What cyber law gives e-commerce
Cyber law in e-commerce begins with a basic protection: an online contract is valid. Section 10A of the Information Technology Act 2000 provides that a contract formed by electronic communication of proposals, acceptances and revocations is not unenforceable solely because it was formed electronically. Sections 4 and 5 give electronic records and electronic signatures the standing of writing and of a handwritten signature where a law requires either. Together they let a seller and a buyer rely on an exchange of electronic messages.
The Act also protects those who keep the platform running. Section 79 exempts an intermediary from liability for third party information that it makes available or hosts, on conditions that include due diligence and prompt action after actual knowledge or a notification from the appropriate Government or its agency. And it provides offences for the fraud that e-commerce attracts: section 66C on identity theft and section 66D on cheating by personation, each with imprisonment up to three years and a fine up to Rs 1 lakh.
Customer data
E-commerce runs on personal data, and the law on it has changed. Section 43A of the Act gave compensation against a body corporate that was negligent in protecting sensitive personal data. The Digital Personal Data Protection Act 2023 now sets the framework: it requires consent that is free, specific, informed, unconditional and unambiguous, a notice before the request for consent, security safeguards, notice of breaches, and erasure when consent is withdrawn or the purpose is served, with penalties up to Rs 250 crore. The guide to the DPDP Act 2023 explains each of these duties for a business that handles customer data.
The other side: limits and difficulties
The limits are as important as the protections. The Act does not apply to the documents and transactions listed in the First Schedule, so a contract for the sale of immovable property cannot be concluded electronically under it. Enforcement is hard because online conduct crosses borders: section 75 applies the Act to an offence or contravention committed outside India if the conduct involves a computer, computer system or computer network located in India, but evidence and offenders may be abroad.
There is also the matter of pace. Section 66A was held unconstitutional in 2015, the appellate tribunal changed in 2017, the criminal and evidence statutes were replaced in 2024, and the data protection framework changed in 2023 and 2025. A business that built its practice on older guidance may find that it no longer applies.
What a business can do
A business that sells online should keep records of its electronic contracts and communications, protect customer data, and know where to report fraud. The page on online fraud in India describes the common forms of fraud that target sellers and buyers, and the guide on how to file a cyber crime complaint online sets out the steps for a report. The advantages that the Act offers are described in the page on the advantages of cyber laws.