IT Act and the Digital Economy in India

India's digital economy, from UPI payments and online marketplaces to DigiLocker certificates and e-signed contracts, rests on a legal assumption most users never think about: that electronic actions have legal effect. The IT Act, 2000 supplies that assumption. This note explains what the digital economy is and how large it has become, how the IT Act provides its legal foundation in layers of trust, security, platform regulation and data protection, which other laws now surround it, the constitutional cases that shape it, and the challenges that are pushing the law to change.

1. The Rails under the Train

Passengers see the train: the app, the payment, the delivery. They do not see the rails, the signals and the rules of the railway. The digital economy is the train. The IT Act is part of the rails: it makes electronic records count, signatures valid and contracts binding, it sets signals against misuse, and it lays down rules for the platforms that carry traffic. Without the rails, the train would not move, however modern the engine.

2. The Digital Economy: Meaning and Scale

• Meaning. Economic activity that depends on digital technologies: the core ICT sector, digital platforms such as marketplaces, payments and social media, and the digitalisation of traditional sectors such as banking, retail, agriculture and government services.
• Features. Scale without mass, network effects, data as a central asset, cross-border reach and heavy reliance on intermediaries.

Figure 1: Size of India's digital economy (MeitY report, January 2025)

3. Digital Public Infrastructure

• Aadhaar. Digital identity with online authentication and e-KYC, under the Aadhaar Act, 2016.
• UPI. The real-time payment system operated by NPCI since 2016, regulated under the Payment and Settlement Systems Act, 2007.
• e-Sign. Aadhaar-based electronic signatures recognised through the Second Schedule of the IT Act in 2015.
• DigiLocker. A government digital locker under rules framed under the IT Act in 2016. Rule 9A treats documents issued through DigiLocker as equivalent to the original physical documents.
• Account Aggregator and ONDC. Consent-based sharing of financial data through RBI-regulated aggregators, and an open network for digital commerce.
• The legal glue. Each of these depends on the IT Act's recognition of electronic records (s.4), electronic signatures (ss.3A and 5), electronic delivery of services (ss.6 and 6A) and retention of records (s.7)

4. The IT Act as the Legal Foundation

Figure 2: Layers of the digital economy and the IT Act's role in each

• Trust layer. Legal recognition of electronic records, signatures and contracts (ss.3 to 10A), attribution and receipt rules (ss.11 to 13), and a licensed Certifying Authority system (ss.17 to 42). Section 6A lets the government authorise service providers, such as Common Service Centres, to deliver e-services.
• Security layer. Civil liability for unauthorised access and data damage (s.43), offences such as identity theft and cheating by personation (ss.66C and 66D), protection of critical information infrastructure (ss.70 and 70A), and CERT-In (s.70B). Confidence in digital payments depends on this layer.
• Platform layer. The conditional safe harbour for intermediaries (s.79) allowed marketplaces, search engines and social media to scale without liability for every user post, while the IT Rules, 2021 impose due diligence and grievance duties.
• Data layer. Section 43A and the SPDI Rules, 2011 made companies accountable for securing sensitive personal data, a role being taken over by the DPDP Act, 2023.

5. The Laws around the IT Act

Figure 3: The wider legal framework of the digital economy

• Digital Personal Data Protection Act, 2023. The general law on personal data, with substantive obligations from May 2027 (see Topic 8)
• Payment and Settlement Systems Act, 2007. RBI regulation of UPI, cards, wallets and payment aggregators.
• Consumer Protection Act, 2019. Consumer rights in e-commerce, with the E-Commerce Rules, 2020 and the dark patterns guidelines, 2023.
• Telecommunications Act, 2023. Regulation of telecom networks and services that carry the digital economy.
• Promotion and Regulation of Online Gaming Act, 2025. Prohibits online money games, promotes e-sports and online social games, and sets up the Online Gaming Authority of India. It received assent in August 2025, came into force on 1 May 2026, and has been challenged before the Supreme Court.
• Competition Act, 2002. Applied by the Competition Commission to digital markets; a draft Digital Competition Bill was released for consultation in 2024.
• Code on Social Security, 2020. Recognises gig workers and platform workers.
• The next step. A Digital India Act to replace the IT Act has been proposed and publicly discussed but not enacted.

Figure 4: Milestones of India's digital economy

6. Constitutional Cases Shaping the Digital Economy

Figure 5: Three constitutional landmarks

• Internet and Mobile Association of India v. Reserve Bank of India, (2020) 10 SCC 274. The RBI's 2018 circular directing banks not to deal with virtual currency businesses was set aside as disproportionate, since it cut off the banking lifeline of lawful businesses without evidence of harm to regulated entities.
• Justice K.S. Puttaswamy (Retd.) v. Union of India (Aadhaar), (2019) 1 SCC 1. The Aadhaar scheme was largely upheld under the proportionality test, but Section 57 of the Aadhaar Act, allowing private entities to require Aadhaar authentication by contract, was struck down.

7. Challenges Ahead

• Cyber fraud. The rise of digital payments has brought phishing, fake investment schemes and impersonation scams, testing Sections 66C and 66D and the capacity of investigators.
• Artificial intelligence and deepfakes. The 2026 amendment to the IT Rules requires labelling of synthetically generated content and faster takedowns, but the Act itself predates generative AI.
• Platform power. Questions of intermediary liability, market dominance and fair treatment of sellers and gig workers go beyond the safe harbour model of Section 79.
• Data. Moving from Section 43A to the DPDP Act, handling cross-border data flows and balancing data use with privacy.
• An ageing statute. The IT Act was drafted in 2000 for a much smaller online world; much of its modern working depends on rules made under it, which is why a replacement Digital India Act has been proposed.

8. Quick Revision and Memory Aids

• 'Rails under the train'. The IT Act as legal infrastructure.
• 'Trust, security, platform, data'. The four layers.
• '11.74 now, 20 by 2030'. The digital economy's share of national income.
• 'DigiLocker 9A = original'. Legal equivalence of digital documents.
• 'Bhasin: internet trade is 19(1)(g)'. Constitutional protection.
• 'IAMAI: proportionality for regulators'. Limits on banning digital businesses.

9. Frequently Asked Questions

What is the role of the IT Act in the digital economy?

It provides the legal foundation: recognition of electronic records, signatures and contracts, a trust infrastructure of Certifying Authorities, protection against cyber contraventions and offences, a conditional safe harbour for intermediaries, and, until the DPDP Act takes over, the duty to secure sensitive personal data.

Which case recognised the right to carry on trade over the internet?

Anuradha Bhasin v. Union of India, (2020) 3 SCC 637, which held that the freedom to carry on trade or business over the internet is protected by Article 19(1)(g).

10. Related Topics

• Topic 13: Technology-Neutral Approach. Why the Act can keep up with new technology.
• Topic 15: IT Act and E-Commerce. The Act at work in an online sale.