Section 43 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Section 43 of the Information Technology Act, 2000 lists ten acts which, if done without the permission of the owner or any other person in charge of a computer, computer system or computer network, make the person liable to pay damages by way of compensation to the person affected. It is the main civil provision of the Act on unauthorised access, copying, damage and disruption.
If a person, without permission of the owner or any other person who is in charge of a computer, computer system or computer network, does any of the ten acts in clauses (a) to (j) (access, download or copy, introduce a virus, damage, disrupt, deny access, assist unauthorised access, charge another's account, destroy or alter information, or tamper with source code), he shall be liable to pay damages by way of compensation to the person so affected. No amount or ceiling is printed in section 43.
Source and scope
This article follows the consolidated text consulted (the Act as amended by the Information Technology (Amendment) Act, 2008). Later amendments and the current position of the section should be checked. The copy prints the heading as " for damage to computer, computer system, etc." in square brackets; the operative text speaks of compensation. If you are the owner of a system that has been accessed or damaged, or a person accused of such an act, our legal dispute resolution team can look at the facts against the text.
The opening words
"If any person without permission of the owner or any other person who is incharge of a computer, computer system or computer network," followed by the ten clauses. Three elements run through every clause:
- Any person: the section is not limited to employees, competitors or strangers.
- Without permission: the permission must come from the owner or any other person in charge. Conduct inside the permission is outside the section.
- Computer, computer system or computer network: defined in section 2(1)(i), (l) and (j). See our article on section 2: computer, data, information, intermediary and cyber security.
The ten acts
| Clause | Act as printed (summary) |
|---|---|
| (a) | accesses or secures access to such computer, computer system or computer network or computer resource |
| (b) | downloads, copies or extracts any data, computer database or information from it, including information or data held or stored in any removable storage medium |
| (c) | introduces or causes to be introduced any computer contaminant or computer virus into it |
| (d) | damages or causes to be damaged any computer, computer system or computer network, data, computer database or any other programmes residing in it |
| (e) | disrupts or causes disruption of any computer, computer system or computer network |
| (f) | denies or causes the denial of access to any person authorized to access it, by any means |
| (g) | provides any assistance to any person to facilitate access in contravention of the provisions of the Act, rules or regulations made thereunder |
| (h) | charges the services availed of by a person to the account of another person by tampering with or manipulating any computer, computer system or computer network |
| (i) | destroys, deletes or alters any information residing in a computer resource or diminishes its value or utility or affects it injuriously by any means |
| (j) | steals, conceals, destroys or alters, or causes any person to steal, conceal, destroy or alter, any computer source code used for a computer resource with an intention to cause damage |
Clauses (i) and (j) are printed in square brackets in the copy, as are the words "or computer resource" in clause (a). Printing slip: clause (j) reads "steel, conceals" for "steals, conceals"; we have read it as "steals".
Notice that clause (j) is the only clause with an express intention ("with an intention to cause damage"). Clauses (a) to (i) are framed by the act itself without a stated intention.
The consequence: damages by way of compensation
The liability words, printed in square brackets, read: "he shall be liable to pay damages by way of compensation to the person so affected." The heading carries the word "penalty", but the operative words speak only of compensation to the person affected. The text prints no amount and no upper limit for the compensation. This article therefore states none. How the claim is decided is dealt with in sections 46 and 47; see our articles on the adjudicating officer and power to adjudicate and on factors, compounding and recovery.
The Explanation: five definitions
For the purposes of the section:
| Term | Meaning as printed |
|---|---|
| (i) Computer contaminant | any set of computer instructions that are designed (a) to modify, destroy, record, transmit data or programme residing within a computer, computer system or computer network; or (b) by any means to usurp the normal operation of the computer, computer system or computer network |
| (ii) Computer database | a representation of information, knowledge, facts, concepts or instructions in text, image, audio, video that are being prepared or have been prepared in a formalized manner or have been produced by a computer, computer system or computer network and are intended for use in a computer, computer system or computer network |
| (iii) Computer virus | any computer instruction, information, data or programme that destroys, damages, degrades or adversely affects the performance of a computer resource or attaches itself to another computer resource and operates when a programme, data or instruction is executed or some other event takes place in that computer resource |
| (iv) Damage | to destroy, alter, delete, add, modify or rearrange any computer resource by any means |
| (v) Computer source code | the listing of programmes, computer commands, design and layout and programme analysis of computer resource in any form |
Definition (v) is printed in square brackets in the copy.
Section 43 and the criminal side
The same list of acts reappears in the criminal provision of section 66, which adds dishonest or fraudulent intention; see our article on section 66: computer-related offences. Section 43 is the civil route to compensation. The two should not be confused: section 43 prints no imprisonment. Tampering with computer source documents has its own offence in section 65; see our article on tampering with computer source documents. For the general scheme, see our overview of offences, penalties and adjudication under the Information Technology Act.
What section 43 does not say
- It does not set an amount or ceiling for compensation.
- It does not set a limitation period.
- It does not state how loss is measured.
- It does not define "permission", "owner" or "in charge".
A worked example
Krishna works in the accounts team of Marigold Textiles Private Limited. His login lets him open the payroll files only. He uses a colleague's credentials, without permission, to open the director's confidential folder and copy several files to a removable drive. On the words of the section, accessing the folder is within clause (a), and copying the files is within clause (b). Marigold may claim compensation as the person affected; the section prints no amount, so the claim has to be proved and decided under the adjudication provisions. If Krishna had instead been given the director's password by the director himself to prepare a report, the act would be within permission and outside the section. Where a former employee deletes records after leaving, clause (i) is the relevant clause; where an outside vendor introduces something that disrupts the network, clauses (c) and (e) are in point.
Need help with a section 43 claim or notice?
If your systems have been accessed or damaged, or you have received a claim alleging unauthorised access, we can review the facts, the permission position and the forum in which the matter can be heard. You can speak to our legal dispute resolution team and bring any logs, notices or correspondence.
Key takeaways
- Section 43 applies to any person acting without permission of the owner or person in charge.
- Ten acts are listed, from unauthorised access to tampering with source code.
- The liability is to pay damages by way of compensation to the person affected; no amount or ceiling is printed.
- Five Explanation definitions give meaning to contaminant, database, virus, damage and source code.
- The criminal counterpart is in section 66, not section 43.
Read next
- Section 43A: compensation for failure to protect data
- Section 46: adjudicating officer and power to adjudicate
- Section 66: computer-related offences
- Cyber law: Information Technology Act 2000, offences, penalties and adjudication
Disclaimer: Based on a consolidated copy of the Information Technology Act, 2000 as amended by the Information Technology (Amendment) Act, 2008, on the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 as originally notified on 25 February 2021 and on the CERT-In Directions of 28 April 2022, read with the amendments made to the Act by the Jan Vishwas (Amendment of Provisions) Act, 2023 and by section 44 of the Digital Personal Data Protection Act, 2023, as consulted on 2 October 2026. Commencement notifications, other amendments, rules, directions and the current position of each provision are not covered and should be checked. This article is general information, not legal advice; check the official text before acting.