Unauthorised Access under the Information Technology Act

Unauthorised computer access occurs when a person, without permission, accesses or secures access to a computer resource belonging to or controlled by another person. Section 43 of the Information Technology Act, 2000 creates civil liability for such access and for related interference with computers, networks, data and services, even where no information is ultimately copied.

Core statutory test

Access falls within Section 43(a) when it is obtained without the permission of the owner or any other person in charge of the computer, computer system, computer network or computer resource. The provision covers both directly accessing the resource and securing access, such as enabling another person to enter it.

• Permission must come from the owner or another person who is legally or operationally in charge of the resource.
• Using automation or an AI agent does not change the inquiry: the relevant question remains whether the resulting access was permitted.

Conduct covered by Section 43

Section 43 extends beyond mere entry and covers unauthorised extraction or interference with digital resources.

• It covers downloading, copying or extracting data, databases or information, including material stored on removable media.
• It covers introducing a computer contaminant or virus, damaging or disrupting a resource, and denying access to an authorised person.
• It covers assisting unlawful access, improperly charging services to another person's account, and destroying, deleting or altering information so as to reduce its value or utility.
• It also covers stealing, concealing, destroying or altering computer source code with intent to cause damage.

Civil and criminal consequences

A person committing an act listed in Section 43 is liable to pay damages by way of compensation to the affected person. If an act referred to in Section 43 is done dishonestly or fraudulently, Section 66 makes it a criminal offence punishable with imprisonment up to three years, a fine up to five lakh rupees, or both.