Is Ethical Hacking Legal in India? The IT Act Explained
Every beginner who opens a hacking tutorial in India eventually asks the same question: can I go to jail for this? The short answer is that ethical hacking with permission is legal in India, and hacking without permission is a serious crime. The long answer involves the IT Act, what counts as authorization, and a few well-known examples of students who crossed the line without realizing it. This guide breaks it down so you know exactly where the boundary sits.
The law that matters: Section 66 of the IT Act
India's primary computer crime law is the Information Technology Act, 2000. Section 66 is the one everyone talks about. It says that if you do anything covered by Section 43 (which lists unauthorized activities like accessing a computer without permission, downloading data without permission, or introducing malware), you can be punished with imprisonment of up to three years, a fine, or both.
Section 66 is not a separate, mysterious hacking law. It is essentially a punishment clause that points back to the unauthorized actions listed in Section 43. The key word in both sections is "unauthorized" or "without permission". That single word is the entire difference between a professional and a criminal.
What counts as unauthorized access
Under Section 43, the following count as offences:
- Accessing a computer or network without permission, even if you do not steal anything.
- Downloading, copying, or extracting data without permission.
- Introducing viruses, trojans, or any code that damages or alters systems.
- Disrupting networks or degrading services.
- Denying legitimate users access to their own systems.
- Stealing, misusing, or concealing someone's computer source code.
Notice that "just looking around" is not a defence. Logging into a system you do not own, without written permission, is unauthorized access even if you take nothing and change nothing. This is the trap that catches many curious students.
So when is hacking legal in India?
It is legal when you have proper authorization. That happens in three standard ways:
- You work for an employer who hired you to test systems. Your job contract and scope of work are the permission.
- You test on platforms built for that purpose. Bug bounty platforms like HackerOne and Bugcrowd run programs where companies explicitly invite researchers to test defined assets. Testing within the program's scope is authorized.
- You practice on your own systems or lab environments. Your own laptop, virtual machines, deliberately vulnerable applications, or training platforms like TryHackMe and Hack The Box exist precisely for this.
In all three cases, there is a clear, documented permission. That documentation is what separates you from Section 66. If you cannot point to written authorization for what you are testing, you are in risky territory.
Bug bounty in India: legal, with scope rules
Bug bounty programs are legal in India, and several Indian companies run them, including many banks and fintechs. But the scope matters more than people realize. When a program says "test *.example.com", it means exactly that domain and nothing else. Testing the company's other domains, their employees' accounts, or their third-party vendors without permission is out of scope, and out-of-scope testing is unauthorized access.
Read the program rules before you test. If the rules say no automated scanning, or no testing of payment flows, follow them. Programs have rejected researchers and even reported them to authorities for violating scope. The report that gets you a bounty is also the same report that gets you in trouble if it came from testing outside the rules.
What about hacking into a friend's account "as a joke"?
It is still illegal. Consent from the victim does not automatically make unauthorized access lawful, and in practice, friends who discover their accounts were accessed often file complaints later, especially if the relationship sours. There are real Indian cases where what started as a prank led to a criminal case. Treat your friend's account the same way you would treat a stranger's: hands off unless they have given you written permission to test it.
Real examples of the line being crossed
Indian news regularly covers cases that illustrate the boundary. Students who hacked their university's result portal to change grades were prosecuted under the IT Act, even when their intention was only to fix their own marks. A developer who accessed a telecom company's customer database using leaked credentials was arrested, not rewarded. People who ran phishing pages to harvest OTPs ended up in cyber crime cases with financial fraud charges on top. In every one of these, the common thread is a lack of authorization.
How to build a career without touching the line
The safe path exists and it is well-trodden:
- Practice on lawful platforms: TryHackMe, PortSwigger Web Security Academy, Hack The Box, and your own home lab.
- Join bug bounty programs and stay strictly inside scope.
- Document everything, and keep written permission before touching any system you do not own.
- Learn the reporting side, because a well-written report is worth more than a flashy exploit.
For the full roadmap, our guide on becoming an ethical hacker in India walks through skills, certifications, and realistic pay. And if you are weighing this as a career, our honest career assessment tells you what to expect.
The bottom line
Ethical hacking is legal in India when you have clear authorization, and a serious crime when you do not. Section 66 of the IT Act punishes unauthorized access with up to three years in prison, and "I was just testing" is not a defence. Stay on authorized platforms, stay inside bug bounty scope, and keep permission in writing. Do that, and the law is firmly on your side while you learn, earn, and build a career.
One attack you should understand even if you never test anything: SIM swap fraud, which targets regular people through carrier vulnerabilities.