Sections 70 and 70A explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Section 70 of the Information Technology Act, 2000 lets the appropriate Government declare a computer resource which directly or indirectly affects the facility of Critical Information Infrastructure to be a protected system, and punishes unauthorised access to it with imprisonment up to ten years and liability to fine. Section 70A lets the Central Government designate a national nodal agency for Critical Information Infrastructure Protection. This article follows the consolidated text consulted (the Act as amended by the Information Technology (Amendment) Act, 2008); later amendments and the current position should be checked.
The appropriate Government may, by notification in the Official Gazette, declare a computer resource affecting Critical Information Infrastructure to be a protected system. Any person who secures access or attempts to secure access to a protected system in contravention of section 70 is punished with imprisonment up to ten years and shall also be liable to fine. Section 70A allows the Central Government to designate a national nodal agency by notification.
Section 70(1): declaring a protected system
Sub-section (1) reads: "The appropriate Government may, by notification in the Official Gazette, declare any computer resource which directly or indirectly affects the facility of Critical Information Infrastructure, to be a protected system."
The Explanation to the sub-section defines the key term: "For the purposes of this section, 'Critical Information Infrastructure' means the computer resource, the incapacitation or destruction of which, shall have debilitating impact on national security, economy, public health or safety."
| Element | What the words say |
|---|---|
| Who declares | The appropriate Government |
| How | By notification in the Official Gazette |
| What | Any computer resource which directly or indirectly affects the facility of Critical Information Infrastructure |
| Result | The resource is a "protected system" |
| Critical Information Infrastructure | A computer resource whose incapacitation or destruction shall have debilitating impact on national security, economy, public health or safety |
"Computer resource" is defined in section 2(1)(k) as "computer, computer system, computer network, data, computer database or software". Our article on section 2 of the IT Act sets out the definition. The phrase "appropriate Government" is used in section 70 without a definition in the section itself.
If you operate systems on which an essential service depends, such as payments, power, transport or health records, a legal consultation on whether any of them could be the subject of a notification, and on what an authorisation under sub-section (2) would mean for your staff and vendors, is a sensible early step.
Section 70(2): who may access
Sub-section (2) says: "The appropriate Government may, by order in writing, authorise the persons who are authorized to access protected systems notified under sub-section (1)." Access to a protected system is therefore tied to an authorisation made by order in writing. The sub-section does not list any category of person or any form of authorisation; it leaves the choice to the appropriate Government.
Section 70(3): the offence and the punishment
Sub-section (3) reads: "Any person who secures access or attempts to secure access to a protected system in contravention of the provisions of this section shall be punished with imprisonment of either description for a term which may extend to ten years and shall also be liable to fine."
| Element | Printed text |
|---|---|
| Who | "Any person" |
| Act | "secures access or attempts to secure access to a protected system in contravention of the provisions of this section" |
| Imprisonment | "of either description for a term which may extend to ten years" |
| Fine | "shall also be liable to fine"; no amount printed |
The section covers an attempt as well as success, in so many words. It prints a maximum and no minimum. Compare section 66F(1)(A)(iii), which refers to "the critical information infrastructure specified under section 70" in its list of results; our article on section 66F explains that provision.
Section 70(4): information security practices
Sub-section (4) says: "The Central Government shall prescribe the information security practices and procedures for such protected system." The Act itself prints none of those practices or procedures. Section 87(2)(y) lists the information security practices and procedures for protected system under section 70 among the matters on which rules may be made. No rule on this is in the sources used for this article, so none is described here.
Section 70A: the national nodal agency
Section 70A has three sub-sections:
| Sub-section | Text in outline |
|---|---|
| (1) | The Central Government may, by notification published in the Official Gazette, designate any organization of the Government as the national nodal agency in respect of Critical Information Infrastructure Protection |
| (2) | The national nodal agency "shall be responsible for all measures including Research and Development relating to protection of Critical Information Infrastructure" |
| (3) | The manner of performing functions and duties of the agency "shall be such as may be prescribed" |
Section 70A is separate from section 70B, which provides for the Indian Computer Emergency Response Team as the national agency for incident response; our article on section 70B explains that section. Whether any particular agency has been designated under section 70A is a question of notification, and no notification is in the sources used for this article.
General provisions that apply
Sections 77A, 77B and 78 apply to offences under the Act as printed. Section 77A bars compounding of offences "for which the punishment for life or imprisonment for a term exceeding three years has been provided"; section 77B prints "the offence punishable with imprisonment of three years and above shall be cognizable and the offence punishable with imprisonment of three years shall be bailable", which we quote and do not apply further; section 78 says a police officer not below the rank of shall investigate any offence under the Act. Section 85 deals with offences by companies. The Act refers to the Code of Criminal Procedure, 1973; check the current procedural law for the corresponding provisions.
A worked example
Rail Signal Data Limited, an invented company, runs a computer resource used in managing passenger rail signalling. Suppose the appropriate Government has notified it as a protected system under section 70(1), and has authorised three named engineers by order in writing under section 70(2). A fourth person, a contractor's employee, secures access without any authorisation. On the words of section 70(3), the contractor's employee has secured access to a protected system in contravention of the section, and the printed punishment is imprisonment up to ten years and liability to fine. If the same person had only attempted to secure access, the section reaches the attempt as well. For the company itself, the practical task is to keep a current list of authorised persons and to check each access request against that list.
Need help with a protected system or critical infrastructure question?
If your organisation operates systems that may be notified, or you need to align access and vendor arrangements with section 70, our team can help. Start with a legal consultation.
Key takeaways
- Section 70(1) lets the appropriate Government declare, by notification, a computer resource affecting Critical Information Infrastructure to be a protected system.
- Critical Information Infrastructure is defined by the effect of incapacitation or destruction: debilitating impact on national security, economy, public health or safety.
- Securing access, or attempting to secure access, in contravention of the section is punishable with imprisonment up to ten years and liability to fine.
- Section 70A lets the Central Government designate a national nodal agency by notification.
- Information security practices for protected systems are left to the Central Government to prescribe.
Read next
- Section 66F of the Information Technology Act, 2000: punishment for cyber terrorism
- Section 70B of the Information Technology Act, 2000: Indian Computer Emergency Response Team
- Section 69A of the Information Technology Act, 2000: blocking of public access to information
- IT Act 2000 and Cybercrimes in India: key provisions, offences and amendments
Disclaimer: Based on a consolidated copy of the Information Technology Act, 2000 as amended by the Information Technology (Amendment) Act, 2008, on the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 as originally notified on 25 February 2021 and on the CERT-In Directions of 28 April 2022, read with the amendments made to the Act by the Jan Vishwas (Amendment of Provisions) Act, 2023 and by section 44 of the Digital Personal Data Protection Act, 2023, as consulted on 2 October 2026. Commencement notifications, other amendments, rules, directions and the current position of each provision are not covered and should be checked. This article is general information, not legal advice; check the official text before acting.