not represent consensus ad idem, a court may examine whether a valid contract was formed despite attribution under the Information Technology Act, 2000.

Source⁠​‌​‌‌​‌​⁠: ICSI Guideline Answers, June 2026, Q. 2(a) (Syllabus 2022).

The Central Government under the Information Technology Act, 2000 may prescribe the security procedure for electronic records, having regard to the commercial circumstances prevailing at the time when the procedure is used (Section 16). When the security procedure has been applied to an electronic record at a specific point of time, then such record is deemed to be a secure electronic record, from such point of time to the time of verification. (Section 14)

An electronic signature shall be deemed to be a secure electronic signature if—

(i)the signature creation data, at the time of affixing signature, was under the exclusive control of signatory and no other person; and

(ii)the signature creation data was stored and affixed in such exclusive manner as may be prescribed. (Section 15).

Source⁠​‌​‌‌​‌​⁠: ICSI Guideline Answers, December 2020, Q. 2A(i) (Syllabus 2017).

According to Section 2(1) (p) of the Information Technology Act, 2000, “Digital Signature” means authentication of any electronic record by a subscriber by means of an electronic method or procedure in accordance with the provisions of Section 3 of the Information Technology Act, 2000.

Digital signature (i.e. authentication of an electronic record by a subscriber, by electronic means) is recognised as a valid method of authentication. The authentication is to be effected by the use of “asymmetric crypto system and hash function”, which envelop and transform electronic record into another electronic record.

According to Section 2(1) (ta) of the Information Technology Act, 2000, “Electronic Signature” means authentication of any electronic record by a subscriber by means of the electronic technique specified in the Second Schedule and includes digital signature.

Section 3A of the Information Technology Act, 2000 deals with electronic signature.

A subscriber may authenticate any electronic record by such electronic signature or electronic authentication technique which is considered reliable; and may be specified in the Second Schedule.

Central Government may prescribe the procedure for the purpose of ascertaining whether electronic signature is that of the person by whom it is purported to have been affixed or authenticated.

Source⁠​‌​‌‌​‌​⁠: ICSI Guideline Answers, December 2018, Q. 2A(i) (Syllabus 2017).

“Digital signature” means authentication of any electronic record by a subscriber by means of an electronic method or procedure in accordance with the provisions of Section 3 of the Information Technology Act 2000 (Act). [Section 2(1) (p)] “Electronic signature” means authentication of any electronic record by a subscriber by means of the electronic technique specified in the Second Schedule and includes digital signature. [Section 2(1) (ta)] According to section 3 of Information Technology Act, 2000, Digital signature (i.e. authentication of an electronic record by a subscriber, by electronic means) is recognised as a valid method of authentication. The authentication is to be effected by the use of“asymmetric crypto system and hash function”, which envelop and transform electronic record into another electronic record.

Verification of the electronic record is done by the use of a public key of the subscriber. The private key and the public key are unique to the subscriber and constitute a functioning “key pair”.

Section 3A of the Act deals with electronic signature. Section 3A(1) provides that notwithstanding anything contained in section 3, but subject to the provisions of section 3A(2), a subscriber may authenticate any electronic record by such electronic signature or electronic authentication technique which—

(a)is considered reliable; and

(b)may be specified in the Second Schedule.

For the purposes of above any electronic signature or electronic authentication technique shall be considered reliable if –

(a)the signature creation data or the authentication data are, within the context in which they are used, linked to the signatory or, as the case may be, the authenticator and to no other person;

(b)the signature creation data or the authentication data were, at the time of signing, under the control of the signatory or, as the case may be, the authenticator and of no other person;

(c)any alteration to the electronic signature made after affixing such signature is detectable;

(d)any alteration to the information made after its authentication by electronic signature is detectable; and

(e)it fulfils such other conditions which may be prescribed.

Central Government may prescribe the procedure for the purpose of ascertaining whether electronic signature is that of the person by whom it is purported to have been affixed or authenticated.

Source⁠​‌​‌‌​‌​⁠: ICSI Guideline Answers, December 2024, Q. 2A(iv) (Syllabus 2017).

“Digital signature” means authentication of any electronic record by a subscriber by means of an electronic method or procedure in accordance with the provisions of Section 3 of the Information and Technology Act 2000. [Section 2(1) (p)] Electronic Signature Certificate” means an Electronic Signature Certificate issued under section 35 and includes Digital Signature Certificate. [Section 2(1) (tb)] Electronic Signature Certificates Sections 35-39 of the Information and Technology Act deal with Electronic Signature Certificates.

As per section 35 of the Act, certifying authority to issue electronic signature Certificates.

Procedure for obtaining an electronic signature Certificate Following is the procedure for obtaining an electronic signature Certificate:

1.Any person may make an application in the prescribed form to the Certifying Authority for the issue of an electronic signature Certificate in such form as may be prescribed by the Central Government.

2.Every such application shall be accompanied by prescribed fees.

3.Every such application shall be accompanied by a certification practice statement or where there is no such statement, a statement containing such particulars, as may be specified by regulations.

4.On receipt of an application, the Certifying Authority may, after consideration of the certification practice statement or the other statement and after making such enquiries as it may deem fit, grant the electronic signature Certificate or for reasons to be recorded in writing, reject the application. It may be noted that no application shall be rejected unless the applicant has been given a reasonable opportunity of showing cause against the proposed rejection.

Source⁠​‌​‌‌​‌​⁠: ICSI Guideline Answers, June 2024, Q. 5(b) (Syllabus 2022).

Digital Signature and Electronic Signature are not same as per the Information Technology Act, 2000. The differences between Electronic Signature and Digital Signature are as under:

value.

Source⁠​‌​‌‌​‌​⁠: ICSI Guideline Answers, December 2023, Q. 4A(iii) (Syllabus 2022).

According to Section 2(1) (tb) of the Information Technology Act, 2000(the Act), "Electronic Signature Certificate" means an Electronic Signature Certificate issued under Section 35 and includes Digital Signature Certificate.

As per section 35 of the Act, Certifying authority issues electronic signature Certificate.

Following is the procedure of obtaining electronic signature Certificate:

(1)Any person may make an application in prescribed form to the Certifying Authority for the issue of electronic signature Certificate in such form as may be prescribed by the Central Government.

(2)Every such application shall be accompanied by prescribed fees.

(3)Every such application shall be accompanied by a certification practice statement or where there is no such statement, a statement containing such particulars, as may be specified by regulations.

(4)On receipt of an application, the Certifying Authority may, after consideration of the certification practice statement or the other statement and after making such enquiries as it may deem fit, grant the electronic signature Certificate or for reasons to be recorded in writing, reject the application.

It may be noted that no application shall be rejected unless the applicant has been given a reasonable opportunity of showing cause against the proposed rejection.

Source⁠​‌​‌‌​‌​⁠: ICSI Guideline Answers, December 2023, Q. 4(a) (Syllabus 2017).

Section 2(1)(w) of the Information Technology Act, 2000(the Act) provides the definition of Intermediary. The Internet system depends, for its working, on network service providers- i.e. intermediaries. An “intermediary”, with respect to any particular electronic records, means any person who on behalf of another person receives, stores or transmits that record or provides any service with respect to that record and includes telecom service providers, network service providers, internet service providers, web-hosting service providers, search engines, online payment sites, online-auction sites, online-market places and cyber cafes.

In his capacity as an intermediary, a network service provider may have to handle matter which may contravene the Information Technology Act, 2000. To avoid such a consequence, the Act declares that no network service provider shall be liable "under Information Technology Act, 2000, rule or regulation made thereunder”, for any third party information or data made available by him, if he proves that the offence or contravention was committed without his knowledge or that he had exercised all due diligence to prevent the commission of such offence or contravention. (Section 79).

According to section 79(1) of the Information Technology Act, 2000, an intermediary shall not be liable for any third party information, data, or communication link made available or hosted by him.

According to section 79(2) of the Information Technology Act, 2000, the provisions of section 79(1) shall apply if-

(a)the function of the intermediary is limited to providing access to a communication system over which information made available by third parties is transmitted or temporarily stored or hosted; or

(b)the intermediary does not-

(i)initiate the transmission,

(ii)select the receiver of the transmission, and

(iii)select or modify the information contained in the transmission;

(c)the intermediary observes due diligence while discharging his duties under the Act and also observes such other guidelines as the Central Government may prescribe in this behalf.

According to section 79(3) of the Information Technology Act, 2000, the provisions of section 79(1) of the Act shall not apply if-

(a)the intermediary has conspired or abetted or aided or induced, whether by threats or promise or otherwise in the commission of the unlawful act;

(b)upon receiving actual knowledge, or on being notified by the appropriate Government or its agency that any information, data or communication link residing in or connected to a computer resource controlled by the intermediary is being used to commit the unlawful act, the intermediary fails to expeditiously remove or disable access to that material on that resource without vitiating the evidence in any manner.

Source⁠​‌​‌‌​‌​⁠: ICSI Guideline Answers, June 2022, Q. 3(d) (Syllabus 2017).

Section 2(1)(w) of the Information Technology Act, 2000 provides the definition of Intermediary. The Internet system depends, for its working, on network service providers-i.e. intermediaries. An “intermediary”, with respect to any particular electronic records, means any person who on behalf of another person receives, stores or transmits that record or provides any service with respect to that record and includes telecom service providers, network service providers, internet service providers, web-hosting service providers, search engines, online payment sites, online-auction sites, online-market places and cyber cafes.

In his capacity as an intermediary, a network service provider may have to handle matter which may contravene the Information Technology Act, 2000. To avoid such a consequence, the Act declares that no network service provider shall be liable "under Information Technology Act, 2000, rule or regulation made thereunder”, for any third party information or data made available by him, if he proves that the offence or contravention was committed without his knowledge or that he had exercised all due diligence to prevent the commission of such offence or contravention. (Section 79).

Source⁠​‌​‌‌​‌​⁠: ICSI Guideline Answers, December 2021, Q. 4(c) (Syllabus 2017).

The purpose of Digital Personal Data Protection Act, 2023(Act) is to provide the law relating to the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto.

According to Section 3, subject to the provisions of this Act, it shall-

(a)apply to the processing of digital personal data within the territory of India where the personal data is collected-

(i)in digital form; or

(ii)in non-digital form and digitised subsequently;

(b)also apply to processing of digital personal data outside the territory of India, if such processing is in connection with any activity related to offering of goods or services to Data Principals within the territory of India;

(c)not apply to–

(i)personal data processed by an individual for any personal or domestic purpose; and

(ii)personal data that is made or caused to be made publicly available by– (A) the Data Principal to whom such personal data relates; or (B) any other person who is under an obligation under any law for the time being in

force in India to make such personal data publicly available.

X, an individual, while blogging her views, has publicly made available her personal data on social media. In such case, the provisions of this Act do not applyon her.

Source⁠​‌​‌‌​‌​⁠: ICSI Guideline Answers, December 2024, Q. 4(c) (Syllabus 2022).

As per section 35 of the Information Technology Act, 2000, the procedure of obtaining electronic signature certificate from the Certifying Authority is as follows:

(1)Any person may make an application in prescribed form to the Certifying Authority for the issue of electronic signature certificate in such form as may be prescribed by the Central Government.

(2)Every such application shall be accompanied by prescribed fees.

(3)Every such application shall be accompanied by a certification practice statement or where there is no such statement, a statement containing such particulars, as may be specified by regulations.

(4)On receipt of an application, the Certifying Authority may, after consideration of the certification practice statement or the other statement and after making such enquiries as it may deem fit, grant the electronic signature certificate or for reasons to be recorded in writing, reject the application.

Provided that no application shall be rejected unless the applicant has been given a reasonable opportunity of showing cause against the proposed rejection.

In the given situation, Rajesh submitted the prescribed application form and paid the required fee but failed to attach the necessary certification practice statement or its substitute. While the absence of this statement could be a valid ground for rejection, the Certifying Authority was bound by the law to give Rajesh a reasonable opportunity to explain or rectify this omission before rejecting the application. By rejecting the application outrightly without giving such an opportunity, the authority violated the mandatory requirement of Section 35. Therefore, the rejection was procedurally invalid under the Information Technology Act, 2000.

Source⁠​‌​‌‌​‌​⁠: ICSI Guideline Answers, December 2025, Q. 5(a) (Syllabus 2022).

Sections 35-39 of the Information Technology Act, 2000 deal with Electronic Signature Certificates. As per section 35 of the Act, Certifying Authority issues Electronic Signature Certificate. Following is the procedure of obtaining Electronic Signature Certificate:

(1)Any person may make an application in prescribed form to the Certifying Authority for the issue of electronic signature Certificate in such form as may be prescribed by the Central Government.

(2)Every such application shall be accompanied by the prescribed fees.

(3)Every such application shall be accompanied by a certification practice statement or where there is no such statement, a statement containing such particulars, as may be specified by regulations.

(4)On receipt of an application, the Certifying Authority may, after consideration of the certification practice statement or the other statement and after making such enquiries as it may deem fit, grant the electronic signature Certificate or for reasons to be recorded in writing, reject the application.

No application shall be rejected unless the applicant has been given a reasonable opportunity of showing cause against the proposed rejection.

Source⁠​‌​‌‌​‌​⁠: ICSI Guideline Answers, June 2021, Q. 4(a) (Syllabus 2017).

Section 43 of the Information Technology Act, 2000 provides the provisions relating to Penalty and compensation for damage to computer, computer system, etc. It states:

If any person without permission of the owner or any other person who is in charge of a computer, computer system or computer network:

(a)accesses or secures access to such computer, computer system or computer network or computer resource;

(b)downloads, copies or extracts any data, computer data base or information from such computer, computer system or computer network including information or data held or stored in any removable storage medium;

(c)introduces or causes to be introduced any computer contaminant or computer virus into any computer, computer system or computer network;

(d)damages or causes to be damaged any computer, computer system or computer network, data, computer data base or any other programmes residing in such computer, computer system or computer network;

(e)disrupts or causes disruption of any computer, computer system or computer network;

(f)denies or causes the denial of access to any person authorised to access any computer, computer system or computer network by any means;

(g)provides any assistance to any person to facilitate access to a computer, computer system or computer network in contravention of the provisions of the Information Technology Act, 2000 rules or regulations made thereunder;

(h)charges the services availed of by a person to the account of another person by tampering with or manipulating any computer, computer system, or computer network;

(i)destroys, deletes or alters any information residing in a computer resource or diminishes its value or utility or affects it injuriously by any means; (j) steal, conceal, destroys or alters or causes any person to steal, conceal, destroy or alter any computer source code used for a computer resource with an intention to cause damage; he shall be liable to pay damages by way of compensation to the person so affected.

Source⁠​‌​‌‌​‌​⁠: ICSI Guideline Answers, June 2023, Q. 6(b) (Syllabus 2017).

If any person, dishonestly or fraudulently, does any act referred to in Section 43 of the Information Technology Act, 2000, he shall be punishable with imprisonment for a term which may extend to three years or with fine which may extend to five lakh rupees or with both. (Section 66 of the Information Technology Act, 2000)

The offences listed in the Information Technology Act, 2000 are as follows:

—Dishonestly receiving stolen computer resource or communication device — Identity theft — Cheating by personation by using computer resource — Violation of privacy — Cyber terrorism — Publishing or transmitting of material containing sexually explicit act, etc., in electronic form — Publishing or transmitting of material depicting children in sexually explicit act, etc., in electronic form — Misrepresentation — Breach of confidentiality and privacy — Disclosure of information in breach of lawful contract — Publishing electronic signature Certificate false in certain particulars — Publication for fraudulent purpose.

Source⁠​‌​‌‌​‌​⁠: ICSI Guideline Answers, June 2019, Q. 3(d) (Syllabus 2017).

As per Section 43A of the Information Technology Act, 2000, where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate shall be liable to pay damages by way of compensation to the person so affected.

According to Section 46 of the Information Technology Act, 2000, an adjudication officer is to be appointed by the Central Government for adjudging whether any person has committed a contravention of the Act or of any rule, regulation, direction or order issued under the Act. He may impose penalty or award compensation in accordance with the provisions of the relevant section.

Source⁠​‌​‌‌​‌​⁠: ICSI Guideline Answers, December 2018, Q. 6A(i) (Syllabus 2017).

Section 43A of the Information Technology Act, 2000 provides that when a body corporate possesses, deals with, or handles sensitive personal data or information in a computer resource and fails to implement reasonable security practices and procedures, causing wrongful loss or wrongful gain, the body corporate is liable to pay compensation to the affected persons. A body corporate includes companies, firms, and other associations engaged in commercial or professional activities.

In the present situation, MediCare Plus Pvt. Ltd. is a private healthcare company, therefore it qualifies as a body corporate. The company collected and stored sensitive personal data such as, medical records, Aadhaar details, Bank account information, Diagnostic reports etc. These types of information are considered sensitive personal data. However, the company failed to implement reasonable security practices. Due to this negligence, hackers gained unauthorized access and leaked patient data, which resulted in financial fraud and reputational harm to the patients.

In view of the facts, MediCare Plus Pvt. Ltd. can be held liable under section 43A of Information Technology Act, 2000.

Source⁠​‌​‌‌​‌​⁠: ICSI Guideline Answers, June 2026, Q. 3(c) (Syllabus 2022).

According to explanation to Section 43A of the Information Technology Act, 2000:

“Body corporate” means any company and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities; “Reasonable security practices and procedures” means security practices and procedures designed to protect such information from unauthorised access, damage, use, modification, disclosure or impairment, as may be specified in an agreement between the parties or as may be specified in any law for the time being in force and in the absence of such agreement or any law, such reasonable security practices and procedures, as may be prescribed by the Central Government in consultation with such professional bodies or associations as it may deem fit; “Sensitive personal data or information” means such personal information as may be prescribed by the Central Government in consultation with such professional bodies or associations as it may deem fit.

According to section 43A of Information Act, 2000 where a body corporate possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate shall be liable to pay damages by way of compensation to the person so affected.

Source⁠​‌​‌‌​‌​⁠: ICSI Guideline Answers, December 2025, Q. 6A(i) (Syllabus 2022).

Section 44 of the Information Technology Act, 2000 provides the provisions relating to Penalty for failure to furnish information, return, etc. It states:

If any person who is required under the Information Technology Act, 2000 or any rules or regulations made thereunder to:

(a)furnish any document, return or report to the Controller or the Certifying Authority fails to furnish the same, he shall be liable to a penalty not exceeding one lakh and fifty thousand rupees for each such failure;

(b)file any return or furnish any information, books or other documents within the time specified therefor in the regulations fails to file return or furnish the same within the time specified therefor in the regulations, he shall be liable to a penalty not exceeding five thousand rupees for every day during which such failure continues;

(c)maintain books of account or records, fails to maintain the same, he shall be liable to a penalty not exceeding ten thousand rupees for every day during which the failure continues.

Source⁠​‌​‌‌​‌​⁠: ICSI Guideline Answers, June 2023, Q. 3(d) (Syllabus 2017).

Section 57 of the Information Technology Act, 2000 (IT Act) provides that any person aggrieved by an order of the Controller of Certifying Authorities or of the adjudicator can appeal to the Appellate Tribunal within 45 days.

In the given situation, Deepak received the certified copy of the order on 3rd April, 2023 and filed an appeal against the decision with the Telecom Disputes Settlement and Appellate Tribunal on 3rd May, 2023. As the appeal have been filed within the stipulated time of 45 days, the appeal is valid.

Source⁠​‌​‌‌​‌​⁠: ICSI Guideline Answers, December 2023, Q. 6A(iv) (Syllabus 2017).

According to section 79(1) of the Information Technology Act, 2000 an intermediary shall not be liable for any third-party information, data, or communication link made available or hosted by him. According to section 79(2)(c), the provisions of sub-section

(1)shall apply if the intermediary observes due diligence while discharging his duties under this Act and also observes such other guidelines as the Central Government may prescribe in this behalf.

In the case of Google India Private Limited vs. Visakha Industries and Ors. (10.12.2019

-SC) the Supreme Court decided that Section 79 of Information Technology Act, 2000(the Act) as originally enacted, did not deal with the effect of other laws.

The Supreme Court inter alia decided that the finding by the High Court that in the case on hand, in spite of the complainant issuing notice, bringing it to the notice of the Appellant about the dissemination of defamatory matter on the part of the first Accused through the medium of Appellant, Appellant did not move its little finger to block the said material to stop dissemination and, therefore, cannot claim exemption Under Section 79 of the Act, as it originally stood, is afflicted with two flaws. In the first place, the High Court itself has found that Section 79, as it originally was enacted, had nothing to do with offences with laws other than the Act. We have also found that Section 79, as originally enacted, did not deal with the effect of other laws. In short, since defamation is an offence Under Section 499 of the Indian Penal Code, Section 79, as it stood before substitution, had nothing to do with freeing of the Appellant from liability under the said provision.

In view of the above discussion, it can be said that Section 79 of Information Technology Act, 2000 as originally enacted does not deal with effect of other laws.

Source⁠​‌​‌‌​‌​⁠: ICSI Guideline Answers, December 2023, Q. 4(b) (Syllabus 2022).