IT Act 2000 vs BNS: What Changed for Cyber Offences

A detailed comparison of the IT Act 2000 and the Bharatiya Nyaya Sanhita, explaining exactly what changed for cyber offences, overlapping provisions, and which law applies when

  Legal Insights   Sep 8, 2026   19  Add to Reading List
Quick Answer: The IT Act 2000 was not replaced by the Bharatiya Nyaya Sanhita (BNS). The two now work together: the IT Act continues to govern technology-specific offences like hacking and data theft, while the BNS handles general offences such as cheating, defamation, and stalking when they are committed using digital means.

Why Compare the IT Act and the BNS?

When the Bharatiya Nyaya Sanhita (BNS) replaced the Indian Penal Code (IPC) on 1 July 2024, many people assumed it also replaced the Information Technology Act 2000, since both deal with crimes that increasingly happen online. That assumption is incorrect, and the confusion it creates can lead to wrongly drafted complaints or misunderstanding of which provisions actually apply to a given cyber offence. Axepron Legal's Legal Practice page gives a broader overview of how these frameworks fit together.

Two Different Laws, Two Different Jobs

The IT Act 2000 was purpose-built to regulate electronic commerce, digital signatures, and computer-related offences. It remains a specialized, technology-focused statute. The BNS, by contrast, is India's general criminal code, replacing the IPC's definitions of offences like theft, cheating, defamation, and criminal intimidation. The BNS was updated to explicitly recognize that many of these traditional offences are now committed using phones, apps, and the internet, but it does not attempt to regulate the technical aspects of computer systems the way the IT Act does.

A Brief History of the IT Act

India enacted the IT Act in 2000 primarily to give legal recognition to electronic contracts and digital signatures, at a time when internet usage in the country was still limited to a small urban population. The 2008 amendment expanded it significantly after incidents like the 2008 Mumbai attacks highlighted gaps in dealing with cyberterrorism, and it introduced several of the offence-specific sections, including 66A (later struck down by the Supreme Court for being unconstitutionally vague), 66C, 66D, and 66E, that are still in use today.

Why 66A Matters to This Comparison

Section 66A, which criminalized sending "offensive" messages through a computer resource, was struck down by the Supreme Court in the 2015 Shreya Singhal judgment for violating the constitutional right to free speech. This history is a useful reminder that not every provision added to deal with online conduct survives judicial scrutiny, and it is part of why the BNS drafters were more careful to frame its digital-era provisions around clearly defined conduct like stalking and impersonation rather than broad, subjective language like "offensive" content.

Governing Law / What Actually Changed

The core structure of the IT Act 2000, including Sections 43, 66, 66C, 66D, 66E, and 67, remains untouched by the arrival of the BNS. What changed is the general criminal law backdrop against which these sections operate, since the IPC references that investigators and courts previously relied on for related offences like cheating and criminal intimidation have now been replaced by their BNS equivalents.

New Recognition of Digital-Era Offences

The BNS explicitly acknowledges offences that the IPC handled awkwardly or not at all, such as organized cybercrime syndicates and crimes facilitated through electronic communication. It also modernizes definitions around identity fraud and impersonation in ways that dovetail more cleanly with the IT Act's existing digital-specific provisions, reducing the friction that previously existed when prosecutors had to stretch decades-old IPC language to fit online conduct.

Changes to Evidence Law

Alongside the BNS, the Bharatiya Sakshya Adhiniyam (BSA) replaced the Indian Evidence Act and expanded the definition of admissible electronic and digital evidence, including electronic records stored in cloud environments and communications sent through instant messaging platforms. This matters directly for cyber crime cases, since convictions frequently hinge on the admissibility of chat logs, emails, or transaction records, and the BSA's clearer framework reduces the scope for defense challenges based on outdated evidentiary rules.

AspectIT Act 2000BNS 2023
ScopeTechnology-specific offencesGeneral criminal offences, digitally updated
Hacking / Data TheftCovered (Sections 43, 66)Not separately defined
Online Cheating / FraudCovered (Section 66D, impersonation)Covered (general cheating provisions)
Cyberstalking / HarassmentNot directly definedCovered (stalking & intimidation provisions)
ReplacesN/A (still in force)Indian Penal Code, 1860

Which Law Applies to Which Offence

In practice, most cyber crime complaints today cite provisions from both statutes together, rather than relying on just one. This is because a single incident, such as an online scam, typically has both a technology-specific element and a general criminal element.

Example: An Online Investment Scam

If a fraudster creates a fake trading app and convinces victims to deposit money, the FIR would typically cite the BNS provisions on cheating and criminal breach of trust to address the deception itself, alongside IT Act Section 66D for cheating by impersonation using a computer resource, and possibly Section 66C if the scammer also stole or misused the victim's identity or banking credentials in the process.

Example: Hacking Without Fraud

If someone simply gains unauthorized access to a company's server without any element of cheating or impersonation involved, the case is likely to rely almost entirely on IT Act Sections 43 and 66, since the BNS does not independently define unauthorized computer access as an offence.

Example: Cyberstalking and Online Harassment

Where a person repeatedly monitors, contacts, or threatens someone online without any hacking or impersonation involved, the case typically relies on the BNS provisions dealing with stalking and criminal intimidation rather than the IT Act, since the conduct itself, not the technology, is what the law is targeting. Investigators may still reference the IT Act if the harasser gained access to private photos or data through unauthorized means as part of the harassment.

Practical Impact on Cyber Crime Cases

For victims, the change means little procedurally, since the National Cyber Crime Reporting Portal and local cyber cells continue to accept complaints exactly as before, applying whichever combination of IT Act and BNS provisions fits the facts. For legal practitioners and businesses, the practical impact is greater: contracts, compliance policies, and internal incident-response documents drafted before July 2024 that reference "IPC Section 420" or similar provisions for cheating should be updated to reference the corresponding BNS provisions to remain legally precise.

What This Means for Ongoing and Past Cases

Criminal law is generally not applied retrospectively, so cyber crime cases registered before 1 July 2024 continue to be tried under the IPC provisions that were in force when the offence was committed, even though the case may still be pending in court today. Only offences committed on or after that date are governed by the BNS, which means investigators and courts will need to work across both frameworks for a transitional period as older cases work their way through the system.

Terminology Shift: IPC Section Numbers to BNS Section Numbers

One of the more disruptive practical changes is that section numbers familiar to the public, such as IPC 420 for cheating or IPC 506 for criminal intimidation, no longer apply directly under the BNS, which renumbers most offences. This matters for cyber crime awareness content, terms of service documents, and even casual references people make when discussing a scam, since citing "Section 420" today refers to a different, unrelated provision in the BNS rather than the cheating offence people historically associate with that number. Anyone drafting legal notices, policy documents, or educational content should double-check the current BNS section number rather than relying on the old IPC reference from memory.

Advice for Businesses and Individuals

Businesses drafting terms of service, data breach response plans, or employee cyber security policies should reference both the IT Act and the relevant BNS sections where cheating, criminal intimidation, or stalking-type conduct is a risk, rather than assuming the IT Act alone covers every scenario. Individuals filing a complaint do not need to identify the exact sections themselves, since police and cyber cell officers are trained to apply the correct combination, but understanding the basic split helps in following up on a case and knowing what kind of evidence will matter most.

People Also Ask

Has the IT Act 2000 been repealed by the BNS?

No, the IT Act 2000 has not been repealed. It continues to operate alongside the BNS, with the IT Act covering technology-specific offences and the BNS covering general offences that happen to be committed using digital means.

Which law applies to online fraud, IT Act or BNS?

Online fraud is usually prosecuted under a combination of both: the BNS cheating provisions establish the fraud itself, while IT Act Section 66D applies specifically because impersonation was carried out using a computer resource.

Did the BNS remove any cyber crime provisions from the IT Act?

No, the BNS did not remove or amend the IT Act's core provisions. It added new context by defining electronic records and digital evidence more clearly and by updating references from the old IPC and Evidence Act to align with modern digital practices.

Is hacking covered under the BNS or the IT Act?

Hacking and unauthorized access remain governed primarily by the IT Act, specifically Sections 43 and 66, since these are technology-specific offences that the BNS does not separately define.

What replaced the Indian Penal Code for cyber-enabled crimes?

The Bharatiya Nyaya Sanhita replaced the Indian Penal Code from July 2024, and it now handles cyber-enabled versions of traditional offences like cheating, defamation, and criminal intimidation when committed through electronic means.

Do police need to choose only one law to file a case?

No, investigators commonly cite provisions from both the IT Act and the BNS in the same First Information Report when an offence involves both a technology-specific element and a general criminal element like cheating or harassment.

Why was a new criminal code needed if the IT Act already existed?

The IT Act was written in 2000 and amended in 2008, before smartphones, UPI payments, and social media were widespread. The BNS modernizes the general criminal law framework so that offences like cyberstalking and online cheating are explicitly recognized rather than being stretched to fit older IPC provisions.

Does the BNS apply to crimes committed before July 2024?

Generally, criminal law is not applied retrospectively, so offences committed before the BNS came into force on 1 July 2024 continue to be prosecuted under the Indian Penal Code provisions that were in effect at the time.