This is Set 11 of 40 in the smartvidya question bank on the Information Technology Act, 2000, with the latest amendments and rules. Part IV: Penalties, adjudication and the Appellate Tribunal. This set covers Compensation for unauthorised access and damage, the ten clauses of Section 43, and compensation for failure to protect sensitive personal data.
Try each question first, then tap Show answer to see the correct option, a short explanation and the section or rule reference. The questions are useful for departmental and promotion examinations, for law, IT and cyber security students, and for officers who deal with cyber cases.
Set 11: Chapter IX: Section 43 and Section 43A
1. Section 43 provides for
(a) penalty and compensation for damage to computer, computer system, etc.
(b) punishment for cyber terrorism
(c) blocking of websites
(d) intermediary safe harbour
Ans. (a) penalty and compensation for damage to computer, computer system, etc. — Explanation: Section 43 is the core civil remedy for unauthorised acts on computers. [Ref: Section 43]
2. Under Section 43, the person who commits a listed act without permission of the owner or person in charge is liable to
(a) pay damages by way of compensation to the person so affected
(b) a fine payable to Government only
(c) deportation
(d) imprisonment for life
Ans. (a) pay damages by way of compensation to the person so affected — Explanation: Section 43 is a civil liability provision. [Ref: Section 43]
3. Before the 2008 amendment, compensation under Section 43 was capped at
(a) ₹25,000
(b) ₹10 lakh
(c) ₹1 crore
(d) ₹5 crore
Ans. (c) ₹1 crore — Explanation: The 2008 amendment removed the ₹1 crore ceiling. [Ref: Section 43 (original)]
4. Downloading, copying or extracting any data from a computer without permission is covered by
(a) Section 43(f)
(b) Section 43(a)
(c) Section 43(b)
(d) Section 43(c)
Ans. (c) Section 43(b) — Explanation: Clause b covers downloading, copying or extraction. [Ref: Section 43(b)]
5. Introducing a computer contaminant or virus into a computer without permission is covered by
(a) Section 43(d)
(b) Section 43(g)
(c) Section 43(e)
(d) Section 43(c)
Ans. (d) Section 43(c) — Explanation: Clause c covers viruses and contaminants. [Ref: Section 43(c)]
6. Denying or causing denial of access to an authorised person is covered by
(a) Section 43(e)
(b) Section 43(f)
(c) Section 43(i)
(d) Section 43(h)
Ans. (b) Section 43(f) — Explanation: Clause (f) covers denial of access, as in denial-of-service attacks. [Ref: Section 43(f)]
7. Charging the services availed by one person to the account of another by tampering with a computer is covered by
(a) Section 43(h)
(b) Section 43(j)
(c) Section 43(g)
(d) Section 43(b)
Ans. (a) Section 43(h) — Explanation: Clause (h) covers such tampering. [Ref: Section 43(h)]
8. Destroying, deleting or altering information in a computer resource, diminishing its value or utility, was added by the 2008 amendment as
(a) Section 43(a)
(b) Section 43(i)
(c) Section 43(e)
(d) Section 43(d)
Ans. (b) Section 43(i) — Explanation: Clause (i) was inserted in 2009. [Ref: Section 43(i)]
9. Stealing, concealing, destroying or altering computer source code with intent to cause damage is covered by
(a) Section 43(j)
(b) Section 43(h)
(c) Section 43(c)
(d) Section 43(i)
Ans. (a) Section 43(j) — Explanation: Clause (j) was inserted in 2009. [Ref: Section 43(j)]
10. Providing assistance to any person to facilitate unauthorised access to a computer is covered by
(a) Section 43(f)
(b) Section 43(a)
(c) Section 43(e)
(d) Section 43(g)
Ans. (d) Section 43(g) — Explanation: Clause (g) covers facilitation. [Ref: Section 43(g)]
11. If an act under Section 43 is done dishonestly or fraudulently, it becomes an offence under
(a) Section 72
(b) Section 65
(c) Section 67
(d) Section 66
Ans. (d) Section 66 — Explanation: Section 66 criminalises Section 43 acts done dishonestly or fraudulently. [Ref: Section 66]
12. Section 43A, inserted in 2009, provides for compensation where a body corporate
(a) earns profits from data
(b) fails to file returns
(c) is negligent in implementing reasonable security practices for sensitive personal data, causing wrongful loss or gain
(d) shares data with Government
Ans. (c) is negligent in implementing reasonable security practices for sensitive personal data, causing wrongful loss or gain — Explanation: Section 43A deals with failure to protect data. [Ref: Section 43A]
13. Under the Explanation to Section 43A, "body corporate" includes
(a) only listed companies
(b) any company, firm, sole proprietorship or other association of individuals engaged in commercial or professional activities
(c) only banks
(d) only Government companies
Ans. (b) any company, firm, sole proprietorship or other association of individuals engaged in commercial or professional activities — Explanation: The definition is broad. [Ref: Section 43A, Explanation]
14. The rules prescribing sensitive personal data and reasonable security practices under Section 43A are
(a) the CERT-In Rules, 2013
(b) the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
(c) the Blocking Rules, 2009
(d) the IT Rules, 2021
Ans. (b) the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 — Explanation: These are commonly called the SPDI Rules, 2011. [Ref: Section 43A; SPDI Rules 2011]
15. Which of these is "sensitive personal data or information" under the SPDI Rules, 2011?
(a) Information furnished under the RTI Act
(b) Information freely available in the public domain
(c) Passwords, financial information, health conditions and biometric information
(d) Name and public address only
Ans. (c) Passwords, financial information, health conditions and biometric information — Explanation: Rule 3 of the SPDI Rules lists sensitive categories; public domain information is excluded. [Ref: SPDI Rules 2011, Rule 3]
16. Under the SPDI Rules, the international standard recognised as reasonable security practice is
(a) ISO 9001
(b) ISO 14001
(c) ISO 45001
(d) IS/ISO/IEC 27001
Ans. (d) IS/ISO/IEC 27001 — Explanation: Rule 8 of the SPDI Rules refers to IS/ISO/IEC 27001. [Ref: SPDI Rules 2011, Rule 8]
17. Section 44(2) of the Digital Personal Data Protection Act, 2023 amends the IT Act by
(a) omitting Section 69A
(b) omitting Section 43A
(c) omitting Section 66
(d) omitting Section 79
Ans. (b) omitting Section 43A — Explanation: Data protection compensation shifts to the DPDP framework. [Ref: DPDP Act, 2023, Section 44(2)]
18. The omission of Section 43A by the DPDP Act takes effect
(a) eighteen months after the November 2025 commencement notification, that is, in May 2027
(b) from August 2023
(c) from 1 April 2026
(d) immediately in November 2025
Ans. (a) eighteen months after the November 2025 commencement notification, that is, in May 2027 — Explanation: Section 44(2) of the DPDP Act was notified to commence eighteen months from the notification. [Ref: DPDP Act commencement notification, November 2025]
19. Until Section 43A is omitted, a claim for compensation for negligent handling of sensitive personal data lies under
(a) Section 79
(b) Section 70
(c) Section 66F
(d) Section 43A of the IT Act
Ans. (d) Section 43A of the IT Act — Explanation: Section 43A remains in force till the DPDP omission takes effect. [Ref: Section 43A]
20. Unauthorised access to a computer without permission, without any dishonest intent, attracts
(a) punishment under Section 67
(b) no liability
(c) imprisonment under Section 66F
(d) civil liability under Section 43
Ans. (d) civil liability under Section 43 — Explanation: Section 43 is civil; Section 66 requires dishonesty or fraud. [Ref: Section 43(a)]
21. Consider: (i) Section 43 has no upper limit on compensation after 2009. (ii) Section 43A applies to body corporates. Which is correct?
(a) Only (i)
(b) Only (ii)
(c) Both (i) and (ii)
(d) Neither (i) nor (ii)
Ans. (c) Both (i) and (ii) — Explanation: Both statements are correct. [Ref: Sections 43 and 43A]
22. Disrupting or causing disruption of any computer, system or network is covered by
(a) Section 43(d)
(b) Section 43(e)
(c) Section 43(f)
(d) Section 43(g)
Ans. (b) Section 43(e) — Explanation: Clause (e) covers disruption. [Ref: Section 43(e)]
23. Damaging any computer, network, data or programme is covered by
(a) Section 43(c)
(b) Section 43(e)
(c) Section 43(d)
(d) Section 43(b)
Ans. (c) Section 43(d) — Explanation: Clause d covers damage. [Ref: Section 43(d)]
24. Assertion (A): A body corporate that leaks customers' card data through poor security may have to pay compensation under the IT Act. Reason (R): Section 43A imposes liability for negligence in reasonable security practices for sensitive personal data.
(a) Both A and R are true and R is the correct explanation of A
(b) Both A and R are true but R is not the correct explanation of A
(c) A is true but R is false
(d) A is false but R is true
Ans. (a) Both A and R are true and R is the correct explanation of A — Explanation: Section 43A supports the assertion while it remains in force. [Ref: Section 43A]
25. Securing access to a computer system without permission is covered by
(a) Section 43(a)
(b) Section 43(g)
(c) Section 43(h)
(d) Section 43(b)
Ans. (a) Section 43(a) — Explanation: Clause a covers access or securing access. [Ref: Section 43(a)]
Want all 1,000 IT Act questions in one PDF? The IT Act 2000 ebook has all 40 sets with answers, explanations and quick-revision tables of punishments, penalties, IT Rules timelines and case law. Launch offer: ₹99 MRP ₹200. Get the ebook
Next: Set 12. See all sets under the label IT Act. For exam preparation, attempt the full set before checking answers and revise the topic of every question you miss.
These questions are prepared for practice from the Information Technology Act, 2000 as amended (including the 2008 amendment, the Jan Vishwas Act, 2023 and the DPDP Act, 2023), the IT Rules, 2021 with amendments up to 2026, and the CERT-In Directions. Check the latest notifications from MeitY before relying on any detail.