"Legal gaps in India's framework for addressing doxxing and online harassment"
Doxxing
malicious public exposure of private personal information to intimidate or harass a target
Safe harbour (Section 79 IT Act)
legal immunity shielding intermediaries from liability for user-generated content
The right to informational privacy — the ability of an individual to control how their personal data is collected, stored, and disseminated — was elevated to a fundamental right under Article 21 of the Constitution by the Supreme Court's nine-judge bench ruling in Justice K.S. Puttaswamy v. Union of India (2017). The Court held that privacy is intrinsic to life and liberty, and that the state must satisfy the triple test of legality, legitimate aim, and proportionality before encroaching upon it. This constitutional anchor is significant because it means that even non-state actors who systematically violate informational privacy may trigger state obligations to protect citizens.
The statutory architecture governing digital conduct in India has historically rested on the Information Technology Act, 2000 and its subsequent amendments, particularly the IT (Amendment) Act, 2008, which introduced provisions on cybercrime, data protection, and intermediary liability. The criminal law dimension was governed by the Indian Penal Code until it was replaced by the Bharatiya Nyaya Sanhita (BNS), 2023, which came into force alongside the Bharatiya Nagarik Suraksha Sanhita (BNSS), 2023. The IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 further layered platform-accountability obligations on top of this framework. Despite this layered architecture, India still lacks a standalone, comprehensive data-protection law that explicitly criminalises doxxing — the Digital Personal Data Protection Act, 2023 addresses data fiduciaries' obligations but does not directly penalise individual acts of malicious data exposure.
Doxxing — the deliberate public exposure of a private individual's personal information (phone numbers, home addresses, workplace details) to intimidate, shame, or incite harassment — sits at the intersection of privacy law, criminal law, and platform regulation. Because no single Indian statute explicitly defines or penalises doxxing as a standalone offence, victims must navigate a patchwork of provisions across multiple laws.
Under the Bharatiya Nyaya Sanhita, several sections become relevant depending on the downstream conduct that doxxing enables. Section 78 BNS (stalking) is attracted when the exposure of personal data leads to repeated monitoring of a woman's internet activity or persistent unwanted contact. Section 351 BNS (criminal intimidation) covers rape and death threats that typically follow doxxing campaigns. Section 79 BNS penalises acts intended to insult the modesty of a woman or intrude upon her privacy — applicable when humiliating photographs or videos are published. …
Under which of the following Articles of the Constitution of India, has the Supreme Court of India placed the Right to Privacy?
Under which Article of the Constitution of India is the 'Right to Privacy' protected?
Which of the following statements about a Zero First Information Report (Zero FIR) under the Bharatiya Nagarik Suraksha Sanhita (BNSS), 2023 is/are correct?
1.A Zero FIR can be lodged at any police station, even though the place of commission of a cognizable/non-cognizable offence is outside the territorial jurisdiction of that police station.
2.The Officer-in-Charge of the police station where a Zero FIR has been lodged may, with the permission of the competent authority, initiate a preliminary enquiry.
3.Under Zero FIR, it is obligatory for the informant to furnish information electronically.
Select the answer using the code given below:
With reference to the Information Technology Act, 2000, consider the following statements:
1.Section 66E criminalises the capturing or publishing of images of private body parts without consent.
2.Section 72A provides for imprisonment of up to three years as the primary penalty for unauthorised disclosure of personal information.
3.Section 79 grants intermediaries immunity from liability for user-generated content, subject to compliance with due diligence requirements.
Which of the statements given above is/are correct?
Under the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, what is the prescribed timeline for significant social media intermediaries to resolve complaints falling under severe categories such as privacy invasion or gender-based harassment?
Which of the following best describes the consequence for a social media platform that fails to comply with the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021?
Assertion (A): The act of doxxing — publicly revealing a private individual's personal data such as phone number and home address — is not a standalone criminal offence under Indian law.
Reason (R): Section 72A of the Information Technology Act, 2000 penalises unauthorised disclosure of personal information primarily through a civil financial penalty rather than criminal prosecution.
Which of the following is correct?
Want the full note, Prelims Facts & MCQ answers?
Create a free account — takes less than a minute.
Create free account