Section 72A creates criminal liability for disclosure of personal information in breach of a lawful contract. It applies to any person, including an intermediary, who obtains access to another person's personal information while providing contractual services. Liability arises where the information is disclosed without consent or in breach of contract, with intent to cause, or knowledge of likely causing, wrongful loss or wrongful gain. The offence is punishable with imprisonment, fine, or both, subject to applicable legal exceptions.

The Central Government must appoint the Indian Computer Emergency Response Team, with a Director-General and prescribed staff, as the national agency for cyber security incident response. Its functions include collecting, analysing and disseminating incident information; issuing forecasts and alerts; implementing emergency measures; coordinating response activities; and issuing information-security guidelines, advisories, vulnerability notes and whitepapers. To discharge these functions, it may require information from, and issue directions to, service providers, intermediaries, data centres, body corporate and other persons.

Protection of Critical Information Infrastructure permits the appropriate Government, through Official Gazette notification, to designate affected computer resources as protected systems. Critical Information Infrastructure includes resources whose incapacitation or destruction has a debilitating impact on national security, the economy, public health or safety. Information-security practices and procedures must be prescribed for protected systems.

Interception, monitoring and decryption of information through computer resources may be directed on recorded written reasons for specified security, public-order, offence-prevention or investigation purposes, subject to prescribed safeguards. Subscribers, intermediaries and resource custodians must provide access, technical assistance or stored information. Public access to online information may be blocked under similar safeguards. Government agencies may also monitor and collect traffic data for cyber security, intrusion identification and prevention, with technical assistance obligations for intermediaries and resource custodians.

Section 68 is amended by replacing sub-section (2). Intentional or knowing non-compliance with an order under sub-section (7) constitutes an offence. On conviction, the person may be punished with imprisonment for up to two years, a fine of up to one lakh rupees, or both. Criminal liability applies only where the failure to comply is intentional or knowing.

Section 32 substitutes provisions creating computer-related offences for dishonest or fraudulent acts involving computer resources, offensive electronic communications, receipt of stolen computer resources, identity theft, cheating by personation, privacy violations, and cyber terrorism. It also criminalises electronic publication or transmission of obscene, sexually explicit, and child sexual material, subject to limited public-good and bona fide heritage or religious exclusions. Intermediaries must preserve and retain prescribed information for the prescribed period and in the prescribed manner, with penalties for intentional or knowing non-compliance.

Section 64 of the Information Technology Act, 2000 is amended to cover both a penalty imposed and compensation awarded. Its marginal heading is correspondingly changed from "penalty" to "penalty or compensation."

Section 56 of the Information Technology Act, 2000 is amended by substituting the term "Chairperson" for "Presiding Officer".

Section 55 of the Information Technology Act, 2000 is amended by replacing the expression "Presiding Officer" with "Chairperson or the Member", aligning references in the provision to the designated adjudicatory office-holders.

Section 54 of the Information Technology Act, 2000 replaces references to "Presiding Officer" with "Chairperson or the Member" wherever they occur, aligning the provision with the designated tribunal office-holders.

Section 53 of the Information Technology Act, 2000 is amended by substituting "Chairperson or Member, as the case may be," for "Presiding Officer." The revised wording replaces the earlier singular designation with an office-specific reference applicable to the Chairperson or Member concerned.

Section 26 replaces the framework governing the Cyber Appellate Tribunal. The Tribunal comprises a Chairperson and appointed Members, with selection by the Central Government in consultation with the Chief Justice of India. Its jurisdiction may be exercised through one- or two-Member Benches constituted by the Chairperson, who may transfer Members and matters, distribute business and exercise general superintendence. Eligibility standards govern the Chairperson, specialist Members and Judicial Members; office is limited to five years or age sixty-five, subject to conflict-of-interest safeguards. A two-Member Bench's disagreement is decided by majority after reference to the Chairperson.

Section 48(1) of the Information Technology Act, 2000 is amended by omitting the word "Regulations".

Chapter X of the Information Technology Act, 2000 is revised by omitting the word "REGULATIONS" from its heading. The change is confined to the chapter heading and modifies the formal title used to identify the Chapter. No alteration to substantive provisions, powers, procedures, or legal obligations within Chapter X is specified.

Section 46 allocates jurisdiction over injury or damage claims by claim value: the adjudicating officer may adjudicate claims not exceeding five crore rupees, while claims exceeding that threshold vest in the competent court. Directions or orders are limited to those creating liability for penalty or compensation. The adjudicating officer is deemed a civil court solely for purposes of Order XXI of the Code of Civil Procedure, 1908.

Section 43A establishes compensation liability where a body corporate handling sensitive personal data or information in a computer resource it owns, controls, or operates negligently fails to implement and maintain reasonable security practices and procedures. Liability arises where that negligence causes wrongful loss or wrongful gain to any person, requiring payment of damages by way of compensation to the affected person.

Section 43 expands conduct attracting damages to include destruction, deletion, or alteration of information in a computer resource and acts diminishing its value, utility, or integrity. It also covers intentional stealing, concealment, destruction, or alteration of computer source code. Damages are payable by way of compensation to the affected person, and computer source code includes programme listings, commands, design and layout, and programme analysis.

Chapter IX of the Information Technology Act, 2000 is retitled as "Penalties, Compensation and Adjudication", incorporating compensation within the scope indicated by the chapter heading.

Section 40A establishes duties of a subscriber in relation to an Electronic Signature Certificate. The subscriber's obligations are subject to prescribed requirements, with the particular duties to be specified through such prescription rather than set out within section 40A itself.

Section 36 adds requirements for the relationship between a subscriber's private key and the public key listed in a digital signature certificate. The subscriber must hold a private key capable of creating a digital signature, while the listed public key must be capable of verifying a signature created through that private key.