Section 66 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Section 66 of the Information Technology Act, 2000 turns the civil acts listed in section 43 into an offence when they are done dishonestly or fraudulently. The punishment printed is imprisonment up to three years, or fine up to five lakh rupees, or both. This article explains the section as per the consolidated text consulted (the Act as amended by the Information Technology (Amendment) Act, 2008); later amendments and the current position should be checked.
Section 66 applies to any person who "dishonestly or fraudulently" does an act referred to in section 43. The same act without that state of mind is a matter of compensation under section 43, not an offence under section 66. The printed punishment is imprisonment for a term which may extend to three years or fine which may extend to five lakh rupees or both. The Explanation ties "dishonestly" and "fraudulently" to sections 24 and 25 of the Indian Penal Code (45 of 1860).
What section 66 says
Section 66 has one operative sentence and an Explanation. The operative sentence reads: "If any person, dishonestly or fraudulently, does any act referred to in section 43, he shall be punishable with imprisonment for a term which may extend to three years or with fine which may extend to five lakh rupees or with both."
There are three ingredients:
- A person. The section is not limited to employees, outsiders or businesses; it says "any person".
- An act referred to in section 43. Section 43 lists ten kinds of act done "without permission of the owner or any other person who is incharge of a computer, computer system or computer network". Section 66 borrows those acts and does not list them again. Our article on section 43 of the IT Act explains each clause.
- A dishonest or fraudulent state of mind. This is what separates the offence from the civil liability.
If you run a business that stores customer data, or if you manage staff who have system access, early legal dispute resolution advice, before a complaint hardens into a case, helps you read these ingredients against the facts.
The acts borrowed from section 43
The table lists the clauses of section 43 as printed, in plain words. Each is subject to the opening words of section 43 (without permission of the owner or the person in charge).
| Clause | The act, as printed in outline |
|---|---|
| (a) | accesses or secures access to a computer, computer system or computer network |
| (b) | downloads, copies or extracts data, a computer database or information, including from a removable storage medium |
| (c) | introduces or causes to be introduced a computer contaminant or computer virus |
| (d) | damages or causes to be damaged a computer, computer system or network, data, a database or programmes residing in it |
| (e) | disrupts or causes disruption of a computer, computer system or network |
| (f) | denies or causes the denial of access to a person authorised to access it |
| (g) | provides assistance to a person to facilitate access in contravention of the Act, rules or regulations |
| (h) | charges the services availed of by one person to the account of another by tampering with or manipulating the system |
| (i) | destroys, deletes or alters information residing in a computer resource, or diminishes its value or utility or affects it injuriously |
| (j) | conceals, destroys or alters a computer source code (printed as "steel, conceals") with an intention to cause damage |
Two drafting slips in the copy are worth knowing. The heading of section 43 prints "" in square brackets, and clause (j) prints "steel, conceals" where the sense is plainly "steal". We flag them and do not correct the text.
"Dishonestly" and "fraudulently"
The Explanation to section 66 gives two meanings by reference:
- (a) "dishonestly" has the meaning assigned to it in section 24 of the Indian Penal Code (45 of 1860);
- (b) "fraudulently" has the meaning assigned to it in section 25 of the Indian Penal Code (45 of 1860).
The IT Act does not repeat those meanings, and this article does not either. Check the current penal law for the corresponding provisions before relying on a reference to the Indian Penal Code.
Civil liability versus offence
| Point | Section 43 | Section 66 |
|---|---|---|
| Nature | Liability to pay damages by way of compensation | Offence with printed punishment |
| State of mind | Not stated in the section | "Dishonestly or fraudulently" |
| What is printed | Compensation "to the person so affected"; no amount or ceiling is printed | Imprisonment up to three years, or fine up to five lakh rupees, or both |
| Who decides | Read section 46, the adjudicating officer (see our article on section 46) | The criminal process described in the Act and the procedural law |
Section 77 of the Act, which is explained in our article on sections 75 to 77, says that compensation, penalty or confiscation under the Act does not prevent other punishment under any other law. The section on compounding and the three-year rule is covered in our article on sections 77A and 77B.
A worked example
Rohan Verma is an accounts executive at Kalpa Foods Private Limited, an invented company. He holds a login to the sales database only for preparing monthly invoices. After he gives notice, he copies the customer list to a personal storage device without anyone's permission and offers it to a rival trader for a price.
Reading section 66 on those facts, the questions are: was there an act listed in section 43 (clause (b) speaks of copying or extracting data), was it done without permission of the person in charge, and was it done dishonestly or fraudulently as those words are explained by reference to the Indian Penal Code? If the answer to the last question is no, the dispute may stay within section 43. If it is yes, section 66 is in play. The facts, the evidence and the language of the complaint decide which provision fits.
Section 66A: printed in the copy, omitted by the Jan Vishwas Act, 2023
The consolidated copy prints a section 66A, headed "Punishment for sending offensive messages through communication service, etc.", which deals with a person who sends information by means of a computer resource or a communication device under clauses (a) to (c) and carries an Explanation on "electronic mail" and "electronic mail message". The punishment printed is imprisonment for a term which may extend to three years and with fine.
Schedule item 32 of the Jan Vishwas (Amendment of Provisions) Act, 2023 contains an entry reading: "Section 66A shall be omitted." Section 1(2) of that Act brings it into force on a date to be appointed by the Central Government by notification, and no such date is in the sources used for this article, so check whether the omission has been brought into force.
Need help with a section 66 matter?
If you have received a police complaint, or you are considering a complaint about a data copying or system misuse incident, our team can read the facts against sections 43 and 66 and advise on the next step. Start with our legal dispute resolution service.
Key takeaways
- Section 66 punishes the acts of section 43 only when done dishonestly or fraudulently.
- Punishment printed: imprisonment up to three years, or fine up to five lakh rupees, or both.
- "Dishonestly" and "fraudulently" are tied to sections 24 and 25 of the Indian Penal Code (45 of 1860) by the Explanation; check the current penal law for the corresponding provisions.
- Section 43 prints no amount or ceiling for compensation.
- Section 66A is printed in the copy and is omitted by an item of the Jan Vishwas (Amendment of Provisions) Act, 2023; commencement is by notification and no date is in the sources.
Read next
- Section 43 of the Information Technology Act, 2000: compensation for damage to computer
- Section 65 of the Information Technology Act, 2000: tampering with computer source documents
- Section 66B of the Information Technology Act, 2000: dishonestly receiving a stolen computer resource
- Cyber Law: Information Technology Act 2000, offences, penalties and adjudication
Disclaimer: Based on a consolidated copy of the Information Technology Act, 2000 as amended by the Information Technology (Amendment) Act, 2008, on the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 as originally notified on 25 February 2021 and on the CERT-In Directions of 28 April 2022, read with the amendments made to the Act by the Jan Vishwas (Amendment of Provisions) Act, 2023 and by section 44 of the Digital Personal Data Protection Act, 2023, as consulted on 2 October 2026. Commencement notifications, other amendments, rules, directions and the current position of each provision are not covered and should be checked. This article is general information, not legal advice; check the official text before acting.