Cyber law in India rests chiefly on the Information Technology Act 2000, read with the Bharatiya Nyaya Sanhita 2023 (BNS), the Bharatiya Nagarik Suraksha Sanhita 2023 (BNSS) and the Bharatiya Sakshya Adhiniyam 2023 (BSA). If money has left your account in an online fraud, call the cybercrime helpline 1930 at once, file a report on the National Cyber Crime Reporting Portal, and ask your bank to freeze the beneficiary account, because funds frozen in the first few hours are the easiest to recover. Bismay Dash & Associates is a full-service law firm in Bhubaneswar whose cyber law team represents victims, accused persons, companies and startups across Odisha and beyond.
Cyber law answers three everyday questions: what conduct is punishable online, how a victim recovers money, data and reputation, and what businesses must do to keep personal data lawful. This page explains the main offences, the reporting and relief mechanics, the compliance duties under the Digital Personal Data Protection Act 2023, and the electronic-evidence rules that decide these cases in the courts of Odisha.
Why cyber law matters in Bhubaneswar and across Odisha
Ordinary life in Odisha now runs on screens. Salary credits, UPI payments, online admissions, property registration and government-to-citizen services delivered through the state’s e-governance portals have moved everyday transactions onto phones and laptops.
That shift has produced a steady stream of complaints: fake customer-care numbers, phishing links sent over SMS and WhatsApp, fraudulent loan and job offers, sextortion, identity theft, business email compromise and social media impersonation. The police have responded with dedicated cyber police stations and cyber cells in Bhubaneswar, Cuttack and other districts, and courts now try these cases under the criminal codes in force since 1 July 2024.
A single online fraud can involve the IT Act, the cheating provisions of the BNS, banking rules and special evidence law for electronic records. Navigating that overlap is exactly what a cyber law practice exists to do, and it is why early cyber law advice pays for itself in these matters.
Bhubaneswar’s own economy amplifies the trend. The city hosts IT units, educational institutions and a growing startup cluster, each of which holds customer data, runs payment systems and answers to regulators when things go wrong. For these organisations cyber law is a boardroom subject rather than a helpdesk ticket.
Our cyber law practice in Bhubaneswar
We appear on both sides of the docket. For victims we move quickly to freeze funds, pursue takedowns and guide the prosecution; for the accused we scrutinise the investigation and the electronic evidence it rests on; for businesses we build compliance programmes and respond to breaches.
The matters arrive from every direction — a student defrauded of a semester’s fees, a doctor facing a leaked recording, a startup struck by ransomware days before an audit. Cyber law advice works best when it is early, practical and written for the forum that will eventually read it.
- Online financial fraud — UPI, card and internet-banking frauds, mule accounts and recovery of frozen funds.
- Phishing, vishing and fake customer-care scams, including spoofed calls and cloned websites.
- Identity theft under s.66C and cheating by personation under s.66D of the IT Act.
- Ransomware attacks, business email compromise and incidents requiring coordinated breach response.
- Sextortion, online harassment and stalking, including offences committed against women and children.
- Social media offences — impersonation, morphed images, threats and impersonated business pages.
- Online defamation and reputation matters, including takedown notices and interim injunctions.
- Email and SMS spoofing, fake profiles and unauthorised access to accounts, devices and networks.
- Defence in prosecutions under the IT Act and the BNS, led with our white-collar crime team.
- Data-protection compliance and breach response under the Digital Personal Data Protection Act 2023.
Where the dispute is financial rather than criminal, we also litigate before consumer commissions and the banking ombudsman, drawing on our banking and financial services and consumer protection practices. Each track needs a different draft, forum and timeline, and most fraud victims need several at once.
Key offences under the Information Technology Act 2000
The Information Technology Act 2000 remains the backbone of cyber law in India. Section 43 creates liability to pay compensation for unauthorised access to or damage of a computer, system or network, and the criminal provisions begin at s.65.
| Provision | Conduct covered | Maximum punishment |
|---|---|---|
| s.43 with s.66 | Unauthorised access, data theft, virus injection or damage to a computer system | Compensation under s.43; imprisonment up to 3 years and fine up to ₹5 lakh |
| s.65 | Tampering with computer source code | Imprisonment up to 3 years and fine up to ₹2 lakh |
| s.66C | Identity theft — fraudulent use of a password, digital signature or biometric | Imprisonment up to 3 years and fine up to ₹1 lakh |
| s.66D | Cheating by personation using a computer resource | Imprisonment up to 3 years and fine up to ₹1 lakh |
| s.66F | Cyber terrorism | Imprisonment up to life |
| s.67 | Publishing or transmitting obscene material electronically | Up to 3 years and ₹5 lakh (first conviction); 5 years and ₹10 lakh thereafter |
Companion provisions matter in daily practice. Section 66E punishes capturing or transmitting private images without consent, while s.67A and s.67B cover sexually explicit material and material involving children, which carry the Act’s heaviest sentences.
The Act also protects systems in the round. Damaging a server, disrupting a network or siphoning data attracts s.66, and the civil remedy under s.43 runs alongside the prosecution, so victims in cyber law disputes often pursue both tracks at once.
Prosecutors rely on these provisions heavily, so defence work under cyber law begins by testing each ingredient: whether the access was truly unauthorised, whether the device or account is identified with the accused, and whether the record connecting the two will survive the evidence rules.
How the new criminal codes fit in
Since 1 July 2024 the BNS 2023 supplies the general criminal law behind most cyber law prosecutions. Cheating is s.318 of the BNS, and cheating by personation — the charge most often paired with s.66D of the IT Act — is s.319, replacing the old s.419 of the IPC.
Online defamation is prosecuted as defamation under s.356 BNS (formerly s.499 IPC), threats as criminal intimidation under s.351, and stalking under s.78, which expressly covers monitoring a woman’s use of the internet, email or any other electronic communication. The BNSS 2023 reshapes the procedure around all of these offences.
A zero FIR under s.175 of the BNSS lets any police station register a cybercrime irrespective of where it occurred, and the informant is entitled to a free copy of the FIR. Stricter investigation timelines now apply, alongside special protections for offences against women and children.
Charges therefore travel in pairs. A fake loan-app extortion, for instance, may be booked under ss.66 and 66D of the IT Act together with extortion (s.308 BNS) and stalking (s.78 BNS), and the defence must be built across both statutes at once.
Online financial fraud: reporting, freezing and recovery
Speed decides outcomes. The helpline 1930 and the National Cyber Crime Reporting Portal, an initiative of the Ministry of Home Affairs, feed a bank-level freezing mechanism, so a report made within the first hours can immobilise the defrauded amount while it still sits in mule accounts.
File with the bank in parallel: a written complaint to the branch, a dispute under the card or UPI framework, and a request to mark the beneficiary account for a debit freeze. Preserve every chat, number, receipt and acknowledgment, because those records become the spine of the complaint.
Once an FIR is registered, the police route freezing directions through the banks’ nodal officers and freeze linked accounts as the money trail is traced. Where funds lie in a stranger’s account, their release or restitution is sought from the Magistrate under the property provisions of the BNSS, on notice to the bank and the investigating officer.
If a police station declines to register the complaint, the FIR provisions of the BNSS permit escalation to the Superintendent of Police and, thereafter, an application to the jurisdictional Magistrate. Complaints can also be lodged through the state police’s citizen portals, which generate an acknowledgment that later supports escalation. Cyber law enforcement moves only as fast as the paperwork behind it.
For unauthorised electronic debits, our banking practice pursues the bank’s own dispute-resolution chain, chargeback rights and, where applicable, the banking ombudsman. Where a cyber-insurance policy exists, notice must be given within the policy timeline, and our insurance law practice runs that track alongside the criminal complaint.
The seizure, freezing and release of money each have their own procedure and forum, and pursuing one without the other usually strands the recovery. We map the full chain at the first conference so that nothing is lost to a missed deadline.
The Digital Personal Data Protection Act 2023
The Digital Personal Data Protection Act 2023 (DPDP Act), administered by the Ministry of Electronics and Information Technology, now shapes cyber law compliance for every organisation in Odisha that handles digital personal data — hospitals, IT units, educational institutions, retailers, fintech startups and government-facing vendors alike.
For most clients this is the first piece of cyber law compliance they have ever bought, and it is a sensible place to start.
Processing must rest on consent for a specified purpose, supported by a clear notice in the languages the data principal uses, or on certain recognised bases such as compliance with law. A data principal may withdraw consent at any time, and the consequences of withdrawal must be communicated fairly.
Data principals hold rights to access a summary of their data, to correct and complete it, to have it erased, to nominate another person to exercise rights on death or incapacity, and to demand grievance redressal within the timelines the Act contemplates. Handling these requests properly is now a compliance function, not a courtesy.
Significant data fiduciaries — notified by the Union Government on the basis of the volume and sensitivity of data handled — carry additional duties, including periodic audits, data-protection impact assessments and the appointment of a data protection officer resident in India.
Failure to take reasonable security safeguards to prevent a data breach attracts a penalty that can reach ₹250 crore, and breaches of other obligations carry penalties of comparable scale, assessed by the Data Protection Board of India. Reasonable safeguards, incident response and honest reporting are the difference between a defensible breach and a penalty proceeding.
We build DPDP compliance end to end: consent notices, policies, vendor and processor contracts, children’s data protocols, breach playbooks and board-level training. For a fuller picture of our work in this area, see our regulatory compliance practice.
CERT-In directions: the six-hour clock
The Indian Computer Emergency Response Team (CERT-In) requires specified cyber incidents to be reported to it within six hours of detection, and directs service providers, intermediaries, data centres, body corporates and government entities to maintain logs within India for 180 days. A breach therefore runs on two clocks — the technical response and the regulatory one.
The six-hour rule surprises most companies the first time they meet it. Cyber law compliance therefore rehearses the notification in advance — who signs it, which template is used, and which officer owns the clock during a live incident.
We help clients honour both: containment and forensic preservation, notifications to CERT-In and to affected individuals, coordination with vendors and law enforcement, and a post-incident review that strengthens the compliance file. Whether the trigger is ransomware, data leakage or an unauthorised intrusion, the sequence and the paper trail must be defensible.
Electronic evidence under the BSA 2023
Cyber law cases are won and lost on proof. Section 63 of the BSA 2023 — the successor to s.65B of the Indian Evidence Act 1872 — governs the admissibility of electronic records and requires a certificate identifying the electronic record and the device, and certifying how the record was generated and stored.
Call recordings, WhatsApp chats, emails, server logs, CCTV exports and forensic images must come with that certificate and an unbroken chain of custody, verified where possible by hash values. Cases collapse when the certificate is missing, the device is unidentifiable or the seizing officer’s testimony cannot connect the record to the accused. In cyber law, the certificate is the case.
We audit the electronic evidence in every brief — for the prosecution case as well as our own — and work with forensic examiners for imaging, deleted-data recovery and authentication. Often the more productive challenge is not to the accusation but to the medium through which it is proved.
Jurisdiction: where cybercrime cases are filed in Odisha
Complaints lie with the police station where the accused or the victim is located or where the underlying transaction occurred, and dedicated cyber police stations in Bhubaneswar and other cities carry these investigations. Grave offences such as cyber terrorism under s.66F are tried by the Court of Session, and the rest by Judicial Magistrates.
Compensation claims for damage to computers under s.43 are decided by the adjudicating officer appointed under s.46 of the IT Act, up to the statutory limit of ₹5 crore, and beyond that by the civil courts. Bail applications, quashing petitions and appeals lie before the Orissa High Court at Cuttack, and our civil litigation practice handles that work across the State. Cyber law remedies follow the forum, and choosing the right one early saves months.
How we help individuals, companies and startups
For individuals we draft and track complaints, coordinate fund-freezing, issue takedown notices to platforms and support testimony at trial. For companies and startups we design cyber law compliance programmes spanning the DPDP Act, the CERT-In directions and intermediary duties, paper vendor contracts, train staff and stand in defence when regulators or prosecutors call.
We also advise schools, hospitals and retailers in Bhubaneswar and Cuttack on cyber law hygiene — acceptable-use policies, incident playbooks and vendor terms — so that the first call after an incident is to a plan rather than to panic.
When disputes allow it, we resolve technology and data matters through mediation and arbitration rather than courtrooms, through our alternative dispute resolution practice. Bismay Dash & Associates treats every cyber law matter as a live investigation with legal, technical and regulatory strands that must move together.
Frequently asked questions about cyber law
How do I report a cybercrime in Bhubaneswar?
Call the helpline 1930 immediately if money is involved, and file a complaint on the National Cyber Crime Reporting Portal or at the nearest police station, including the cyber police station. Keep every acknowledgment, because the complaint number drives the freezing and follow-up process.
Can money lost to UPI fraud be recovered?
Recovery is strongest when the fraud is reported within hours, because the helpline and the portal trigger freezing of the beneficiary account while funds are still traceable. After the money passes through mule accounts, recovery depends on the investigation, court orders for release and restitution proceedings, which take longer but succeed where the trail is documented.
What is the punishment for identity theft under cyber law?
Identity theft under s.66C of the IT Act is punishable with imprisonment up to three years and a fine up to ₹1 lakh, and cheating by personation under s.66D carries the same maximum. The BNS adds s.319 for cheating by personation, so both statutes may operate on the same conduct.
Does the DPDP Act apply to small businesses in Odisha?
Yes. Any business that handles digital personal data — customer lists, payment details, app registrations — must comply, whatever its size. Duties scale with the data handled and the risk created, and penalties depend on the conduct, not the turnover of the firm.
What is the electronic evidence certificate under the BSA 2023?
It is the certificate under s.63 of the BSA 2023 that accompanies an electronic record in court, identifying the device and certifying how the record was produced. Without it, chats, recordings and logs are generally inadmissible, which is why evidence handling decides most cyber law trials.
How long do cybercrime cases take?
Financial-fraud investigations move quickly when funds are frozen, but trials depend on the number of accounts, forensic reports, server records from multiple jurisdictions and witness availability. The BNSS imposes investigation timelines and the portal allows victims to track progress, so consistent follow-up matters.
Get advice from a cyber law team in Bhubaneswar
Cyber law moves faster than any other field of practice, and the first week of any matter usually decides it. Bismay Dash & Associates anchors that response within the firm’s wider strengths — our full range of practice areas — from criminal defence to banking and data protection. Reach our Bhubaneswar office for a consultation on any cyber law matter, before the trail goes cold.