Cyber Law India FAQ by CyberWithMadhav

Question 1

Is opening my partner's phone without permission illegal?

Accepted Answer

Accessing someone else's phone, accounts or data without their permission can be an offence under the IT Act, even between spouses or partners, and the Supreme Court has recognised privacy as a fundamental right (Puttaswamy, 2017). Unauthorised access can attract civil compensation under Section 43 and becomes a criminal offence under Section 66 if done dishonestly or fraudulently. Capturing or sharing private images can bring in Section 66E of the IT Act and voyeurism under BNS Section 77. Every situation depends on its facts, so speak to a lawyer before acting or using such data as evidence.

Question 2

What do I do in the first hour after UPI fraud?

Accepted Answer

Call the 1930 cyber fraud helpline immediately, because quick reporting gives the best chance of the money being put on hold before it moves further. Then inform your bank in writing, block your UPI or card if needed, and file or complete your complaint on cybercrime.gov.in with the transaction IDs (UTR numbers), screenshots and the fraudster's number or UPI ID. Under the RBI's customer liability rules (first issued in July 2017 and now in the RBI Responsible Business Conduct Directions, 2025, paras 67 to 72), you bear zero loss for a third-party fraud reported within 3 working days; reporting within 4 to 7 working days caps your loss at ₹5,000, ₹10,000 or ₹25,000 depending on the account; after that the bank's Board-approved policy applies (being verified). Never share OTP, PIN or screen-sharing access with anyone who calls offering to 'help recover' the money.

Question 3

Is a WhatsApp chat valid evidence in court?

Accepted Answer

WhatsApp chats, screenshots and other electronic records can be used as evidence in India, but courts generally expect them to be properly proved. Under the Bharatiya Sakshya Adhiniyam 2023, Section 63 (which replaced Section 65B of the old Evidence Act) requires a certificate in the prescribed Schedule format, including details of the device and a hash value. Keep the original phone and chats intact, do not edit or crop screenshots, and export chats where possible. A lawyer can advise how to present the evidence in your specific case.

Question 4

What is the difference between IT Act Section 43 and Section 66?

Accepted Answer

Section 43 lists acts like accessing a computer without permission, downloading data, introducing viruses or damaging a system, and makes the person liable to pay compensation, so it is mainly a civil remedy. Section 66 makes the same acts a criminal offence when they are done dishonestly or fraudulently. In simple terms, Section 43 is about compensation and Section 66 is about punishment, and the two can apply together. Claims under Section 43 of up to ₹5 crore are decided by the adjudicating officer under Section 46; larger claims go to the competent court. Check the process with a lawyer.

Question 5

Can I be arrested for forwarding a message?

Accepted Answer

Forwarding can be an offence if the content itself is unlawful, for example content promoting enmity between groups, false statements likely to cause public mischief, defamatory content or obscene material. Section 66A of the IT Act, which was often misused for 'offensive' posts, was struck down by the Supreme Court in Shreya Singhal (2015) and formally omitted by the Jan Vishwas Act from 30 November 2023, so it cannot be applied. For offences punishable with up to seven years, the BNSS generally requires police to issue a notice of appearance instead of arresting straight away, with arrest as an exception. If you receive a notice or complaint, consult a lawyer before responding.

Question 6

Who handles complaints under the DPDP Act?

Accepted Answer

Under the Digital Personal Data Protection Act 2023, you must first use the grievance redressal mechanism of the company (Data Fiduciary) or Consent Manager, which must reply within a reasonable period not exceeding 90 days (DPDP Rules r.14(3)). Only then can you complain to the Data Protection Board of India, and the Board's orders can be appealed to the Appellate Tribunal (TDSAT) within 60 days (s.29(2)). But these grievance, complaint, appeal and penalty provisions take effect only 18 months after 13 November 2025, around 13 May 2027 (being verified). Until then, claim compensation under IT Act Section 43A before the adjudicating officer (Section 46) or in a civil court; the SPDI Rules 2011 still apply. For financial loss or a crime, also report to 1930 and cybercrime.gov.in.

Question 7

Someone is threatening to leak my private or morphed photos (sextortion). What do I do?

Accepted Answer

Do not pay and do not send more images, because payment usually leads to more demands. Preserve evidence (chats, profile links, numbers, payment requests), block the person, report the account to the platform, and file a complaint on cybercrime.gov.in, which has a category for crimes against women and children, or call 1930. Such threats can attract IT Act provisions on privacy and obscene or sexually explicit material, and BNS provisions on extortion and criminal intimidation. You are not at fault, and a lawyer or a trusted person can help you through the process.

Question 8

Someone made a fake profile pretending to be me. Is that a crime?

Accepted Answer

Creating a fake profile using your name or photos to deceive others can be identity theft or cheating by personation under the IT Act, and cheating by personation under the BNS. If the profile posts content that harms your reputation, defamation provisions may also apply. Report the profile to the platform using its impersonation form, warn your contacts, save screenshots with the profile URL, and file a complaint on cybercrime.gov.in. A lawyer can help if you want to pursue the matter further.

Question 9

Is posting false and insulting things about someone online defamation?

Accepted Answer

Online posts, reviews, videos or messages that harm someone's reputation with false statements can amount to defamation, which is a criminal offence under BNS Section 356 and can also lead to a civil suit for damages. Truth and fair comment in the public interest can be defences, but whether they apply depends on the facts. If you are targeted, save evidence and ask the platform to remove the content; if you are accused, avoid deleting or reposting until you have spoken to a lawyer. When talking about ongoing cases, words like 'allegedly' and avoiding names of accused persons reduce risk. Under the IT Rules as amended in 2026, the platform must acknowledge your complaint within 24 hours and resolve it within 7 days, and intimate or morphed images must be taken down within 2 hours (being verified).

Question 10

My child is being cyberbullied online. What can we do?

Accepted Answer

Talk to your child calmly, save the evidence, and report and block the bully on the platform; also inform the school if classmates are involved. Depending on the content, laws on stalking, criminal intimidation, sexual harassment of children (POCSO) or sexually explicit material involving children may apply. You can report on cybercrime.gov.in, which has a section for crimes against women and children, or call 1930, and the child's identity should be kept confidential. For serious cases, consult a lawyer or a child protection officer.

Question 11

How do I file a complaint on cybercrime.gov.in or through 1930?

Accepted Answer

For money lost to online fraud, call 1930 first, then register on cybercrime.gov.in (the National Cyber Crime Reporting Portal) and file under financial fraud with transaction details, screenshots and suspect identifiers. For other cybercrimes, choose the relevant category; crimes against women and children have a separate reporting option. Note your acknowledgement number and follow up with your local cyber cell or police station. Information given electronically must be signed by the complainant within three days to be taken on record as an FIR (BNSS s.173(1)(ii)).

Question 12

Can the police refuse to register an FIR for a cybercrime?

Accepted Answer

For a cognizable offence, the police are generally required to register an FIR, and under BNSS Section 173 a 'Zero FIR' can be filed at any police station regardless of where the offence happened. For offences punishable with 3 years or more but less than 7 years, police may first hold a preliminary enquiry, within 14 days, with permission from an officer of DSP rank. If the police refuse, you can send the complaint to the Superintendent of Police under Section 173(4), and then approach a Magistrate under Section 175(3). A lawyer can help draft these applications.

Question 13

Is my bank liable if money is taken from my account without my authorisation?

Accepted Answer

Under the RBI's customer liability rules, first issued in the July 2017 circular and now carried into the RBI (Commercial Banks - Responsible Business Conduct) Directions, 2025 (paras 67 to 72), you have zero liability where the bank was negligent, or where a third-party breach occurred and you reported it within 3 working days. Reporting within 4 to 7 working days caps your liability at ₹5,000, ₹10,000 or ₹25,000 depending on the account, and beyond 7 working days the bank's Board-approved policy applies (being verified). If the loss happened because you shared credentials such as OTP or PIN, you may bear the loss until you report it. The bank must credit the amount to your account (shadow credit) within 10 working days of your report and resolve the complaint within 90 days. If the bank does not reply within 30 days or you are not satisfied, complain at cms.rbi.org.in under the Reserve Bank - Integrated Ombudsman Scheme, 2026 (in force 1 July 2026): file within 90 days; the Ombudsman can award up to ₹30 lakh + ₹3 lakh, and an appeal lies within 30 days (being verified). Complaints received before 1 July 2026 stay under the 2021 scheme. A lawyer or consumer forum advisor can help.

Question 14

Someone made a deepfake video or voice clone of me. What law applies?

Accepted Answer

There is no single 'deepfake' section, but depending on the content, IT Act provisions on identity theft, cheating by personation, privacy violation and obscene or sexually explicit material can apply, along with BNS provisions on defamation, cheating by personation and forgery. The IT Rules were amended in 2026 to cover 'synthetically generated information', requiring platforms to label such content and act against unlawful deepfakes. Report the content to the platform, save the links and copies, and file on cybercrime.gov.in or call 1930 if money is involved. A lawyer can advise on takedown and further action.

Question 15

I got a 'digital arrest' call from someone claiming to be police, CBI or customs. Is it real?

Accepted Answer

There is no procedure in Indian law called 'digital arrest', and genuine police or investigating agencies do not keep people on video calls or demand money transfers to 'verify' accounts. These calls are a scam where fraudsters pose as officials to frighten victims into paying. Disconnect the call, do not transfer money or share documents, and report it on cybercrime.gov.in, the Chakshu facility on sancharsaathi.gov.in for the number, or call 1930 if you have paid. Impersonating a public servant, extortion and cheating are offences under the BNS and IT Act.

Entering someone's device without permission is illegal in India

History of Indian Cyber Law

IT Act sections at a glance

Cyber-relevant BNS sections with old IPC numbers

Data protection penalties

Where to go: report, adjudicate, appeal

Where to File

Case files every advocate should know

Questions clients ask

Cyber law terms, explained

Download the PG Diploma level sheets

Related guides