1. Introduction:

An information system may contain private communications, personal records, business information and other protected data. A person who enters such a system without permission can compromise its security even if they do not alter, copy or destroy anything. The Prevention of Electronic Crimes Act, 2016 (PECA) addresses this conduct through the offence of unauthorized access.

2. Meaning of Unauthorized Access:

Under section 2(xxxi) of PECA, “unauthorized access” means access to an information system or data that is not available to the general public, where the access is obtained without authorization or in violation of the conditions of an authorization. Thus, access may be unauthorized because the person had no permission at all, or because they exceeded the permission they had been given. For example, a person who deliberately enters another person’s private email account without permission may gain unauthorized access, even if they do not delete messages or change the account settings.

3. Relevant Provision: Section 3

Section 3 of PECA provides that whoever, with dishonest intention, gains unauthorized access to any information system or data commits an offence. The prescribed punishment is imprisonment for up to three months, a fine of up to fifty thousand rupees, or both.

Unauthorized access to information system or data.— Whoever with dishonest intention gains unauthorized access to any information system or data shall be punished with imprisonment for a term which may extend to three months or with fine which may extend to fifty thousand rupees or with both.

4. Essential Ingredients:

To establish the offence under section 3:

i. Access must actually be gained:

The prosecution must establish that the accused gained access to an information system or data. The statutory wording is not simply about having the intention to enter or making an unsuccessful attempt: section 3 refers to a person who “gains” access. Access may, depending on the facts, involve entering a protected account, database or system. The manner of entry may include using another person’s credentials or bypassing a technical restriction. Those examples do not automatically prove the offence; the prosecution must still establish the statutory elements.

ii. The access must be unauthorized:

The prosecution must show that the accused lacked authorization or acted beyond the scope of the authorization granted. Authorization may arise by law or from a person empowered by law to grant it. Publicly available information is treated differently from private or restricted information. A person who has permission to use a system for a defined purpose does not necessarily have permission to access every account, file or database connected to it. Whether access exceeded the permission granted depends on the terms and limits of that permission.

iii. The accused must have acted with dishonest intention:

Dishonest intention is an express requirement of section 3. Unauthorized access alone does not complete the statutory case: the prosecution must also establish the required intention. The definition in section 2 connects that intention with matters such as injury, wrongful gain, wrongful loss or harm. Intention is usually assessed from the circumstances. For example, the method used to obtain access, the use of another person’s credentials, efforts to conceal the activity and the surrounding conduct may be relevant. But an allegation of access, without proof of the required dishonest intention, does not by itself satisfy the wording of section 3

5. Why Actual Damage Is Not Required:

i. Section 3 focuses on the intrusion itself:

Section 3 is framed around gaining unauthorized access with dishonest intention. It does not say that the accused must also damage the system, destroy data, interrupt a service or cause financial loss. Actual damage is therefore not an ingredient of this offence. The legal wrong lies in deliberately crossing a protected boundary of access. Once that unauthorized, dishonest access is gained, the conduct falls within the kind of intrusion section 3 addresses even if the intruder stops before changing or destroying anything.

ii. Unauthorized access can threaten confidentiality and security:

Damage is not the only way a system can be harmed. An intruder may view sensitive data, expose private communications, learn how a system is protected or create an opportunity for later misuse without leaving visible damage behind. A system may appear to function normally while its confidentiality or security has already been compromised. Making prosecution depend on proof of a measurable loss would leave a gap where an intruder obtained access but the owner could not show that any data had been altered, disclosed or destroyed. Section 3 addresses the unauthorized access itself, while other provisions deal with particular conduct that may follow.

iii. The provision allows intervention before further harm occurs:

The offence operates at an earlier stage than conduct that involves copying, transmitting or interfering with data. That structure enables the law to address a deliberate intrusion before it develops into a more serious breach. It does not mean that liability is automatic whenever a person uses a system: the prosecution must still prove both unauthorized access and dishonest intention.

6. Distinction from Related Offences

PECA treats access and subsequent conduct as distinct matters.

• Section 3 concerns gaining unauthorized access to an information system or data with dishonest intention.
• Section 4 concerns unauthorized copying or transmission of data with dishonest intention.
• Section 5 concerns interference with or damage to an information system or data with dishonest intention.

Therefore, to establish an offence under section 3, the prosecution need not to prove that the accused copied data, interfered with the system, or caused damage. The offence focuses on the dishonest, unauthorized access itself.

7. Illustration:

A person deliberately uses another person’s password, without permission, to enter a private email account and read confidential messages, intending to obtain information for wrongful gain. The person does not copy, delete, or alter anything. The example shows that unauthorized access may fall under section 3 even though no actual damage is caused.

8. Comment:

Section 3 adopts a preventive approach to cybercrime by treating unauthorized access as an inchoate offence. An unauthorized user can compromise the confidentiality and security of a system simply by entering it and viewing restricted data; thus, the legal injury occurs even where no file is altered, and no financial loss is suffered. Requiring proof of tangible damage would leave dangerous initial intrusions outside the scope of criminal liability until they produced a more severe consequence. At the same time, Section 3 does not criminalize accidental or automated access. The statutory text expressly requires intentional conduct, and the Act defines unauthorized access strictly by reference to access without authorization or in excess of permitted terms. These combined elements successfully limit the offence to conduct that purposefully crosses a protected digital boundary.

9. Conclusion:

Section 3 criminalizes the deliberate, unauthorized entry into an information system or data, even when no actual damage follows. The absence of a damage requirement reflects the law’s concern with the intrusion itself; the requirement of dishonest intention distinguishes that offence from accidental access. Thus, damage need not be proved, but dishonest intention must be established.