Information Technology Act 2000 Section 43: Penalty for Damage to Computer Systems (2026)
What Section 43 of the Information Technology Act, 2000 does: it makes a person pay compensation for damaging a computer, computer system or data without permission. It is a civil wrong, decided by an adjudicating officer. Last verified October 2026.
Explainer · Cyber Law · IT Act
Section 43 of the Information Technology Act, 2000 says that if any person, without the permission of the owner, accesses, downloads, damages or disrupts a computer, computer system, network or the data in it, that person must pay compensation to the person who is harmed. It is the main civil remedy in Indian cyber law. There is no jail under Section 43 by itself; the wrongdoer pays money. The same acts, when done dishonestly or fraudulently, become a crime under Section 66. This explainer sets out what Section 43 covers, how compensation is decided, and the key cases. Last verified October 2026.
- What it is: Section 43 of the IT Act makes a person pay compensation for damaging a computer, system, network or data without permission.
- Civil, not criminal: there is no jail under Section 43 itself; the wrongdoer pays money. The same act done dishonestly becomes a crime under Section 66.
- Who decides: an adjudicating officer under Section 46, with an appeal to the appellate tribunal.
- Old cap gone: the one crore ceiling was removed by the 2008 amendment, so compensation now follows the real loss.
01The short answer
Section 43 is a civil provision. If someone touches your computer, system, network or data without permission and causes harm, Section 43 lets you claim money as compensation from them. You do not have to prove a crime, and there is no imprisonment under this section.
You take the claim to an adjudicating officer, not a regular civil court. If the same act was done with a dishonest or fraudulent mind, it also becomes a criminal offence under Section 66, which can carry jail.
02What Section 43 covers
Section 43 lists a set of acts that attract liability when they are done to a computer, computer system or network without the permission of the owner or person in charge. These include:
- accessing or securing access to the computer or network;
- downloading, copying or extracting data or information;
- introducing a virus or other contaminant;
- damaging the computer, data, programs or network;
- disrupting the system, or denying access to an authorised user;
- helping someone else do any of these, or charging the services used by one person to the account of another.
The key words are "without permission"
Liability turns on the lack of authority. If you had the owner's permission for what you did, Section 43 does not apply. The person who is harmed does not have to show intention; the act and the harm are enough for a civil claim.
Because intention is not required, Section 43 is wider than the criminal provisions. A careless or unauthorised act that causes loss can be enough, even if there was no dishonest motive.
03How compensation is decided
A claim under Section 43 is decided by an adjudicating officer appointed by the government under Section 46, usually a senior IT department official of the rank of Director or above. The officer hears both sides and fixes the compensation payable to the person who was harmed.
When the Act was passed, Section 43 capped compensation at one crore rupees. The 2008 amendment removed that fixed ceiling, so the officer now awards compensation based on the actual loss. Under Section 46, the adjudicating officer handles claims up to five crore rupees; claims above that figure go to the competent civil court.
In deciding the amount, the officer looks at the gain made by the wrongdoer, the loss caused to the victim, and whether the act was repeated. An appeal from the adjudicating officer lies to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), which now hears cyber appeals.
04Section 43 and the old Section 43A
People often mix up Section 43 with Section 43A. They are different.
| Point | Section 43 | Section 43A (now omitted) |
|---|---|---|
| Who it targeted | Any person who damages a computer or data without permission | A body corporate handling sensitive personal data |
| What it required | An unauthorised act causing harm | Failure to keep reasonable security practices, causing wrongful loss |
| Status in 2026 | In force | Omitted by the Digital Personal Data Protection Act, 2023 |
Section 43A, which made a company pay compensation for failing to protect sensitive personal data, has been omitted by Section 44 of the Digital Personal Data Protection Act, 2023. Data protection failures are now dealt with under the DPDP Act and its penalties instead. Section 43, about damage to a computer by any person, continues as before.
05Key case law
The best known Section 43 matters come from adjudication, not the higher courts, because it is a civil remedy. In early adjudication orders, officers awarded compensation to bank customers whose accounts were drained by phishing or unauthorised online transfers, holding that the loss flowed from unauthorised access to the computer system.
Courts have also read Section 43 together with Section 66. Where the same unauthorised act is done dishonestly or fraudulently, it crosses from a civil wrong under Section 43 into a criminal offence under Section 66. So the facts that found a Section 43 claim often support a parallel Section 66 complaint.
06A practical note
If your computer, phone, account or data has been accessed or damaged without permission and you have lost money or suffered harm, you have two tracks and can use both. File a civil claim for compensation before the adjudicating officer under Section 43, and, where there was dishonesty or fraud, file a criminal complaint under Section 66 and the related sections. For the criminal route, see how to file a cyber crime complaint, and if money was taken, how to recover money lost to online fraud.
Keep evidence from the start: screenshots, transaction records, emails, device logs and the complaint you file. In cyber matters the electronic trail is the case.
07Where Claw fits
Claw is an all-in-one legaltech platform for Indian advocates, law firms, and corporate legal teams, combining AI-based case search, an AI legal assistant (Legal GPT), case management, and compliance automation across all Indian courts and tribunals.
How much compensation an adjudicating officer or a court is likely to award often depends on how similar unauthorised-access and data-damage matters have been decided. Claw lets you search more than 30 crore judgments and orders, with Supreme Court rulings from 1950 and High Court rulings from 1990, in under 5 seconds, so you can see how Section 43 and Section 66 have been applied. You can also follow a live complaint or appeal by party or advocate name across 9,102 courts, benches and forums, and get the next hearing date without scanning cause lists by hand. Claw does not use the documents you upload to train its AI models.
Create a free Claw account to track a Section 43 adjudication or appeal and follow every hearing, and use case search across Indian courts to find how compensation has been fixed in similar cyber matters.
08Sources and further reading
- India Code (Information Technology Act, 2000, bare text): indiacode.nic.in
- PRS Legislative Research (IT Act and amendments): prsindia.org
- Ministry of Electronics and IT (MeitY): meity.gov.in
- Claw: clawlaw.in
This explainer is general information, not legal advice. The law changes through amendments and judgments, so check the current text and take advice from counsel before you act.
09Frequently asked questions
What is Section 43 of the IT Act?
Section 43 of the Information Technology Act, 2000 makes any person who, without the owner's permission, accesses, copies, damages or disrupts a computer, computer system, network or data liable to pay compensation to the person harmed. It is a civil remedy, not a criminal offence.
Is there jail under Section 43?
No. Section 43 only makes the wrongdoer pay compensation. If the same act is done dishonestly or fraudulently, it becomes a criminal offence under Section 66, which can carry up to three years in jail and a fine.
Who decides a Section 43 claim?
An adjudicating officer appointed under Section 46 of the IT Act, usually a senior IT department official, hears the claim and fixes the compensation. An appeal lies to the appellate tribunal.
Do I have to prove intention under Section 43?
No. Section 43 does not require a dishonest or fraudulent intention. The unauthorised act and the harm caused are enough for a civil compensation claim. Intention is needed only for the criminal offence under Section 66.
What happened to Section 43A?
Section 43A, which made companies pay compensation for failing to protect sensitive personal data, has been omitted by the Digital Personal Data Protection Act, 2023. Data protection failures are now handled under the DPDP Act. Section 43 continues in force.
Can I find Section 43 and Section 66 cases in Claw?
Yes. Claw lets you search more than 30 crore judgments and orders in under 5 seconds to see how compensation has been fixed in unauthorised-access matters, and track a live adjudication or appeal by party or advocate across 9,102 courts, benches and forums. It researches and tracks the matter but does not give legal advice.