Introduction

The Information Technology Act, 2000 (“IT Act”) is India’s primary cyber law framework governing:

• cyber offences
• unauthorized access to computer systems
• data breaches
• hacking and fraud
• electronic records and digital identity misuse

It provides two major legal consequences:

1. Penalties (civil + criminal punishment)
2. Compensation (monetary damages to victims)

These are mainly covered under:

• Section 43 (civil compensation)
• Section 43A (data protection compensation)
• Section 66 series (criminal offences)
• Sections 44–45 (residuary penalties)

I. Legal Framework for Penalties and Compensation

1. Section 43 – Civil Liability (Compensation)

If a person:

• accesses computer systems without permission
• steals data
• introduces viruses
• disrupts systems
• causes denial of service
• manipulates data

➡️ They are liable to pay compensation up to ₹1 crore to the affected party.

👉 This is a civil remedy (not criminal punishment).

2. Section 43A – Compensation for Data Protection Failure

Applies to companies (“body corporates”) that:

• fail to protect sensitive personal data
• are negligent in cybersecurity practices

➡️ Must pay damages to affected persons for wrongful loss or gain.

👉 This is the foundation of India’s data breach compensation law.

3. Section 66 – Criminal Punishment

If offences under Section 43 are done:

• dishonestly OR
• fraudulently

➡️ Punishment:

• imprisonment up to 3 years
• fine up to ₹5 lakh (or both) 

4. Section 66C & 66D – Identity Theft & Impersonation

• Identity theft (passwords, OTP misuse)
• Cheating by impersonation online

➡️ Criminal liability with imprisonment + fine

5. Section 44–45 – Residuary Penalties

Applies to:

• failure to submit documents
• non-compliance with authorities
• procedural violations

II. Types of Liability Under IT Act

1. Civil Liability (Compensation)

• Section 43
• Section 43A
  ➡️ Monetary compensation without jail

2. Criminal Liability

• Section 66 series
  ➡️ Jail + fine

3. Regulatory Liability

• adjudicating officer penalties
• compliance penalties

4. Corporate Liability

• companies liable for data protection failure
• negligence in cybersecurity systems

III. Important Case Laws on IT Act Penalties & Compensation

CASE 1

Shreya Singhal v. Union of India (2015)

Facts

Challenge to Section 66A (struck down).

Legal Principle

Freedom of speech vs cyber regulation; vague criminal provisions unconstitutional.

Relevance

Clarifies:

• criminal IT Act provisions must be precise
• protects misuse of penalty provisions

CASE 2

Avnish Bajaj v. State (NCT of Delhi) (Bazee.com Case)

Facts

Obscene content was sold online via platform.

Legal Principle

Intermediary liability can arise if due diligence fails.

Relevance

Establishes:

• platform liability under IT Act
• criminal exposure under Section 67 + Section 85

CASE 3

Kalandi Charan Lenka v. State of Odisha (2017)

Facts

Cyberstalking and identity misuse using fake accounts.

Legal Principle

Section 66C and 66D apply to impersonation and harassment.

Relevance

Shows:

• strict criminal penalties for digital identity misuse

CASE 4

Sharat Babu Digumarti v. Government (2017)

Facts

Online obscene content case involving platform liability.

Legal Principle

IT Act overrides IPC in electronic offences.

Relevance

Important for penalties:

• IT Act is the primary statute for cyber offences
• governs punishment framework exclusively

CASE 5

Tamil Nadu v. Suhas Katti (2004)

Facts

Cyber harassment and obscene messaging online.

Legal Principle

First conviction under IT Act in India.

Relevance

Shows:

• effective criminal enforcement of Sections 66 & 67
• strong penalty application for online harassment

CASE 6

Pune Citibank Mphasis Payroll Fraud Case (Cyber Fraud Principle Case Line)

Facts

Insider misused access to manipulate banking/payment systems.

Legal Principle

Unauthorized access and financial manipulation attract IT Act + IPC liability.

Relevance

Shows:

• Section 43 + 66 applied for financial cyber fraud
• compensation + criminal punishment both possible

CASE 7

Reliance Data Leakage / Corporate Cyber Breach Cases (Principle-Based)

Facts

Employee data exposed due to weak cybersecurity systems.

Legal Principle

Companies liable under Section 43A for negligence.

Relevance

Establishes:

• compensation for failure to protect sensitive personal data
• corporate liability under IT Act

CASE 8

Adjudicating Officer Cyber Fraud Compensation Cases (Various Tribunal Decisions)

Facts

Victims of hacking and unauthorized transfers awarded compensation.

Legal Principle

Adjudicating officers can award compensation up to statutory limits.

Relevance

Confirms:

• IT Act provides civil compensation mechanism up to statutory caps
• quick remedy without full civil trial

IV. Compensation Framework Under IT Act

1. Section 43 Compensation

• up to ₹1 crore
• for unauthorized access or system damage

2. Section 43A Compensation

• unlimited (based on damages proven)
• for data breach due to negligence

3. Adjudicating Officer Powers

Can:

• investigate cyber claims
• award compensation
• summon witnesses

4. Civil Court Bar

Civil courts generally barred when adjudicating officer jurisdiction applies.

V. Nature of Penalties Under IT Act

1. Monetary Penalties

• fines for non-compliance
• compensation for victims

2. Criminal Penalties

• imprisonment up to 3 years (or more under specific sections)
• fines up to ₹5 lakh or higher under special offences

3. Corporate Liability

• companies liable for negligence
• directors may be liable in certain cases

VI. Key Principles Emerging from Case Law

1. Dual Liability Principle

Same act can lead to:

• compensation (civil)
• punishment (criminal)

2. Strict Cyber Accountability

Unauthorized access = liability even without physical harm

3. Corporate Negligence Standard

Companies must implement “reasonable security practices”

4. Intermediary Responsibility

Platforms must exercise due diligence

5. IT Act Supremacy Principle

Cyber offences are primarily governed by IT Act over IPC

VII. Conclusion

Penalties and compensation under the IT Act, 2000 form a dual legal structure combining civil compensation and criminal punishment.

Key provisions:

• Section 43 → compensation up to ₹1 crore
• Section 43A → data breach compensation for negligence
• Section 66 series → criminal punishment (imprisonment + fine)
• Adjudicating officers → fast-track compensation mechanism

Key cases like:

• Shreya Singhal v. Union of India
• Avnish Bajaj v. State (Bazee.com case)
• Kalandi Charan Lenka case
• Suhas Katti case
• Sharat Babu Digumarti case
• Citibank/Mphasis fraud line cases

establish that:

1. Cyber offences attract both civil compensation and criminal liability.
2. Companies have a strict duty to protect digital systems and personal data.
3. Courts prioritize data protection, system integrity, and user harm compensation.
4. The IT Act is the primary legal framework for cyber penalties in India.

Overall, the IT Act creates a strong enforcement system balancing punishment, compensation, and regulatory control in India’s digital ecosystem.