Is Ethical Hacking Legal in India? What the Law Says

Ethical hacking is a legal, recognized profession in India. The same actions done without permission are a crime. The difference is not your intention, your certificate or your tools. It is written authorization from the owner of the system. This guide explains what the law says, what that authorization must cover and where beginners get into trouble. It is general information, not legal advice.

The Short Answer

Testing a computer system is legal when its owner has authorized you in writing and you stay within what they authorized. Testing anything else, even "just to check", can be an offense under the Information Technology Act, 2000. There is no license or registration you need to become an ethical hacker in India, but there is also no certificate that makes unauthorized testing legal. The labels white hat, black hat and gray hat are explained in types of hackers.

What the IT Act Says

• Section 43 covers accessing a computer or network without the owner's permission, copying data from it, damaging it or disrupting it. The person responsible can be ordered to pay compensation.
• Section 66 makes the same acts a criminal offense when they are done dishonestly or fraudulently, with imprisonment of up to three years, a fine of up to ₹5 lakh, or both.
• Sections 66C and 66D cover identity theft and cheating by impersonation, for example using someone else's password or building a fake login page.
• Section 70 protects systems the government has notified as protected, such as some banking, power and telecom systems. Unauthorized access to them carries imprisonment of up to ten years.

Courts look at what you did and whether you had permission. "I was only learning" is not a defense.

What Written Authorization Must Cover

Professional testers never start without a signed document, often called the rules of engagement or a statement of work. It should state:

• Who owns the systems and who is authorizing the test (they must have the right to authorize it)
• Exactly which systems, IP ranges, applications and accounts are in scope, and which are not
• The dates and times of testing
• What is allowed: for example, whether password attacks, phishing or denial-of-service tests are permitted
• How data you see will be handled, stored and deleted
• Who to call if something breaks or you find evidence of a real attack

Bug Bounty Programs

Many companies publish a bug bounty or vulnerability disclosure program that invites anyone to test certain systems under stated rules. That published policy is your authorization, but only for the assets and methods it lists. Read the scope and the rules before you start, and stop at proof: do not download customer data or keep access. Our bug bounty guide for beginners explains how to start safely, and IDOR explained covers the flaw beginners most often report.

Where Beginners Get into Trouble

• Scanning a college, employer or neighbor's network to "show them a problem"
• Trying a login form on a live website with a list of common passwords
• Using a found password or session token, even once, to "confirm" it works
• Sharing screenshots of someone else's data on social media as proof
• Following a video tutorial against a real website instead of a practice lab

If you find a weakness by accident, do not explore further. Report it through the organization's security contact or disclosure page, or to CERT-In, and keep your report factual.

CERT-in and the DPDP Act

CERT-In, the national computer emergency response team, is the agency organizations report cyber incidents to. Its 2022 directions require organizations to report specified incidents within six hours of noticing them. CERT-In also empanels security auditing organizations to audit government systems. The Digital Personal Data Protection Act, 2023, with rules notified in 2025 and coming into force in phases, sets duties for organizations that handle personal data. For a tester, both mean the same thing: treat any personal data you see as confidential, and handle it exactly as the contract says.