Cyber Laws

Cyber Laws is a comprehensive, analytically driven textbook on India's cyber-law regime. It traces the framework from its origins in the Information Technology Act 2000—India's first cyber legislation, modelled on the UNCITRAL Model Law on E-Commerce (UN General Assembly Resolution A/RES/51/162 of 30th January 1997) and brought into force on 17th October 2000—through its successive amendments (notably 2008), right up to the newest statutes reshaping the field: the Digital Personal Data Protection Act 2023 and the DPDP Rules (notified November 2025), the Promotion and Regulation of Online Gaming Act 2025, and the cyber-relevant provisions of the reformed criminal codes, the Bharatiya Nyaya Sanhita 2023, Bharatiya Nagarik Suraksha Sanhita 2023, and Bharatiya Sakshya Adhiniyam 2023. It even weighs in on the Jan Vishwas Act 2023 (which decriminalised certain offences) and the yet-incomplete Digital India Act.

The book's stated centre of gravity is the regulation of cybercrime—approached from both its substantive side (what conduct is prohibited, and what civil or criminal liability attaches) and its procedural side (how cyber offences are investigated, how jurisdiction is invoked, how cases are adjudicated and appealed, and how digital evidence must be handled). Around that core, it builds out the connected themes that make up modern cyber law: e-commerce and e-governance, cyber civil wrongs, internet-intermediary obligations and liability, digital evidence and cyber forensics, data protection and privacy, the State's special surveillance and content-blocking powers, cross-border cooperation, and the regulatory challenges posed by emerging technologies.

A defining feature is that the author treats cyber law as an inherently 'techno-legal' and interdisciplinary subject—repeatedly explaining the underlying technology (from IP addresses and malware to agentic AI, deepfakes, and quantum cryptography) before mapping it onto the relevant statutory provisions and case law. The result is a single, unusually current reference that deliberately bridges technological concepts and legal principles, written in a lucid, illustration-rich style by one of India's leading academic authorities on cyber and criminal law.

The book is written for a broad, multidisciplinary readership, and its dual substantive/procedural structure lets each group use it differently:

• Students of Law, Cyber Law, and Cyber Forensics—including LL.B., LL.M., and specialised post-graduate diploma candidates—who need one text spanning both the doctrine and the practice
• Academicians and Researchers wanting an organised, heavily referenced account of India's cyber-law framework and its interface with international instruments
• Legal Practitioners advising on cybercrime, intermediary liability, e-commerce, data protection, and privacy disputes, who need the precise sections to invoke
• Law Enforcement Officers, Investigators, and Prosecutors who must understand the procedural provisions, jurisdictional principles, and evidentiary/forensic requirements governing cybercrime—the book explicitly emphasises identifying the correct sections for registering an FIR, framing a chargesheet, framing charges, and taking cognisance
• Compliance, Data-protection, and Technology Professionals (including prospective Data Protection Officers and Consent Managers) grappling with obligations under the DPDP Act and Rules and the intermediary regime
• The Judiciary and Adjudicating Authorities dealing with the adjudication, penalty, and appeal mechanisms under the IT Act and the DPDP Act

The Present Publication is the 1st Edition, authored by Dr Nagarathna Annappa, with the following noteworthy features:

• [Complete Legislative Evolution] Traces Indian cyber law from the IT Act 2000 (based on the UNCITRAL Model Law on E-Commerce) through its 2008 and later amendments to the DPDP Act 2023—showing how a statute originally built to facilitate e-commerce became the country's principal cybercrime and cyber-security law
• [Comprehensive Thematic Coverage] Intermediary liability, e-commerce, e-governance, privacy, data protection, and online gaming each receive dedicated treatment
• [Civil Wrongs and Cybercrimes Distinguished] Cleanly separates the civil-liability regime (Sections 43, 43A, 44, 45) from the criminal regime (Sections 65–85 and beyond), and explains where the two overlap
• [Substantive and Procedural Focus] Investigation, jurisdiction, adjudication, appeals, and enforcement are given weight comparable to the offences themselves
• [Digital Evidence and Cyber Forensics] A specialised, techno-legal treatment, including the shift to the Bharatiya Sakshya Adhiniyam 2023 and the Section 63 certificate regime
• [Fully Updated (2024–2026)] Reflects the latest statutes, rules, and judicial pronouncements, including the newest legislative and case-law developments
• [Illustrations and Landmark Cases] Worked hypotheticals throughout, plus analysis of decisions such as Shreya Singhal, the Puttaswamy privacy rulings, Anvar P.V. v. P.K. Basheer, ICICI Bank v. Uma Shankar, Kunal Kamra, and X Corp (Twitter) v. Union of India
• [Concept-based, 'Techno-Legal' Approach] Explains the technology before the law, bridging the two for readers without a technical background
• [Cross-audience Utility] Useful to students, academicians, researchers, practitioners, law-enforcement personnel, and other professionals alike

Across nineteen chapters, the book moves through several connected clusters:

• Foundations and the Digital Economy (Chapters 1–3)
• It opens by locating cyber law as a new branch of law born of technological change, and explains how the IT Act 2000 made parallel amendments to the Indian Penal Code 1860, the Indian Evidence Act 1872, the Banker's Books Evidence Act 1891, and the Reserve Bank of India Act 1934. Chapter 2 details the statute's evolution and amendments (including the 2002/2003 changes and the pivotal 2008 amendment that widened definitions, added Sections 66B–66E and 67A/67B, inserted Section 43A for data protection, and introduced the Examiner of Electronic Evidence under Section 79A). Chapter 3 covers e-commerce and e-governance—electronic records, electronic and digital signatures, and e-contracts under the Act
• Cyber Wrongs and Cybercrimes (Chapters 4–8, 11)
• Chapter 4 is a rich conceptual anatomy of cybercrime: its salient features (anonymity, transnational reach, technical evidence, fast-changing forms), its classifications (against individuals, organisations, and society; and by whether the computer is the target, tool, or repository), and a detailed catalogue of forms—hacking, phishing/vishing/smishing, malware and worms, data theft and destruction, internet time theft, spam, cyber-pornography and child pornography, cyber-stalking, voyeurism, cyber-terrorism and cyber-warfare (with the Tallinn Manual), identity theft, online fraud (courier fraud, 'pig-butchering'/crypto scams, digital arrest and extortion), corporate espionage, DoS/DDoS attacks, source-code offences, IPR crimes and software piracy, and AI-based cybercrimes such as deepfakes and AI-assisted attacks. Chapter 5 sets out the civil-wrong regime (with the full text of Section 43 and the ICICI Bank v. Uma Shankar phishing decision); Chapter 6 covers adjudication of civil cases, compensation, appeals, compounding, and the intersection with the DPDP Act; Chapter 7 details substantive regulation of cybercrimes under the IT Act, corporate criminal liability, intermediary liability, and the new cyber-offences under the Bharatiya Nyaya Sanhita; Chapter 8 addresses investigation and the procedural code; and Chapter 11 works through the jurisdiction principles that cross-border cybercrime raises
• Institutions and State Powers (Chapters 9–10)
• The institutional machinery for adjudicating cyber civil wrongs and investigating cybercrimes—including cyber forensics labs and national cyber-security bodies—and the government's special powers under Sections 69, 69A, and 69B (e-surveillance and decryption, blocking of online content, and traffic-data monitoring), consistently framed against the countervailing rights to privacy and free expression
• Intermediaries (Chapter 12)
• A thorough treatment of internet-intermediary obligation and liability—the Section 79 'safe harbour,' the Intermediary Guidelines and Digital Media Ethics Code Rules, 2021 and their successive amendments (2022, 2023, 2025, and the February 2026 amendment on synthetically-generated information), the significant-social-media-intermediary and grievance-redressal machinery, the evolving due-diligence framework, and the consequences of non-compliance
• Digital Evidence and Forensics (Chapter 13)
• The legal perspective on digital evidence and forensics, the prescribed SOPs/manuals, and the recent changes wrought by the Bharatiya Sakshya Adhiniyam 2023, including the Section 63 certificate
• Data Protection and Privacy (Chapters 14–16)
• Data protection under the IT Act; personal-data protection and the right to privacy as a fundamental right; and a dedicated, granular overview of the DPDP Act 2023 and its Rules—scope and extraterritorial application, the key roles (Data Principal, Data Fiduciary, Significant Data Fiduciary, Data Processor, Data Protection Officer, Consent Manager), consent and notice requirements, legitimate uses and State exemptions (Sections 7 and 17), the rights of data principals (access, correction, erasure, grievance redressal), erasure-vs-retention timelines under the Schedules, children's and persons-with-disability data, cross-border transfer, and the Data Protection Board of India and its phased implementation
• Online Gaming (Chapter 17)
• A focused account of the Promotion and Regulation of Online Gaming Act 2025 (assented on 22nd August 2025) and the Online Gaming Rules 2025 (effective 1st May 2026): the definitions of online game, online money game, online social game, and e-sports; the prohibition of online money games and their advertising and financial facilitation (Sections 5–7); the newly constituted National Online Gaming Commission (NOGC), also styled the Online Gaming Authority of India; offences and penalties (imprisonment up to three years and fines up to ₹1 crore); corporate liability; and blocking powers read with Section 69A of the IT Act
• The International Dimension (Chapter 18)
• Cross-border measures for regulating cybercrime and ensuring cyber security—the Budapest Convention, the UN Cybercrime Convention, the G7 24/7 network, and India's engagement through BRICS, G20, ASEAN, and SAARC, alongside bilateral, MLAT, and extradition arrangements
• Emerging Technology (Chapter 19)
• A forward-looking capstone on the technologies straining the existing framework—Artificial Intelligence (narrow, general, and super AI, plus machine learning and agentic AI), India's AI-governance push (the India AI Mission, MEITY's AI Governance Guidelines and their six pillars), the Internet of Things, M2M and AIoT, deepfake technology (and the February 2026 intermediary-rules amendment requiring labelling of synthetically-generated content), robots and humanoids, drones (the Drone Rules 2021 and defence uses), quantum computing and its threat to current encryption, blockchain, and the metaverse—each paired with the legal and regulatory questions it raises
• Annexures and Reference Apparatus
• Eleven annexures reproduce key primary materials—the UNCITRAL resolution; MEITY notifications and the Adjudicating Officer rules; the Section 63 certificate formats under the Bharatiya Sakshya Adhiniyam; the Intermediary Guidelines and Digital Media Ethics Code Rules (2021 and the 2023 amendment); the DPDP Act commencement notification; and the National Critical Information Infrastructure Protection Centre Rules—followed by a detailed List of Cases, an Abbreviations table, and a Subject Index

The book is built as a logical progression rather than a loose collection of topics: conceptual and historical foundations first, then outward from the substantive law to the procedural law, then to the institutional machinery, then to specialised regimes (intermediaries, digital evidence, data protection, online gaming), and finally to the international and forward-looking dimensions. This substantive-to-procedural-to-institutional flow mirrors the way a cyber matter actually unfolds in practice. Its pedagogical apparatus is consistent and reader-friendly:

• Synopsis Boxes open every chapter with a map of its numbered sections, so readers can navigate straight to a provision
• Introductions and Conclusions bookend each chapter, and several chapters close with their own References list for further reading
• Illustration Boxes present worked hypotheticals that make abstract provisions concrete—for example, a neighbour tapping another's Wi-Fi to explain 'internet time theft,' or a banking scenario to explain how Consent Managers operate under the DPDP Rules
• Statutory Extracts reproduce the actual text of key provisions in indented blocks, so the commentary sits alongside the law itself
• Inline Case Analysis threads landmark and very recent judgments through the discussion rather than relegating them to a separate table
• Extensive Footnoting Points to primary sources—government notifications, PIB releases, and standards bodies—many with live URLs, reflecting an evidence-based approach
• Eleven primary-source annexures, a List of Cases, an Abbreviations key, and a Subject Index round out the reference layer

The effect is a volume that works equally well read cover-to-cover as a course text and dipped into as a desk reference.