(1) Where a person committing a contravention of any of the provisions of this Act or of any rule, direction or order made thereunder is a company, every person who, at the time the contravention was committed, was in charge of, and was responsible to, the company for the conduct of business of the company as well as the company, shall be guilty of the contravention and shall be liable to be proceeded against and punished accordingly:
Provided that nothing contained in this sub-section shall render any such person liable to punishment if he proves that the contravention took place without his knowledge or that he exercised all due diligence to prevent such contravention.
(2) Notwithstanding anything contained in sub-section (1), where a contravention of any of the provisions of this Act or of any rule, direction or order made thereunder has been committed by a company and it is proved that the contravention has taken place with the consent or connivance of, or is attributable to any neglect on the part of, any director, manager, secretary or other officer of the company, such director, manager, secretary or other officer shall also be deemed to be guilty of the contravention and shall be liable to be proceeded against and punished accordingly.
Legal Commentary & Landmark Judgments: Section 85
Section 85 establishes the statutory framework for corporate criminal and civil liability under the Information Technology Act, enacting that where a contravention is committed by a company, the company as well as every person in charge of and responsible for the conduct of its business shall be deemed guilty, subject to a due diligence defense.
In cyber prosecutions against corporate management for corporate data breaches or intermediary defaults, verify whether the company itself has been arraigned as an accused; failure to implead the corporate entity is a fatal defect warranting quashing under Section 482 CrPC.