The IT Act, 2000 for Business Readers: What It Still Does, What Has Changed, and What Is Changing Next
The Information Technology Act, 2000 still governs electronic records, signatures and cyber offences in India, but what sits around it has changed: the Evidence Act is gone, section 43A is on its way out, and the DPDP Act arrives in 2027. A business reader's guide, 2026 edition.
Most explainers of the Information Technology Act, 2000 were written a decade ago and quietly refreshed. They still cite section 65B of the Evidence Act (repealed in 2024), "Class 2" certificates (discontinued in 2021) and section 43A as India's data-protection law (being replaced). This is the 2026 edition: what the IT Act does for a business today, with the surrounding changes stated accurately. Position as of October 2026.
What the IT Act does for your documents
Electronic records are recognised. Section 4 provides that where any law requires information to be in writing, typewritten or printed, that requirement is satisfied if the information is in electronic form and accessible for subsequent reference. Section 2(1)(t) defines an electronic record broadly as data, records or images stored, received or sent in electronic form.
Electronic signatures are recognised. Section 2(1)(ta) defines an electronic signature as authentication of an electronic record by a technique in the Second Schedule, including a digital signature. Section 3 covers digital signatures (asymmetric cryptography, certificate from a licensed Certifying Authority); section 3A covers other Second Schedule techniques, of which Aadhaar e-KYC based eSign (notified 2015) is the one in daily use. Section 5 gives these the legal effect of a handwritten signature where a law requires one.
Electronic contracts are valid. Section 10A provides that where proposals, acceptances and revocations are expressed in electronic form, the contract "shall not be deemed to be unenforceable solely on the ground that such electronic form or means was used".
Some documents are outside the Act. Section 1(4) and the First Schedule exclude, after the 26 September 2022 amendment: negotiable instruments other than cheques and certain instruments in favour of RBI/SEBI/IRDAI/PFRDA/NHB-regulated entities; powers of attorney other than those in favour of such entities; trusts; and wills. The former exclusion for immovable-property contracts was deleted in 2022.
What the IT Act does for your security and liability
Civil liability for unauthorised access and damage. Section 43 makes a person who, without permission, accesses a computer system, downloads data, introduces malware or causes damage liable to pay compensation.
Compensation for failing to protect sensitive personal data. Section 43A makes a body corporate that is "negligent in implementing and maintaining reasonable security practices and procedures" for sensitive personal data liable to compensate the affected person. The IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 made under it define sensitive data (passwords, financial information, health, biometrics and so on) and treat ISO 27001 as a recognised standard. This is the provision on its way out: section 44(2)(a) of the DPDP Act, 2023 omits section 43A, but that part of the DPDP Act commences only on 13 May 2027 under the phased notifications of 13 November 2025. Until then section 43A and the 2011 Rules remain in force alongside preparation for the DPDP regime.
Offences. Section 66 punishes dishonest or fraudulent acts under section 43; section 66C punishes fraudulent use of another's electronic signature, password or identity feature; section 66D punishes cheating by personation using a computer resource; section 72 punishes breach of confidentiality by persons who obtained access under the Act; section 72A punishes a service provider that discloses personal information obtained under a lawful contract without consent, with intent to cause wrongful loss or gain. These are the provisions that make forging an e-signature or leaking contract data a criminal matter, not just a breach of contract.
Incident reporting. Section 70B establishes CERT-In; its Directions of 28 April 2022 require service providers, intermediaries, data centres, body corporates and government organisations to report listed cyber incidents within six hours of noticing them and to keep ICT logs for 180 days within India.
What has changed around the Act
| Topic | Old reference you will still see | Position in October 2026 |
|---|---|---|
| Proving an electronic record in court | Evidence Act s. 65B certificate | Bharatiya Sakshya Adhiniyam, 2023, s. 63 certificate (in force 1 July 2024) |
| DSC classes | Class 2 and Class 3 | Class 2 discontinued for new issuance from 1 January 2021 |
| Immovable property contracts | Excluded by First Schedule | Exclusion deleted 26 September 2022; registration under the Registration Act still applies |
| Personal data protection | IT Act s. 43A and SPDI Rules, 2011 | Still in force; DPDP Act, 2023 sections 3-17 and the omission of s. 43A commence 13 May 2027 |
| Data Protection Board | - | Established 13 November 2025; Chairperson and Members not reported appointed as of September 2026 |
What a business should do now
- Treat the IT Act as the basis for e-records, e-signatures and e-contracts, and stop citing the Evidence Act.
- Keep complying with section 43A and the 2011 Rules while building DPDP-ready processes (notice, consent, processor contracts, breach reporting) for May 2027.
- Check templates against the First Schedule and route excluded documents to paper.
- Align incident response with CERT-In's six-hour rule now and the DPDP Rules' 72-hour report later.
- Make sure your document systems can produce the section 63 certificate.
Where Legatio fits. Legatio executes and stores documents on the basis the IT Act provides, records the audit trail for section 63, and flags First Schedule templates. The Act itself, and the changes around it, apply to every business and every platform.
Position stated as of October 2026. General information, not legal advice.