Information Technology Act 2000: Cyber Laws & Compliance
Table of Contents
The Information Technology Act, 2000 remains in full force today. What is changing is one specific piece of it: Section 43A, the provision that currently governs how employers must protect employee data, is scheduled to be omitted once the Digital Personal Data Protection Act, 2023 comes fully into force, expected around May 2027.
Key Takeaways
- Confirm that digital signatures on offer letters and employment contracts are legally valid.
- Understand why electronic HR records carry the same legal weight as paper records.
- Identify what constitutes sensitive personal data for payroll and employee records under current rules.
- Review the statutory penalties that apply when HR or payroll staff mishandle confidential employee data.
- Track the compliance transition from the current SPDI Rules to the newer data protection framework.
- Maintain a compliance checklist covering both legal regimes during this transition period.
What is the Information Technology Act, 2000?
The Act serves as India’s primary legal framework governing electronic records, digital signatures, and cyber activities. For HR and payroll teams, the Act is particularly relevant because it provides legal recognition of electronic records and signatures and establishes statutory requirements for the protection and lawful disclosure of personal data.
The Act also establishes legal consequences for unauthorized access, disclosure of confidential information, and failure to maintain reasonable security practices in circumstances covered by the Act.
What the Information Technology Act, 2000 Means for HR
This Act was India’s first cyber law, and four of its provisions directly affect HR and payroll.
| Provision | What It Covers |
|---|---|
| Sections 3 and 3A | Legal validity of digital signatures and electronic signatures |
| Sections 4 and 5 | Legal recognition of electronic records and signatures generally |
| Section 43A | Compensation liability for mishandling sensitive personal data |
| Sections 72 and 72A | Criminal penalties for breach of confidentiality and unauthorized disclosure |
Everything else in this Act, from intermediary liability to cybercrime investigation powers, falls outside the scope of daily HR operations; therefore, this guide focuses exclusively on these four core statutory areas.
Are Digital Signatures on Offer Letters and Contracts Valid?
Yes. The IT Act explicitly recognizes the legal validity of electronically signed documents, allowing employers to issue offer letters, appointment letters, and employment contracts digitally.
| Signature Type | Section | How It Works |
|---|---|---|
| Digital signature | Section 3 | Asymmetric cryptography issued by a licensed Certifying Authority |
| Electronic signature | Section 3A | Any reliable authentication method, including OTP-based authentication and government-recognized eSign frameworks. |
A small list of documents is excluded from electronic execution altogether under the First Schedule: negotiable instruments, powers of attorney, trust deeds, wills, and real estate conveyance documents. An offer letter, a joining letter, or a standard employment contract does not appear on that list, so HR departments can use electronic signatures throughout the onboarding workflow without requiring separate legal opinions for routine execution.
Digital Signature or Simple E-Signature: Which does each HR Document Need?
Not every HR document requires the same level of authentication. The choice depends on the document’s purpose and importance.
| Document Type | Recommended Authentication | Why |
|---|---|---|
| Offer letters, joining letters, internal memos | Section 3A electronic signature, such as OTP or Aadhaar eSign | Fast, convenient workflow for routine HR correspondence. |
| Employment contracts, appraisal sign-offs with financial implications | Electronic signature with an audit trail | Fast, convenient workflow for routine HR correspondence. |
| Government filings or high-value evidence | Section 3 digital signature via a licensed Certifying Authority | Maximum cryptographic assurance and non-repudiation for regulatory or legal scrutiny. |
While a licensed Certifying Authority is not mandatory for routine HR documentation, it is recommended for high-risk or high-value legal instruments.
Electronic HR Records Now Carry Full Legal Weight
Section 4 – Legal Recognition
Where statutory provisions require information to be rendered in writing, an electronic record satisfies the requirement provided it remains accessible for subsequent reference.
What This Means for HR
Paperless records, such as appraisal forms, resignation emails, and attendance registers, can be maintained electronically while retaining their legal validity.
Keep Records Retrievable
The record should remain accessible, intact, and reproducible when required. In employment or resignation disputes, a properly archived email complete with system timestamps serves as admissible documentary evidence.
Sensitive Personal Data: What Section 43A Actually Protects
Section 43A requires organizations to maintain reasonable security practices when handling Sensitive Personal Data or Information (SPDI). The SPDI Rules, 2011 identify specific categories relevant to HR and payroll.
| Category | Examples in an HR Context |
|---|---|
| Passwords | Employee self-service portal and payroll system logins |
| Financial information | Bank account, salary account, and payment card details |
| Health records | Medical certificates, leave records tied to illness, insurance claims |
| Biometric data | Attendance-system fingerprint or facial recognition data |
Compliance Standard: Organizations collecting or processing SPDI must implement reasonable security practices and procedures. Maintaining ISO/IEC 27001 certification (or an audited equivalent) fulfills the statutory requirement under the SPDI Rules.
Where does a Data Protection Claim Actually Get Heard?
An employee seeking compensation under Section 43A need not initiate a civil suit.
| Claim Value | Forum |
|---|---|
| Up to ₹5 crore | Adjudicating Officer, typically the state’s IT Secretary |
| Above ₹5 crore | Civil court |
Most employee data claims, such as a leaked salary slip or an exposed medical record, fall well within the Adjudicating Officer’s jurisdiction, offering an expedited and cost-effective regulatory dispute resolution process.
Confidentiality and Misuse: Penalties that Apply to HR and Payroll Staff
HR and payroll employees may be liable for unauthorized disclosure or misuse of confidential information under Sections 72 and 72A.
| Offence | Section | Penalty |
|---|---|---|
| Breach of confidentiality after lawful access | Section 72 | Imprisonment up to 2 years, fine up to ₹1,00,000, or both |
| Disclosure in breach of a lawful contract, causing wrongful loss or gain | Section 72A | Imprisonment up to 3 years, fine up to ₹5,00,000, or both |
Unauthorized sharing of salary or medical records can trigger liability even without an external cyberattack. Organizations should update their internal Non-Disclosure Agreements (NDAs) and employee confidentiality policies to explicitly reference statutory liabilities under Sections 72 and 72A.
The Transition to the Digital Personal Data Protection Act, 2023
The Digital Personal Data Protection Act, 2023 received presidential assent, but its substantive obligations became operational only when the Digital Personal Data Protection Rules, 2025 were notified on 14 November 2025.
| Date | What Happened |
|---|---|
| August 2023 | DPDP Act, 2023 received presidential assent. |
| 14 November 2025 | Digital Personal Data Protection Rules, 2025 notified |
| November 2025 to May 2027 | 18-month phased compliance window for organizations |
| Around May 2027 | Section 44(2) of the newer Act omits Section 43A and the SPDI Rules |
Until Section 44(2) takes effect, organizations must comply with both regulatory regimes simultaneously. The SPDI Rules remain the binding legal standard for sensitive personal data, while organizations must progressively align their systems with the DPDP framework before the compliance window closes.
A Compliance Checklist for HR and Payroll Teams
HR and payroll teams should review their processes to ensure compliance with current IT Act requirements and to prepare for the upcoming data protection framework. Use this checklist to identify key areas that require attention:
- Review your e-signature process: Use the appropriate authentication method and reference Section 3A for electronic signatures such as OTP or Aadhaar eSign.
- Check documents requiring physical signatures: Review your onboarding documents to ensure none fall under the First Schedule exclusions.
- Map employee data: Identify where payroll, health, biometric, and other sensitive employee data is collected, stored, and processed under Section 43A.
- Verify vendor security practices: Confirm that your HRMS or payroll provider follows ISO/IEC 27001 or an approved equivalent security standard.
- Reference Sections 72 and 72A in internal policies: Update the Employee Code of Conduct and IT policy to highlight individual criminal liability for unlawful disclosure of personal data, in addition to corporate liability.
- Prepare for the DPDP framework: Assess internal workflows against data fiduciary obligations, consent mechanisms, and data principal rights ahead of full enforcement.
- Review cybersecurity policies annually: Ensure your policies address both current Section 43A requirements and upcoming DPDP obligations.
- Maintain accessible electronic records: Ensure HR records are stored in a retrievable and reproducible digital format in compliance with Section 4 of the IT Act.
Conclusion
The future of HR is increasingly digital, and compliance needs to evolve with it. As electronic signatures, paperless records, HRMS platforms, and automated payroll become standard, organizations must treat employee data protection as an ongoing responsibility rather than a one-time requirement.
The transition from the IT Act’s SPDI framework to the DPDP regime is an opportunity for HR teams to strengthen how employee data is collected, stored, accessed, and protected. factoHR’s HR and payroll software is built with the security certifications and access controls that this transition demands, so employee data stays protected, regardless of which regime is being audited against. Schedule a demo to learn more.
Suggested articles
Frequently Asked Questions
Is the Information Technology Act, 2000 Still Applicable in 2026?
Yes. The Information Technology Act, 2000 remains active and governs electronic records, electronic signatures, and data confidentiality during the transition period.
Are Digital Signatures Valid on Employment Contracts in India?
Yes. Employment contracts are not excluded from electronic execution under the First Schedule of the IT Act, so they can be signed electronically.
What is the Difference between a Digital Signature and an Electronic Signature?
A digital signature under Section 3 uses cryptographic technology and a Digital Signature Certificate. Section 3A covers recognized electronic signature methods, including certain OTP- and eSign-based methods.
Can Employee Records be Stored Electronically in India?
Yes. Section 4 recognizes electronic records, provided they remain accessible and can be reproduced for future reference.
What Constitutes Sensitive Personal Data or Information (SPDI) under the IT Act?
Yes. The SPDI Rules remain relevant during the transition to the DPDP framework, as the new data protection regime is being implemented in phases.
Do the SPDI Rules Still Apply in 2026?
Yes. The SPDI Rules remain relevant during the transition to the DPDP framework, as the new data protection regime is being implemented in phases.
Does ISO 27001 Certification Satisfy IT Act Data-Security Requirements?
Yes. Under the SPDI Rules, obtaining ISO/IEC 27001 certification satisfies the statutory requirement to maintain reasonable security practices under Section 43A.
Grow your business with factoHR today
Focus on the significant decision-making tasks, transfer all your common repetitive HR tasks to factoHR and see the things falling into their place.
