What is the punishment for hacking into someone's computer or account in India?

Question

Someone gained unauthorised access to my computer, email, or online account and I want to know the applicable law and punishment. I have been reading conflicting things online and I would like to understand what Indian law actually says about this, which Act and Section applies, what the realistic timelines and costs are, and what I should be doing right now to protect my position. If the matter can be resolved without litigation I would prefer that route, but I want to know what my rights are before I agree to anything or sign any document.

MyVakeel Legal Desk · Accepted Answer

What is the punishment for hacking into someone's computer or account in India? is governed in India primarily by Information Technology Act, 2000 – Section 43, Information Technology Act, 2000 – Section 66 and Bharatiya Nyaya Sanhita, 2023 – Section 331 (house trespass, by analogy). The short answer is set out below, followed by the practical steps most people in this situation need to take. Read it alongside the specific provisions named, because the exact relief available to you turns on the facts you can prove on paper.

Section 43 of the IT Act makes unauthorised access, downloading, introducing viruses, damaging data, or denying access to an authorised user a civil wrong, entitling the victim to compensation without any cap (courts/adjudicating officers can award damages based on actual loss).

Where the act is done 'dishonestly or fraudulently', Section 66 converts the same conduct into a criminal offence punishable with imprisonment up to 3 years or fine up to Rs 5 lakh, or both, making it a cognizable, bailable offence generally triable by a Magistrate.

If the hacking targets a 'protected system' (notified critical infrastructure like banking, power grids), Section 70 of the IT Act applies with much stricter punishment up to 10 years imprisonment.

Victims can approach either the police/cyber cell for criminal prosecution, or the adjudicating officer (usually the state IT Secretary) under Section 46 IT Act for a faster civil compensation claim up to Rs 5 crore without the delays of a criminal trial.

Preserve system logs, IP addresses and timestamps immediately, since digital evidence can be volatile and courts require it to be certified under Section 65B of the Indian Evidence Act (now Section 63 of the Bharatiya Sakshya Adhiniyam, 2023) to be admissible.

What to do next: 1) Disconnect the compromised system from the network and change all passwords; 2) Preserve logs and take a certified digital evidence certificate under BSA Section 63; 3) File a complaint at cybercrime.gov.in or the local cyber cell citing Sections 43/66; 4) Consider filing before the adjudicating officer for quicker civil compensation.

If the other side has already issued a notice, filed a case or set a deadline, treat the matter as time-sensitive — most remedies under Information Technology Act, 2000 – Section 43 carry limitation periods, and a delay you cannot explain weakens an otherwise strong case. You can post the details on the MyVakeel forum for a practising advocate to review, or book a paid consultation with a Bar Council verified lawyer in this practice area.