Section 47 of the Information Technology (Amendment) Act, 2008 omits clause (c) of sub-section (2) of section 90 of the Information Technology Act, 2000.

Rule-making authority under section 87 is expanded to cover electronic signature reliability, authentication procedures, Electronic Signature Certificates, subscriber duties, reasonable security practices, and sensitive personal data. It also extends to service-provider charges, information retention, interception, decryption, public-access blocking, traffic-data collection, protected-system security, agency functions, intermediary guidelines, and encryption methods. The laying provision is aligned with notifications concerning the national nodal agency.

New sections 84A, 84B and 84C establish government-prescribed encryption standards and ancillary criminal liability. Encryption methods may be prescribed for secure electronic use and promotion of e-governance and e-commerce. Where no specific punishment applies, abetment resulting in an offence attracts the punishment for that offence, while an attempt involving an act towards commission may attract up to one-half of the maximum imprisonment, the applicable fine, or both.

Section 84 of the Information Technology Act, 2000 is amended by replacing the reference to "Presiding Officer" with "Chairperson, Members", aligning the provision with those offices.

Section 82 revises its marginal heading to identify the Chairperson, Members, officers and employees as public servants. References to "Presiding Officer" are replaced with "Chairperson, Members", aligning the provision's terminology with the revised institutional design and public-servant designation.

Section 81 of the Information Technology Act, 2000 is amended by inserting a proviso that preserves every person's right to exercise rights conferred under the Copyright Act, 1957 and the Patents Act, 1970. The amendment clarifies that the Information Technology Act does not restrict the exercise of copyright or patent rights.

Section 80(1) of the Information Technology Act, 2000 is amended by replacing the rank of Deputy Superintendent of Police with Inspector, extending the specified statutory power under that provision to an Inspector.

Intermediary safe harbour excludes liability for third-party information, data, or communication links where the intermediary provides access, does not initiate or control transmission content or recipients, and observes due diligence and prescribed guidelines. Protection is unavailable for conspiracy, abetment, aid, or inducement of an unlawful act, or for failure after actual knowledge or government notification to expeditiously remove or disable unlawful material without impairing evidence. Governmental departments, bodies, or agencies may be notified as Examiners of Electronic Evidence to provide expert opinion.

Section 78 of the Information Technology Act, 2000 is amended by substituting "Inspector" for "Deputy Superintendent of Police", altering the police rank specified for the relevant statutory function.

Compensation, penalties or confiscation under the information-technology framework do not prevent separate compensation, penalties or punishment under other law. Compounding is available only for offences not punishable with life imprisonment or imprisonment exceeding three years, subject to exclusions for prior convictions, offences affecting socio-economic conditions, and offences against women or children below 18 years. Offences punishable with imprisonment of three years and above are cognizable, while offences punishable with imprisonment of three years are bailable.

Section 72A creates criminal liability for disclosure of personal information in breach of a lawful contract. It applies to any person, including an intermediary, who obtains access to another person's personal information while providing contractual services. Liability arises where the information is disclosed without consent or in breach of contract, with intent to cause, or knowledge of likely causing, wrongful loss or wrongful gain. The offence is punishable with imprisonment, fine, or both, subject to applicable legal exceptions.

The Central Government must appoint the Indian Computer Emergency Response Team, with a Director-General and prescribed staff, as the national agency for cyber security incident response. Its functions include collecting, analysing and disseminating incident information; issuing forecasts and alerts; implementing emergency measures; coordinating response activities; and issuing information-security guidelines, advisories, vulnerability notes and whitepapers. To discharge these functions, it may require information from, and issue directions to, service providers, intermediaries, data centres, body corporate and other persons.

Protection of Critical Information Infrastructure permits the appropriate Government, through Official Gazette notification, to designate affected computer resources as protected systems. Critical Information Infrastructure includes resources whose incapacitation or destruction has a debilitating impact on national security, the economy, public health or safety. Information-security practices and procedures must be prescribed for protected systems.

Interception, monitoring and decryption of information through computer resources may be directed on recorded written reasons for specified security, public-order, offence-prevention or investigation purposes, subject to prescribed safeguards. Subscribers, intermediaries and resource custodians must provide access, technical assistance or stored information. Public access to online information may be blocked under similar safeguards. Government agencies may also monitor and collect traffic data for cyber security, intrusion identification and prevention, with technical assistance obligations for intermediaries and resource custodians.

Section 68 is amended by replacing sub-section (2). Intentional or knowing non-compliance with an order under sub-section (7) constitutes an offence. On conviction, the person may be punished with imprisonment for up to two years, a fine of up to one lakh rupees, or both. Criminal liability applies only where the failure to comply is intentional or knowing.

Section 32 substitutes provisions creating computer-related offences for dishonest or fraudulent acts involving computer resources, offensive electronic communications, receipt of stolen computer resources, identity theft, cheating by personation, privacy violations, and cyber terrorism. It also criminalises electronic publication or transmission of obscene, sexually explicit, and child sexual material, subject to limited public-good and bona fide heritage or religious exclusions. Intermediaries must preserve and retain prescribed information for the prescribed period and in the prescribed manner, with penalties for intentional or knowing non-compliance.

Section 64 of the Information Technology Act, 2000 is amended to cover both a penalty imposed and compensation awarded. Its marginal heading is correspondingly changed from "penalty" to "penalty or compensation."

Section 56 of the Information Technology Act, 2000 is amended by substituting the term "Chairperson" for "Presiding Officer".

Section 55 of the Information Technology Act, 2000 is amended by replacing the expression "Presiding Officer" with "Chairperson or the Member", aligning references in the provision to the designated adjudicatory office-holders.

Section 54 of the Information Technology Act, 2000 replaces references to "Presiding Officer" with "Chairperson or the Member" wherever they occur, aligning the provision with the designated tribunal office-holders.