Adjudication Under the IT Act: Resolving Cyber Disputes in India

When someone hacks into your computer, steals your data, or causes financial damage through digital means, the natural question is: where do you go for justice? In India, the answer lies within the Information Technology Act, 2000. The IT Act does not just define cyber offences – it also builds a complete, two-tier mechanism to resolve them. This mechanism is called adjudication, and it works through a specific set of officials and tribunals, each with clearly defined powers and limits. Understanding how this system works is essential for anyone navigating the world of digital rights and cyber law in India.

The role of an adjudicating officer 🔗

At the foundation of the IT Act’s dispute resolution system sits a government official called the Adjudicating Officer (AO). The AO is not a judge in the traditional sense, but functions as a quasi-judicial authority – a body that has powers and procedures resembling those of a court, without being a court of law.

Appointment and qualifications 🔗

Section 46(1) of the IT Act grants the Central Government the authority to appoint an AO. The person appointed must hold a rank no lower than a Director to the Government of India, or an equivalent officer of a State Government. Crucially, Section 46(3) specifies that no one can be appointed as an AO without possessing experience in both the field of information technology and legal or judicial matters. In practice, as per a 2003 Ministry of Electronics and Information Technology (MeitY) gazette notification, the Secretary of the Department of Information Technology of each State or Union Territory is appointed as the AO for that respective state by default.

Jurisdiction and scope 🔗

The AO’s jurisdiction is not unlimited. As per Section 46(1A), the AO can only adjudicate matters where the claim for injury or damage does not exceed ₹5 crore. Any claim exceeding this threshold moves out of the AO’s hands and into the jurisdiction of a competent civil court. Where the Central Government appoints more than one AO, it also specifies, by order, which matters and places fall under each officer’s jurisdiction, preventing overlap and confusion.

Powers and functions 🔗

The AO’s primary function is to hold an inquiry and determine whether a person has violated any provision of the IT Act or any rules, regulations, directions, or orders made under it. Once the inquiry is complete and the AO is satisfied that a contravention has occurred, it can impose a penalty or award compensation. Importantly, before reaching any conclusion, the AO must give the accused a reasonable opportunity to make a representation – a fundamental principle of natural justice.

The AO is also equipped with significant investigative powers. Section 46(5) of the IT Act grants the AO the same powers as a civil court under the Code of Civil Procedure, 1908. These include summoning and enforcing the attendance of any person, examining them on oath, requiring the discovery and production of documents or electronic records, and ordering the attachment and sale of property. All proceedings before the AO are deemed to be judicial proceedings within the meaning of Sections 193 and 228 of the Indian Penal Code, making false statements before the AO a punishable offence.

When determining how much compensation to award, the AO must consider specific factors outlined in Section 47 of the IT Act: the amount of unfair advantage gained, the loss suffered by the affected party, and whether the offender has committed the same contravention before. After passing its order, the AO is required to deliver a certified copy to both the complainant and the respondent.

Challenges in practice 🔗

Despite a well-designed framework on paper, the AO system has faced real-world challenges. A detailed analysis by Ikigai Law points out that because State IT Secretaries serve as AOs in addition to their primary administrative roles, the dual workload is extremely burdensome. Furthermore, since there are multiple AOs operating across states simultaneously, conflicting interpretations of the same provision of the IT Act have emerged, creating legal uncertainty for businesses operating nationally. There is also a significant lack of public awareness, as highlighted by the Centre for Internet and Society, which notes that most people simply do not know this mechanism for seeking compensation even exists.

The Cyber Regulations Appellate Tribunal (CRAT) 🔗

No justice system is complete without a mechanism for appeal – a second look by a higher authority. For the IT Act, this second tier was originally provided by the Cyber Regulations Appellate Tribunal (CRAT), established under Section 48 of the IT Act. Understanding its history and current status is essential to grasping how cyber disputes are resolved in India today.

Establishment and original mandate 🔗

Section 48(1) of the IT Act empowered the Central Government to establish, by notification, one or more appellate tribunals to be known as the Cyber Appellate Tribunal. The Central Government was also required to specify, in the same notification, the matters and places over which the tribunal would exercise jurisdiction. The country’s first and only such tribunal was set up and began functioning from October 2006, in New Delhi, with a retired judge of the Delhi High Court as its first Presiding Officer.

The CRAT had appellate jurisdiction only, meaning it could not take up a cyber dispute fresh – it could only examine and review decisions already made by the AO or the Controller of Certifying Authorities. As noted by cyber law experts, the tribunal was placed hierarchically between the High Courts and the Adjudicating Officers, meaning its decisions could themselves be appealed to the High Court. Its authority extended to reviewing an AO’s decision on both facts and law – checking not just whether the right law was applied, but whether the facts were correctly assessed.

Composition 🔗

The CRAT was led by a Chairperson who was required to be a retired judge of a High Court or an eminent person with at least 10 years of experience in information technology. It also included a Judicial Member and a Technical Member, all appointed by the Central Government. Legal observers noted that the composition lacked adequate technical expertise, since cyber law disputes often involve highly complex IT concepts that require a specialized technical understanding beyond what a purely legal background provides.

Transition to TDSAT 🔗

Despite its important mandate, the CRAT had a troubled history – it remained inactive for years because no Presiding Officer was appointed. The situation was significantly restructured in 2017. Through the Finance Act, 2017, the Central Government formally merged the CRAT with the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), which was originally established under Section 14 of the Telecom Regulatory Authority of India Act, 1997. As confirmed by the TDSAT’s own documentation, after the Finance Act 2017 came into force, the TDSAT’s jurisdiction was extended to cover all matters that previously lay before the Cyber Appellate Tribunal. Today, the TDSAT functions as the designated appellate tribunal for all cyber matters under the IT Act, headed by a person who is or has been a Judge of the Supreme Court or the Chief Justice of a High Court.

The appeals process under Section 57 🔗

Now that we know who the AO and the appellate tribunal are, the next question is: how exactly does an appeal work? Section 57 of the IT Act lays this out in clear terms.

Who can appeal and against what 🔗

Section 57(1) states that any person aggrieved by an order made by the Controller of Certifying Authorities or an Adjudicating Officer may prefer an appeal to the Appellate Tribunal (now TDSAT) having jurisdiction in the matter. The phrase “any person aggrieved” is intentionally broad. It covers both the complainant who is unhappy with the outcome, and the person against whom the order was passed and who believes it was unjust. For example, if a company is ordered to pay compensation for a data breach but believes its security measures were adequate, it qualifies as an aggrieved party and can appeal.

The consent order exception 🔗

There is one important restriction. Section 57(2) clearly provides that no appeal shall lie to the Appellate Tribunal from an order that was made with the consent of the parties. This is a logical and well-established principle of law: if both parties agreed to the outcome before the AO, they cannot then turn around and challenge that same agreed-upon outcome before a higher forum. The mutual consent makes the order final and binding on the parties who accepted it.

Timeline for filing an appeal 🔗

An aggrieved party does not have an unlimited window to file an appeal. As analyzed in Ikigai Law’s framework review, a party must file its appeal before the TDSAT within 45 days of receiving a copy of the AO’s order. This limitation period keeps the process from dragging on indefinitely and ensures that disputes are addressed while the facts are still fresh.

How the TDSAT handles the appeal 🔗

Once an appeal is filed, the TDSAT gives both parties a fair opportunity to be heard. It examines the original order, the evidence on record, and any new arguments presented. After this, it can confirm the AO’s decision, modify it, or set it aside entirely. The TDSAT is not bound by the strict procedural rules of the Code of Civil Procedure but must follow the principles of natural justice. It also holds the same civil court powers as the AO – summoning parties, ordering document production, and reviewing its own decisions.

Speed is also a built-in expectation. Section 57(6) of the IT Act directs that appeals should be disposed of as expeditiously as possible, with an endeavour to conclude the process within six months from the date the appeal is received. For a digital world where the consequences of a breach can multiply quickly, this commitment to timely resolution is as important as the resolution itself.

Further appeal to the High Court 🔗

The process does not necessarily end at the TDSAT. As noted in Ikigai Law’s analysis, a party dissatisfied with a TDSAT order may further appeal to the relevant High Court, and must do so within 60 days of receiving that order. This creates a clear, three-tier structure: Adjudicating Officer → TDSAT → High Court, ensuring that no decision is made without the possibility of proper judicial review.

The bigger picture: does the system work? 🔗

The IT Act’s adjudication framework is structurally sound and well-thought-out. It provides a specialized, accessible, and faster alternative to traditional civil courts for resolving cyber disputes. However, its real-world effectiveness remains limited. Public awareness of the AO mechanism is extremely low. The orders passed by AOs are rarely accessible in any central database, making it hard for citizens, lawyers, and businesses to track precedents. The merger of CRAT with TDSAT, while administratively convenient, has raised concerns about whether a tribunal primarily focused on telecom disputes has the specialized cyber-law expertise needed to handle the growing volume and complexity of digital rights cases. Researchers have called for a dedicated bench within TDSAT for cyber matters, a central online repository of AO orders, and greater public outreach about the existence of this dispute resolution pathway.

What do you think? Given that awareness of the Adjudicating Officer mechanism is very low even among educated internet users, what practical steps should the government take to make this system more accessible and effective? And with cyber disputes growing rapidly in scale and complexity, does merging cyber appeals into a telecom tribunal seem like a sustainable long-term solution?

References

1. https://www.indiacode.nic.in/show-data?actid=AC_CEN_45_76_00001_200021_1517807324077&sectionId=13061&sectionno=46&orderno=52
2. https://indiankanoon.org/doc/1076139/
3. https://lawgist.in/information-technology-act/46
4. https://cis-india.org/internet-governance/blog/analysis-of-cases-filed-under-sec-48-it-act-for-adjudication-maharashtra
5. https://www.ikigailaw.com/article/261/dispute-resolution-framework-under-the-information-technology-act-2000
6. https://indiankanoon.org/doc/1414109/
7. https://www.naavi.org/cyber_appellate_tribunal.htm
8. https://www.cybertalkindia.com/composition-power-and-functions-of-cyber-appellate-tribunal/
9. https://bnwjournal.com/2021/01/12/role-of-the-appellate-tribunal-under-the-it-act/
10. https://tdsat.gov.in/admin/introduction/uploads/TDSAT%20INTRO.pdf
11. https://indiankanoon.org/doc/1616195/