Definition
The unauthorised downloading, copying, extracting, or stealing of electronic data from a computer system — a civil wrong under Section 43(b) of the IT Act and a criminal offence under Section 66 when done dishonestly or fraudulently.
Data theft involves the unauthorised taking of electronic data — confidential customer databases, trade secrets, personal data, source code, financial records. Unlike physical theft (where the original is taken), data theft involves copying — the original remains but the thief now also has it. This creates unique legal challenges. IT Act Section 43(b) penalises 'downloading, copying or extracting any data, computer database or information.' When done dishonestly, Section 66 criminalises it. Additionally: Section 72 IT Act — breach of confidentiality and privacy by an official (person authorised to access data who discloses it without consent); and the Digital Personal Data Protection Act, 2023 — which creates obligations for data fiduciaries to protect personal data.
Statutory Definition
Section 43(b), Information Technology Act, 2000: 'If any person without permission of the owner or any other person who is in charge of a computer — (b) downloads, copies or extracts any data, computer database or information from such computer, computer system or computer network including information or data held or stored in any removable storage medium; he shall be liable to pay damages by way of compensation to the person so affected.' Section 66 IT Act: criminal liability when done dishonestly or fraudulently.
Etymology & Origin
From 'data' (from Latin 'datum' — thing given, plural 'data') + 'theft.' In legal usage, 'data theft' is the unauthorised taking (copying) of digital data — though since copying doesn't deprive the original owner of the data itself, it raises questions about whether traditional 'theft' law applies (hence the specific IT Act provisions).
Full Legal Analysis
Data Theft: The New Property Crime
Data is the new oil — and data theft is the new property crime. When a disgruntled employee copies the customer database before leaving, when a hacker exfiltrates trade secrets, when an insider leaks confidential data — these are data thefts that cause real, often severe, economic harm to organisations and individuals. India’s legal framework for data theft is evolving — from the IT Act’s foundational provisions to the Digital Personal Data Protection Act, 2023’s comprehensive personal data framework.
Insider Threats: The Most Common Source
A significant proportion of data theft in India comes from insiders — employees, contractors, or vendors with legitimate access who misuse that access. The legal response: (a) IT Act Section 43(b) — downloading/copying data without permission (even if the employee had access to the system, copying for personal use or competitive purposes is 'without permission' in the relevant sense); (b) IT Act Section 72 — breach of confidentiality by authorised persons (specifically covers insiders); (c) BNS breach of trust provisions — employees misusing their position of trust. Employment contracts should include specific data confidentiality clauses that supplement the legal framework.
DPDP Act, 2023: Personal Data Protection
The Digital Personal Data Protection Act (DPDPA), 2023 creates a specific framework for protecting personal data (information about identifiable individuals). Data fiduciaries (organisations that process personal data) must: (a) obtain free, specific, informed, and unambiguous consent before processing personal data; (b) implement appropriate technical and organisational measures to prevent data breaches; and (c) notify individuals and the Data Protection Board of significant data breaches. Failure can result in financial penalties up to Rs. 250 crore per breach.
“Data theft is a crime against information — arguably the most valuable resource in the digital economy. When a database of millions of customer records is stolen, the harm is not just to one person but to millions whose privacy is compromised, whose data is potentially misused, and who never know it happened until too late.”
This Term in Indian Statutes
Information Technology Act, 2000, 2000
"If any person without permission of the owner downloads, copies or extracts any data, computer database or information from such computer, computer system or computer network including information or data held or stored in any removable storage medium; he shall be liable to pay damages by way of compensation."
Data theft: Section 43(b) civil liability; Section 66 criminal when dishonest; Section 72 insider breach; DPDPA 2023 for personal data breaches
