Section 2 IT Act: All Definitions Explained

Section 2 is the dictionary of the IT Act. Almost every question on the Act turns on a defined term: whether a phone is a 'computer', whether a platform is an 'intermediary', whether a file is an 'electronic record', whether a method is an 'electronic signature'. This note explains every definition in Section 2(1), grouped into families, notes the terms the Act uses but does not define, and works through the comparisons examiners most often set.

1. The Dictionary at the Front of the Book

A good dictionary tells you not only what a word means but what it does not mean. Section 2 works the same way: 'addressee' excludes intermediaries, 'computer system' excludes non-programmable calculators, and 'electronic signature' includes digital signatures. Reading the definitions closely, including their inclusions and exclusions, is the surest way to answer questions on the rest of the Act.

Figure 1: Seven families of definitions

2. Structure of Section 2

• Section 2(1). Definitions from clause (a), 'access', to clause (zh), 'verify', with clauses inserted in 2008 (such as (ha), (na), (nb), (ta), (tb) and (ua)) and in 2017 ((da), Appellate Tribunal). Clause (n), 'Cyber Appellate Tribunal', was omitted by the Finance Act, 2017.
• 'Unless the context otherwise requires'. The definitions apply unless the context of a particular provision indicates otherwise.
• Section 2(2). A reference to an enactment or provision not in force in any area is to be read, in relation to that area, as a reference to the corresponding law in force there.

Figure 2: Twelve core definitions

3. Computing Terms

• Access (a). Gaining entry into, instructing or communicating with the logical, arithmetical or memory function resources of a computer, computer system or computer network. The key word in Section 43(a) and hence Section 66.
• Computer (i). Any electronic, magnetic, optical or other high-speed data processing device or system which performs logical, arithmetic and memory functions by manipulations of electronic, magnetic or optical impulses, and includes all connected input, output, processing, storage, software and communication facilities. In Syed Asifuddin v. State of A.P. (2005), the Andhra Pradesh High Court treated a mobile handset as a computer.
• Computer network (j). The inter-connection of one or more computers, computer systems or communication devices through satellite, microwave, terrestrial line, wire, wireless or other media, and terminals or complexes of inter-connected computers or devices, whether or not continuously maintained.
• Computer resource (k). Computer, computer system, computer network, data, computer database or software.
• Computer system (l). A device or collection of devices, including input and output support devices and excluding non-programmable calculators, capable of use with external files containing programs, instructions and data, which performs logic, arithmetic, data storage and retrieval, communication control and other functions.
• Communication device (ha). Cell phones, personal digital assistants, a combination of both, or any other device used to communicate, send or transmit any text, video, audio or image.
• Function (u). In relation to a computer, includes logic, control, arithmetical process, deletion, storage, retrieval and communication or telecommunication from or within a computer.
• Cyber cafe (na). Any facility from where access to the internet is offered by any person in the ordinary course of business to members of the public.

4. Information Terms

• Data (o). A representation of information, knowledge, facts, concepts or instructions prepared in a formalised manner and intended to be, being or having been processed in a computer system or network, in any form, including printouts, storage media, punched cards or tapes, or stored in memory.
• Information (v). Includes data, message, text, images, sound, voice, codes, computer programmes, software and databases or micro film or computer generated micro fiche.
• Electronic form (r). With reference to information, any information generated, sent, received or stored in media, magnetic, optical, computer memory, micro film, computer generated micro fiche or similar device.
• Electronic record (t). Data, record or data generated, image or sound stored, received or sent in an electronic form, or micro film or computer generated micro fiche. The central unit recognised by Section 4 and proved under Sections 61 to 63 of the BSA.
• Electronic Gazette (s). The Official Gazette published in electronic form.

5. Signature Terms

• Asymmetric crypto system (f). A system of a secure key pair consisting of a private key for creating a digital signature and a public key to verify it.
• Key pair (x). A private key and its mathematically related public key, so related that the public key can verify a digital signature created by the private key.
• Private key (zc). The key of a key pair used to create a digital signature.
• Public key (zd). The key of a key pair used to verify a digital signature and listed in the Digital Signature Certificate.
• Digital signature (p). Authentication of an electronic record by a subscriber by means of an electronic method or procedure in accordance with Section 3.
• Electronic signature (ta). Authentication of an electronic record by a subscriber by means of the electronic technique specified in the Second Schedule, and includes a digital signature.
• Affixing electronic signature (d). Adoption of any methodology or procedure by a person for the purpose of authenticating an electronic record by means of an electronic signature.
• Digital Signature Certificate (q) and Electronic Signature Certificate (tb). A certificate issued under Section 35(4); an Electronic Signature Certificate includes a Digital Signature Certificate.
• Verify (zh). To determine whether the initial electronic record was affixed with the digital signature using the private key corresponding to the subscriber's public key, and whether it is retained intact or has been altered since.

6. Parties

• Originator (za). A person who sends, generates, stores or transmits any electronic message, or causes it to be sent, generated, stored or transmitted to another, but not an intermediary.
• Addressee (b). A person intended by the originator to receive the electronic record, but not an intermediary.
• Subscriber (zg). A person in whose name the Electronic Signature Certificate is issued.
• Intermediary (w). With respect to any particular electronic records, any person who on behalf of another receives, stores or transmits that record or provides any service with respect to it, and includes telecom, network and internet service providers, web-hosting providers, search engines, online payment sites, online auction sites, online marketplaces and cyber cafes.

Figure 3: Originator, intermediary and addressee

7. Institutions and Legal Terms

• Adjudicating officer (c). An officer appointed under Section 46(1)
• Appellate Tribunal (da). The Appellate Tribunal referred to in Section 48(1), now TDSAT; inserted in 2017 in place of the omitted clause (n)
• Appropriate Government (e). As respects matters in the State List, or relating to a State law under the Concurrent List, the State Government; in any other case, the Central Government.
• Certifying Authority (g). A person granted a licence to issue an Electronic Signature Certificate under Section 24.
• Certification practice statement (h). A statement issued by a Certifying Authority specifying the practices it employs in issuing Electronic Signature Certificates.
• Controller (m). The Controller of Certifying Authorities appointed under Section 17(1)
• Indian Computer Emergency Response Team (ua). The agency established under Section 70B(1)
• Law (y). Includes Acts of Parliament and State Legislatures, Ordinances, regulations under Article 240, President's Acts under Article 357, and rules, regulations, bye-laws and orders made under them.
• Licence (z) and prescribed (zb). A licence granted to a Certifying Authority under Section 24; prescribed by rules made under the Act.

8. Security Terms

• Cyber security (nb). Protecting information, equipment, devices, computer, computer resource, communication device and information stored therein from unauthorised access, use, disclosure, disruption, modification or destruction.
• Secure system (ze). Computer hardware, software and procedure that are reasonably secure from unauthorised access and misuse, provide a reasonable level of reliability and correct operation, are reasonably suited to their intended functions, and adhere to generally accepted security procedures.
• Security procedure (zf). The security procedure prescribed by the Central Government under Section 16.

9. Terms the Act Does Not Define

• Person. Not defined in the IT Act. Under Section 3(42) of the General Clauses Act, 1897, 'person' includes any company or association or body of individuals, whether incorporated or not. The IT Act separately explains 'company' for Section 85 and 'body corporate' for Section 43A.
• Signature creation data. Used in Sections 3A(2) and 15 but not defined in Section 2; the Explanation to Section 15 equates it, in the case of a digital signature, with the subscriber's private key.
• Public key infrastructure. Not defined, but the Act builds one: the Controller as root, licensed Certifying Authorities, certificates binding public keys to subscribers, and relying parties who verify.

Figure 4: India's public key infrastructure as built by the Act

10. Key Comparisons

Computer Resource and Computer System

Figure 5: The machine and everything around it

Electronic Record and Data

Figure 6: Raw material and finished document

Digital Signature and Electronic Signature

• Relationship. Every digital signature is an electronic signature (s.2(1)(ta)), but not every electronic signature is a digital signature.
• Technology. A digital signature must use an asymmetric crypto system and hash function (s.3); an electronic signature may use any reliable technique in the Second Schedule (s.3A)
• Origin. 'Digital signature' is the 2000 concept; 'electronic signature' was added in 2008 for technology neutrality (see Topic 37)

Originator and Addressee

• Roles. The originator sends or causes the record to be sent; the addressee is the person the originator intends to receive it. Neither includes an intermediary.
• Why it matters. Sections 11 to 13 attribute records to originators and fix the time and place of receipt by reference to the addressee's designated resource and place of business.

Intermediary: Scope and Meaning

Figure 7: Intermediaries named in Section 2(1)(w)

• Functional test. The phrase 'with respect to any particular electronic records' means intermediary status is decided record by record. A platform is an intermediary for content posted by users, but a publisher of content it creates itself.
• Inclusive list. The named categories are illustrations; any person who handles records on behalf of another may qualify.
• Courts. An e-commerce site actively involved in selling goods is not a mere intermediary (Christian Louboutin v. Nakul Bajaj, Delhi High Court, 2018); an intermediary's duty to act arises on specific knowledge (MySpace v. Super Cassettes, Delhi High Court, 2016); and 'actual knowledge' under Section 79 means a court order or government notification (Shreya Singhal, 2015)
• IT Rules. The 2021 Rules create sub-categories of social media and significant social media intermediaries (see Topic 22)

11. Quick Revision and Memory Aids

• 'Dictionary at the front of the book'. Section 2's role.
• 'Machine, network, everything: system, network, resource'. Clauses (l), (j), (k)
• 'Raw data, finished record'. Clauses (o) and (t)
• 'Private creates, public verifies'. Clauses (zc), (zd)
• 'Sender, carrier, receiver'. Originator, intermediary, addressee.
• 'Person? See General Clauses Act 3(42)'. Undefined terms.

12. Frequently Asked Questions

Is a mobile phone a 'computer' under the IT Act?

Yes. It performs logical, arithmetic and memory functions by electronic impulses, and the Andhra Pradesh High Court in Syed Asifuddin (2005) treated a handset as a computer. It is also a 'communication device' under Section 2(1)(ha).

What is the difference between an originator and an intermediary?

The originator sends, generates, stores or transmits a message or causes it to be sent; the intermediary handles the record on behalf of another. Both 'originator' and 'addressee' expressly exclude intermediaries.

13. Related Topics

• Topic 31: Section-Wise Structure. Where each defined term is used.
• Topic 37: Digital and Electronic Signatures. The signature definitions in action.