Home  /  Information Technology Act  /  Section 16

Section 16: Security procedures and practices

Information Technology Act • Official Statutory Text & Practice Guide

Statutory Regulation
Legal Standard
Competent Court / Tribunal
Act 2000
Section 15 All 90 Sections of Information Technology Act Section 17

Legal Commentary & Landmark Judgments: Section 16

Section 16 empowers the Central Government to prescribe security procedures and practices for the purposes of Sections 14 and 15, having regard to commercial reasonableness, technological feasibility, transaction nature, and prevailing international standards.

  • Commercial Reasonableness Standard: Directs that prescribed security practices must balance robust cryptographic security with commercial practicality and transaction costs.
  • Statutory Rule-Making Authority: Empowers the Central Government to notify binding security rules for data encryption, key generation, access control, and incident logging.
  • Alignment with Global Cryptographic Standards: Requires administrative consideration of international standards (such as ISO/IEC 27001 and NIST guidelines) when formulating binding security procedures.
Key Landmark Precedents:
  • Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1: Nine-Judge Constitution Bench held that reasonable data security practices under Section 16 form part of the state's positive obligation to safeguard the fundamental right to informational privacy.
  • Shreya Singhal v. Union of India (2015) 5 SCC 1: Supreme Court affirmed that technical rules framed under the IT Act must be narrowly tailored, legally proportionate, and administratively clear.
  • Internet and Mobile Association of India v. RBI (2020) 10 SCC 274: Supreme Court evaluated technological security standards and proportional regulatory supervision over digital transaction ecosystems.
Courtroom Practice & Strategic Litigation Guidance:

Verify whether your client's data storage architecture adheres strictly to the Information Technology (Reasonable Security Practices and Procedures) Rules framed under Section 16; demonstrable compliance provides a complete defense against regulatory audit penalties.

Section 15 All 90 Sections of Information Technology Act Section 17