Indian IT Act (2000)

The Information Technology Act, 2000 is India’s foundational law for electronic records, digital signatures and cybercrime. For two decades it was also, through Section 43A and the rules made under it, India’s principal data protection instrument — a role it is now handing over, but has not finished handing over.

That transitional position is the practically important point, and it is where most current summaries are wrong.

What the IT Act covers

Legal recognition of electronic records and signatures. This is the provision that makes digital contracting and electronic onboarding work in India at all — without it, a remotely executed agreement would have no clear standing.

Cybercrime offenses, including unauthorized access, data theft, computer-related fraud and identity theft, with Section 66C specifically covering fraudulent use of another person’s electronic signature, password or unique identification feature.

Intermediary liability, under Section 79 and the rules made under it, setting out the conditions on which platforms are protected from liability for user content.

Section 43A, which required bodies corporate handling sensitive personal data to maintain reasonable security practices, with compensation payable for negligence. The SPDI Rules, 2011 made under it defined sensitive personal data — passwords, financial information, biometric data, health data — and set consent and disclosure requirements.

What changed, and what has not

The Digital Personal Data Protection Act, 2023 is India’s dedicated data protection statute and supersedes the Section 43A regime. Its operative rules — the Digital Personal Data Protection Rules, 2025 — were notified on 13 November 2025, and implementation is phased.

The phasing matters. The Data Protection Board of India was constituted on notification; consent manager registration follows twelve months after notification; and the substantive obligations on data fiduciaries commence eighteen months after notification, on 13 May May 2027.

Section 43A and the SPDI Rules are repealed when the deferred DPDP provisions commence on 13 May 2027 — not before. Through 2026 both frameworks apply concurrently, and the prudent position for anyone handling sensitive personal data in India is to meet the higher standard of the two rather than assuming the older regime is gone.

A great deal of published material states that the IT Act’s data protection provisions have been replaced. As of 2026 that is premature.

Why it matters for identity verification

India is one of the largest digital onboarding markets in the world, and the IT Act underpins the mechanics of it.

Electronic records and signatures having legal recognition is what allows an account to be opened remotely. Sectoral KYC obligations — the Reserve Bank of India’s directions, and the rules under the Prevention of Money Laundering Act — sit on top of that, and they are the source of the identification duty rather than the IT Act itself.

The data side is where the transition bites. Biometric data is sensitive personal data under the SPDI Rules and also falls within the DPDP framework, so a flow capturing a document image and a face is regulated under both at once during the transition. The DPDP Act’s consent architecture — notice, purpose limitation, and the right to withdraw — is more prescriptive than what the SPDI Rules required, so designing to DPDP now is the sensible reading even while the older rules stand.

The practical conclusion is the same as it is under UK and EU law, for the same reason: minimize. Extract the attributes required, avoid retaining the document image, and keep the retention period tied to the obligation that requires it. Data not held is not regulated under either framework.

India compared with other regimes

What the IT Act does not do

It is not a comprehensive data protection law. Section 43A was a security and compensation provision, not a rights framework. Access, correction and erasure rights arrive with the DPDP Act.

It does not create KYC obligations. Those come from RBI directions, the PMLA rules and sector regulators. The IT Act supplies the legal validity of the electronic records those processes produce.

It does not govern Aadhaar. Aadhaar has its own statute and its own restrictions on who may use it and how, separate from ordinary document capture rules, which are separate from both the IT Act and the DPDP framework.

It has not been repealed. Its electronic records, signature, cybercrime and intermediary provisions continue regardless of the DPDP transition — only the Section 43A data protection role is being displaced.

Frequently asked questions

Has the DPDP Act replaced the IT Act 2000?

Only in part, and not yet completely. The DPDP Act supersedes the Section 43A data protection role, but that repeal takes effect when the deferred DPDP provisions commence on 13 May 2027. The IT Act’s electronic records, signature, cybercrime and intermediary provisions are unaffected.

Are the SPDI Rules still in force in 2026?

Yes. They are repealed alongside Section 43A when the deferred DPDP provisions commence on 13 May 2027, which has not happened yet. Through 2026 both frameworks apply concurrently, and organizations with sensitive personal data exposure should meet the higher standard of the two.

Is biometric data protected under Indian law?

Yes, under both frameworks during the transition. It is sensitive personal data under the SPDI Rules, and personal data with consent and purpose-limitation requirements under the DPDP Act. Aadhaar-linked biometrics carry further restrictions under separate legislation.

Does the IT Act allow remote digital onboarding in India?

It provides the foundation by giving electronic records and signatures legal recognition. The obligation to identify a customer comes from elsewhere — RBI directions and the rules under the Prevention of Money Laundering Act — which specify what verification is required.

Related reading

• GDPR — the regime India’s framework is most often compared with
• Data Protection Act 2018 — the UK comparison
• Know your customer — where India’s identification duty actually comes from
• Personally identifiable information — what counts as protected data