Section 70B IT Act: Indian Computer Emergency Response Team to serve as national agency for incident response
Information Technology Act, 2000
Section 70B IT Act at a Glance
Section 70B IT Act appoints the Indian Computer Emergency Response Team for cyber incident response. Failing to give called information or obey its directions brings up to 1 year's imprisonment, a fine up to ₹1 crore instead of imprisonment, or both.
Up to 1 year, under sub-section (7)
Section 70B IT Act Bare Act Text
70B. Indian Computer Emergency Response Team to serve as national agency for incident response.
(1) The Central Government shall, by notification in the Official Gazette, appoint an agency of the Government to be called the Indian Computer Emergency Response Team.
(2) The Central Government shall provide the agency referred to in sub-section (1) with a Director General and such other officers and employees as may be prescribed.
(3) The salary and allowances and terms and conditions of the Director-General and other officers and employees shall be such as may be prescribed.
(4) The Indian Computer Emergency Response Team shall serve as the national agency for performing the following functions in the area of cyber security,—
(a) collection, analysis and dissemination of information on cyber incidents;
(b) forecast and alerts of cyber security incidents;
(c) emergency measures for handling cyber security incidents;
(d) coordination of cyber incidents response activities;
(e) issue guidelines, advisories, vulnerability notes and white papers relating to information security practices, procedures, preventation, response and reporting of cyber incidents;
(f) such other functions relating to cyber security as may be prescribed.
(5) The manner of performing functions and duties of the agency referred to in sub-section (1) shall be such as may be prescribed.
(6) For carrying out the provisions of sub-section (4), the agency referred to in sub-section (1) may call for information and give direction to the service providers, intermediaries, data centres, body corporate and any other person.
(7) Any service provider, intermediaries, data centres, body corporate or person who fails to provide the information called for or comply with the direction under sub-section (6), shall be punishable with imprisonment for a term which may extend to one year or with fine which may extend to one crore rupees or with both.
(8) No court shall take cognizance of any offence under this section, except on a complaint made by an officer authorised in this behalf by the agency referred to in sub-section (1).
Amendments to this section
- Subs. by Act 18 of 2023, s. 2 and Schedule, for "one lakh" (w.e.f. 30-11-2023).
- Ins. by Act 10 of 2009, s. 36 (w.e.f. 27-10-2009).
Section 70B IT Act in Simple Words
Section 70B IT Act requires the Central Government to set up a national agency for cyber security incident response and makes disobeying that agency's requests or directions an offence. Under Section 70B(1) IT Act, the Central Government must appoint a government agency called the Indian Computer Emergency Response Team by notification in the Official Gazette (the government's official publication). Under Sections 70B(2) and 70B(3) IT Act, the Central Government must provide the agency with a Director General and other prescribed officers and employees, whose salaries, allowances, and service terms are as may be prescribed.
Under Section 70B(4) IT Act, the Indian Computer Emergency Response Team serves as the national agency for six cyber security functions: (a) collecting, analysing, and sharing information on cyber incidents; (b) issuing forecasts and alerts on cyber security incidents; (c) taking emergency measures to handle cyber security incidents; (d) coordinating cyber incident response activities; (e) issuing guidelines, advisories, vulnerability notes, and white papers on information security practices, procedures, prevention, response, and reporting of cyber incidents; and (f) performing any other prescribed cyber security functions. Under Section 70B(5) IT Act, the agency performs its functions and duties in the prescribed manner.
To carry out the functions in Section 70B(4) IT Act, Section 70B(6) IT Act empowers the Indian Computer Emergency Response Team to call for information from, and give directions to, service providers, intermediaries (a term defined in Section 2 IT Act), data centres, bodies corporate, and any other person. Under Section 70B(7) IT Act, any service provider, intermediary, data centre, body corporate, or person that fails to provide the information called for or fails to comply with a direction under Section 70B(6) IT Act commits an offence punishable with imprisonment of up to 1 year, a fine of up to ₹1 crore instead of imprisonment, or both.
Under Section 70B(8) IT Act, no court can take cognizance (formally take up the case for trial) of an offence under Section 70B IT Act except on a complaint made by an officer authorised by the Indian Computer Emergency Response Team. Section 70B IT Act was inserted by Act 10 of 2009 with effect from 27 October 2009, and amended by Act 18 of 2023 with effect from 30 November 2023.
Ingredients of Section 70B IT Act
- The Indian Computer Emergency Response Team calls for information or issues a direction under Section 70B(6) IT Act to carry out its cyber security functions under Section 70B(4) IT Act.
- The request or direction is addressed to a service provider, an intermediary, a data centre, a body corporate, or any other person.
- That recipient fails to provide the information called for or fails to comply with the direction (Section 70B(7) IT Act).
- For a court to take cognizance of the offence, a complaint is made by an officer authorised by the Indian Computer Emergency Response Team (Section 70B(8) IT Act).
Punishment Under Section 70B IT Act
Up to 1 year, under sub-section (7)
Up to ₹1 crore, instead of or with imprisonment
Section 77B IT Act does not cover an offence punishable with less than 3 years, so Part II of the First Schedule to the BNSS decides it: it is non-cognizable and bailable, and any Magistrate can try it. Under sub-section (8) a court takes cognizance only on a complaint by an officer the Indian Computer Emergency Response Team has authorised. Section 77A IT Act lets the court compound it, but not where the accused is liable to enhanced punishment because of a previous conviction, or where the offence affects the socio economic conditions of the country or was committed against a child below 18 years or a woman.
Under Section 70B(7) IT Act, failing to provide requested information or comply with a direction is punishable with imprisonment of up to 1 year, a fine of up to ₹1 crore instead of imprisonment, or both. Because Section 77B IT Act covers only offences punishable with 3 years or more, Part II of the First Schedule to the BNSS makes the offence non-cognizable (police cannot register an FIR or arrest without a court order) and bailable (the accused can claim bail as of right), triable by any Magistrate on a complaint by an officer authorised under Section 70B(8) IT Act. Under Section 77A IT Act, a court may compound (settle) the offence, except where a previous conviction attracts enhanced punishment, or where the offence affects the socio economic conditions of the country or was committed against a child below 18 years or a woman.
Example of Section 70B IT Act
When Section 70B IT Act Does Not Apply
- The service provider, intermediary, data centre, body corporate, or person provides the information called for and complies with the direction issued under Section 70B(6) IT Act.
- A court cannot take cognizance of an offence under Section 70B IT Act unless the complaint is made by an officer authorised by the Indian Computer Emergency Response Team (Section 70B(8) IT Act).
FAQs on Section 70B IT Act
What is Section 70B IT Act?▼
Section 70B IT Act requires the Central Government to appoint the Indian Computer Emergency Response Team as the national agency for cyber security incident response, and sets out its functions and powers to call for information and issue directions. Under Section 70B(7) IT Act, failing to provide requested information or comply with its directions is punishable with up to 1 year's imprisonment, a fine of up to ₹1 crore instead of imprisonment, or both.
Can the police register an FIR and arrest someone directly for an offence under Section 70B(7) IT Act?▼
No. The offence under Section 70B(7) IT Act is non-cognizable and bailable under Part II of the First Schedule to the BNSS, and under Section 70B(8) IT Act a court can take cognizance only on a complaint by an officer authorised by the Indian Computer Emergency Response Team.
Who must comply with directions issued under Section 70B(6) IT Act?▼
Service providers, intermediaries, data centres, bodies corporate, and any other person. Section 70B(6) IT Act empowers the Indian Computer Emergency Response Team to call for information from and give directions to all of them for carrying out its functions under Section 70B(4) IT Act.
How soon must a cyber incident be reported to CERT-In?▼
Within 6 hours of noticing it. Directions issued by the Indian Computer Emergency Response Team (CERT-In) under Section 70B(6) IT Act on 28 April 2022 require service providers, intermediaries, data centres, bodies corporate and government organisations to report specified cyber incidents within 6 hours.
Can an offence under Section 70B(7) IT Act be compounded?▼
Yes. Under Section 77A IT Act, a court may compound the offence because the maximum imprisonment is up to 1 year. Compounding is barred where a previous conviction attracts enhanced punishment, or where the offence affects the socio economic conditions of the country or was committed against a child below 18 years or a woman.
Must a court impose both jail and a fine under Section 70B(7) IT Act?▼
No. Section 70B(7) IT Act allows imprisonment of up to 1 year, a fine of up to ₹1 crore instead of imprisonment, or both.
Have questions about Section 70B IT Act?
Ask NyayGuru about your situation and get an answer based on the Information Technology Act, 2000.
Ask NyayGuru →Disclaimer: This is for informational purposes only. Always consult a qualified advocate for legal advice.
Sources: Bare Act Text, Information Technology Act, 2000 ·