Beginner · Rules first: ethics, law and permission · topic 2 of 35 · 20 min
The law in India: IT Act 2000, sections 43 and 66
Explanation
Why a hacker must know the law
Security work sits very close to the line between legal and criminal. The difference is often a single document: your permission to test. If you understand the law, you know exactly why that document matters and what you must never do. If you do not, you can get into serious trouble even with good intentions.
The Information Technology Act, 2000
The IT Act, 2000 is India's main law for computers and the internet. Two sections matter most to a tester.
Section 43 covers damage to a computer, system or network WITHOUT the owner's permission: accessing it, downloading or copying data, introducing a virus, causing damage, disrupting it, or denying access. It is a civil wrong: if you do these without permission, you are liable to pay compensation to the person harmed. Note the words "without permission" — that is the whole point.
Section 66 makes the same acts in section 43, when done dishonestly or fraudulently, a criminal offence. On conviction this can mean imprisonment (up to three years) or a fine, or both. So the exact same action can move from "pay money" to "go to jail" depending on intent and circumstances.
Other sections you should be aware of: 66C (identity theft, such as misusing someone's password or digital signature) and 66D (cheating by personation using a computer, such as phishing). These are the sections often used against online fraudsters.
| Section | In plain words | Type |
|---|---|---|
| 43 | Access or damage without permission → pay compensation | Civil |
| 66 | Doing section-43 acts dishonestly/fraudulently → jail and/or fine | Criminal |
| 66C | Identity theft (misusing passwords, signatures) | Criminal |
| 66D | Cheating by pretending to be someone using a computer | Criminal |
How permission protects you
Because the law turns on the words "without permission", your signed authorisation is the thing that keeps your testing on the right side of the line. It names who gave permission, what you may test, and what you may not. Keep it before you start, and keep a copy.
The newer data-protection law
India also passed the Digital Personal Data Protection Act, 2023, which governs how organisations handle people's personal data. As a tester you must be extra careful with any personal data you come across: do not copy it, keep it, or share it beyond what the engagement allows.
Need help?
Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.
Try:
Watch the lesson
The law in India: IT Act 2000, sections 43 and 66 · 1/7
Security work sits close to the legal line. The law is what defines that line.
Prefer a video by a teacher? Find free videos on “IT Act 2000 section 43 66 cyber law India explained” on YouTube ↗
In real life: A student's costly "experiment"
A college student finds that his university portal shows other students' marks if he changes the ID in the web address. Curious, he downloads a few and shares a screenshot in a group chat. Even with no intent to sell anything, he has accessed and copied data without permission — squarely inside section 43, and possibly 66 given the sharing. The right move was to stop at the first odd result and email the university's IT team.
Practice (0/3 done)
Under the IT Act, 2000, what single factor runs through sections 43 and 66?
Which section can lead to imprisonment when acts are done dishonestly or fraudulently?
Write a short note (5–8 lines) a junior tester could keep on their desk, summarising why they must never test without written permission, mentioning the IT Act.
Quick quiz
Read more (free)
Related help
Before this, learn
This topic builds on these. If something here feels new, open them first.
Related topics
- Scope and rules of engagementRules first: ethics, law and permission · same module
- The CIA triad and the tester's mindsetRules first: ethics, law and permission · same module
- Ethics and the law: permission firstCyber Security: from zero to SOC analyst · Security basics
- India: CERT-In and the legal landscapeBug bounties, disclosure and careers
- Privacy and data protectionData Science, Machine Learning and AI · Ethics, privacy and careers
- Security basics: threats, CIA and AAAComputer Networking (CCNA level) · Network security
Questions people ask about this
Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.
Section 43 of the IT Act is best described as…
Answer: A civil liability to pay compensation for unauthorised access/damage
Section 43 is civil: compensation for access or damage done without permission.
Phishing (pretending to be a bank to cheat someone online) is often charged under…
Answer: Section 66D
66D covers cheating by personation using a computer resource.
Which newer Indian law governs handling of personal data?
Answer: The Digital Personal Data Protection Act, 2023
The DPDP Act, 2023 governs personal data; testers must handle any personal data they see very carefully.
A tester downloads customer records "to prove the bug" during an engagement whose scope said not to touch customer data. This is…
Answer: Outside scope and a legal and ethical problem
Staying inside the agreed scope is mandatory; pulling data the scope forbids is both an ethical and a legal problem.
Under the IT Act 2000, which section covers unauthorised access and damage with compensation?Related
Answer: Section 43
Section 43 sets civil liability (compensation) for unauthorised access, copying, damage and similar acts.
With no permission and no programme, finding a flaw means you should…Related
Answer: Stop and report privately to the owner or CERT-In
Stop and disclose responsibly through the right channel.
Under India's DPDP Act, 2023, who is the "data principal"?Related
Answer: The individual the personal data is about
The data fiduciary is the organisation; the principal is the person.
An authorisation ("get out of jail") letter is useful because…Related
Answer: It proves the owner authorised the test if anyone questions you
It is proof of authorisation you can show on site.
Pass the quiz (60% or more) or mark this topic as done when you are ready.
Your progress is saved on this device only.
Next steps
- 2 more topics in “Rules first: ethics, law and permission” before its exam: Scope and rules of engagement, The CIA triad and the tester's mindset.
- Module 1 exam: ethics, law and permission · 13 questions · 20 min, without help. 4 topics of this module still to finish first.
- Then the next module, Your legal practice lab. 35 topics left in the course before the final exam.