Section 2 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Section 2(1) of the Information Technology Act, 2000 is the dictionary of the Act. This article covers seventeen of its terms: access, addressee, communication device, computer, computer network, computer resource, computer system, cyber cafe, cyber security, data, electronic form, electronic record, function, information, intermediary, originator and secure system. The remaining definitions, such as digital signature and Certifying Authority, are in our article on section 2: digital signature, electronic signature, certifying authority and key pair.
Almost every provision of the Act turns on these words. "Computer resource" covers a computer, computer system, computer network, data, computer database or software. "Intermediary" is any person who, on behalf of another person, receives, stores or transmits an electronic record or provides a service with respect to it, and the definition names telecom, internet, web-hosting, search, payment, auction, marketplace and cyber cafe operators. An originator or addressee is never an intermediary.
Source and scope
This article follows the consolidated text consulted (the Act as amended by the Information Technology (Amendment) Act, 2008). Later amendments and the current position of each definition should be checked. The section opens with the words "In this Act, unless the context otherwise requires", so a definition applies only where the context does not point the other way. If your business is not sure whether it is an intermediary under the Act, a legal consultation on your actual services is a sensible first step.
The hardware and network terms
Computer (clause (i)). Any electronic, magnetic, optical or other high-speed data processing device or system which performs logical, arithmetic and memory functions by manipulations of electronic, magnetic or optical impulses. It "includes all input, output, processing, storage, computer software or communication facilities which are connected or related to the computer in a computer system or computer network". The definition is wide: it is by function, not by the kind of device.
Computer system (clause (l)). A device or collection of devices, including input and output support devices and excluding calculators which are not programmable and capable of being used in conjunction with external files, which contain computer programmes, electronic instructions, input data and output data, and which perform logic, arithmetic, data storage and retrieval, communication control and other functions.
Computer network (clause (j)). The inter-connection of one or more computers or computer systems or communication device through (i) satellite, microwave, terrestrial line, wire, wireless or other communication media, and (ii) terminals or a complex of two or more inter-connected computers or communication devices, "whether or not the inter-connection is continuously maintained".
Communication device (clause (ha)). Cell phones, personal digital assistance or combination of both, or any other device used to communicate, send or transmit any text, video, audio or image.
Computer resource (clause (k)). Computer, computer system, computer network, data, computer database or software. Offence and compensation provisions later in the Act (for example section 43, see our article on section 43) use this term, so its width carries through.
The information terms
Data (clause (o)). A representation of information, knowledge, facts, concepts or instructions which are being prepared or have been prepared in a formalized manner, and is intended to be processed, is being processed or has been processed in a computer system or computer network. It may be in any form, including computer printouts, magnetic or optical storage media, punched cards, punched tapes, or stored internally in the memory of the computer. This Act's "data" is a different term from "digital personal data" in the data-protection statute; for that see our post on section 2 of the Digital Personal Data Protection Act, 2023.
Information (clause (v)). Includes data, message, text, images, sound, voice, codes, computer programmes, software and databases or micro film or computer generated micro fiche. The printed list begins in square brackets in the copy; the list is "includes", so it is not closed.
Electronic form (clause (r)). With reference to information, any information generated, sent, received or stored in media, magnetic, optical, computer memory, micro film, computer generated micro fiche or similar device.
Electronic record (clause (t)). Data, record or data generated, image or sound stored, received or sent in an electronic form or micro film or computer generated micro fiche. Legal recognition of such a record is the subject of section 4, explained in our article on legal recognition of electronic records.
Function (clause (u)). In relation to a computer, includes logic, control, arithmetical process, deletion, storage and retrieval and communication or telecommunication from or within a computer.
Access (clause (a)). With its grammatical variations and cognate expressions, gaining entry into, instructing or communicating with the logical, arithmetical or memory function resources of a computer, computer system or computer network.
The people in the chain
Originator (clause (za)). A person who sends, generates, stores or transmits any electronic message, or causes any electronic message to be sent, generated, stored or transmitted to any other person, "but does not include an intermediary".
Addressee (clause (b)). A person who is intended by the originator to receive the electronic record, "but does not include any intermediary".
Intermediary (clause (w)). "With respect to any particular electronic records", any person who on behalf of another person receives, stores or transmits that record or provides any service with respect to that record. The printed list says it includes telecoms service providers, network service providers, internet service providers, web-hosting service providers, search engines, online payment sites, online-auction sites, online-market places and cyber cafes. Two points follow from the words. The status is tied to a particular record, so the same business can be an intermediary for one record and an originator for another. And the list begins with "includes", so it is not limited to the named kinds. The conditions on which an intermediary is exempt from liability are in section 79, covered in our article on exemption from liability of an intermediary.
Cyber cafe (clause (na)). Any facility from where access to the internet is offered by any person in the ordinary course of business to the members of the public.
Security terms
Cyber security (clause (nb)). Protecting information, equipment, devices computer, computer resource, communication device and information stored therein from unauthorized access, use, disclosure, disruption, modification or destruction. The copy prints "devices computer" without a punctuation mark between the two words; we quote it as printed.
Secure system (clause (ze)). Computer hardware, software and procedure that (a) are reasonably secure from unauthorized access and misuse, (b) provide a reasonable level of reliability and correct operation, (c) are reasonably suited to performing the intended functions, and (d) adhere to generally accepted security procedures.
Quick reference
| Term | Clause | Core idea |
|---|---|---|
| Access | (a) | Gaining entry into, instructing or communicating with a computer's resources |
| Addressee | (b) | Person intended by the originator to receive the record; not an intermediary |
| Communication device | (ha) | Cell phones, personal digital assistance or any device that sends text, video, audio or image |
| Computer | (i) | Electronic, magnetic or optical data processing device or system |
| Computer network | (j) | Inter-connection of computers or communication devices |
| Computer resource | (k) | Computer, system, network, data, database or software |
| Computer system | (l) | Device or collection of devices with programmes and data |
| Cyber cafe | (na) | Public internet access facility offered in the ordinary course of business |
| Cyber security | (nb) | Protection from unauthorized access, use, disclosure, disruption, modification or destruction |
| Data | (o) | Representation of information prepared for processing in a computer |
| Electronic form | (r) | Information generated, sent, received or stored in electronic or similar media |
| Electronic record | (t) | Data, record, image or sound in electronic form |
| Function | (u) | Logic, control, storage, retrieval, communication and so on |
| Information | (v) | Includes data, message, text, images, sound, voice, codes, software, databases |
| Intermediary | (w) | Receives, stores or transmits a record, or provides a service for it, for another |
| Originator | (za) | Sends, generates, stores or transmits a message; not an intermediary |
| Secure system | (ze) | Reasonably secure, reliable, suited to its function, generally accepted procedures |
A worked example
Nimbus Hosting Private Limited stores a customer's website files and passes visitors' requests to them. For those records it receives and stores on behalf of another person, so it fits the definition of an intermediary. Rohan, the customer, writes a message and sends it to Latha through the site. Rohan is the originator and Latha the addressee; Nimbus is neither. If Nimbus itself posts a notice on its own website, it is the originator of that notice. The consequences of the label (for example under section 79) depend on the rest of the Act, not on this section alone.
Need help with the definitions of the Act?
If you run a platform, hosting service or cyber cafe and want to know whether the intermediary definition fits your business, we can read your services against the text. Speak to us about a legal consultation before you rely on any exemption.
Key takeaways
- Section 2(1) applies "unless the context otherwise requires".
- "Computer resource" is wider than a computer: it includes data, a database and software.
- An intermediary is defined for a particular electronic record, on behalf of another person.
- Originators and addressees are not intermediaries.
- "Includes" in clauses (v) and (w) means the lists are not exhaustive.
Read next
- Section 2: digital signature, electronic signature, certifying authority and key pair defined
- Section 1: short title, extent, application and First Schedule exclusions
- Section 79: exemption from liability of an intermediary
- Cyber law: Information Technology Act 2000, offences, penalties and adjudication
Disclaimer: Based on a consolidated copy of the Information Technology Act, 2000 as amended by the Information Technology (Amendment) Act, 2008, on the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 as originally notified on 25 February 2021 and on the CERT-In Directions of 28 April 2022, read with the amendments made to the Act by the Jan Vishwas (Amendment of Provisions) Act, 2023 and by section 44 of the Digital Personal Data Protection Act, 2023, as consulted on 2 October 2026. Commencement notifications, other amendments, rules, directions and the current position of each provision are not covered and should be checked. This article is general information, not legal advice; check the official text before acting.