Doxxing in India — Legal Remedies When Your Personal Information Is Leaked Online

One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.

Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.

Rohan Gupta, a software professional based in Nagpur, was an active participant in several online discussion communities on social media platforms. Around 18 March 2025, a dispute within one of those communities escalated sharply. A group of users, evidently coordinated, decided to expose his full name, home address in the Dharampeth locality, phone number, and workplace details across multiple large forums. Within days, Rohan was receiving threatening calls and abusive messages at all hours.

He initially approached a general criminal lawyer in Nagpur, who filed a basic police complaint. It went nowhere. The complaint was not taken forward with urgency, and the harassment continued. Frustrated, Rohan reached out to Advocate Sudhir Rao. A detailed strategy was immediately prepared — identifying the applicable offences under the Bharatiya Nyaya Sanhita and the Information Technology Act, 2000, framing the complaint with precise electronic evidence, and pressing for a cybercrime FIR. The police response changed notably once the complaint was properly structured with screenshots, call logs, and platform-specific data requests.

By early April 2025, an FIR had been registered and the cybercrime cell was actively investigating. The threatening calls stopped within two weeks of formal action. Rohan's experience shows that doxxing is a serious cognizable offence in India, and that a structured, domain-aware legal approach makes a material difference to both the speed and effectiveness of the response.

Advice in Such Cases

Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation to come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

Preserve all evidence immediately: Take screenshots of every post, message, and platform where your personal information was shared. Don't wait. Platforms remove content after reports, and once it's gone, reconstructing it becomes genuinely difficult. Save URLs, timestamps, and usernames of the people responsible.

Report to the cybercrime portal: File a complaint on cybercrime.gov.in right away. This creates a formal digital record and triggers the cybercrime cell in your city. It's not a substitute for an FIR, but it supports one.

Do not engage the harassers: Responding publicly or privately to the people doxxing you only gives them more material to misuse. Let your advocate handle all communication strategy. Frankly, silence from your end is often the smartest move at this stage.

Doxxing and online harassment cases involve specific procedural steps under the IT Act and BNS that a general practitioner may not be fully familiar with — from drafting preservation requests to platforms, to citing the correct BNS and IT Act sections in an FIR application. Engaging an advocate who regularly handles cybercrime matters typically leads to faster registration of the FIR and more effective investigation.

Applicable Sections of Law

Doxxing in India is addressed across two primary statutes. Under the Bharatiya Nyaya Sanhita, 2023 (BNS):

• Section 351 BNS — Criminal intimidation: threats communicated with intent to cause alarm are punishable, covering threatening calls and messages received post-doxxing.
• Section 79 BNS — Stalking, including monitoring a person's activities online or in person with intent to harass.
• Section 356 BNS — Defamation, where false personal information is published intentionally to harm reputation.

Under the Information Technology Act, 2000:

• Section 66C IT Act — Identity theft through electronic means.
• Section 66E IT Act — Publishing private information without consent, which directly covers doxxing of personal addresses and contact details.
• Section 67 IT Act — Publishing obscene or harmful material electronically.

And here's the thing — most victims don't realise how many of these provisions overlap. A single doxxing incident can attract three or four sections simultaneously, which actually strengthens the FIR considerably.

Punishment and Penalties

• Section 351 BNS (Criminal Intimidation): Imprisonment up to two years, or fine, or both. If the threat is of death or grievous hurt, imprisonment may extend to seven years.
• Section 79 BNS (Stalking): First conviction — imprisonment up to three years and fine. Second conviction — imprisonment up to five years and fine.
• Section 66E IT Act (Privacy violation): Imprisonment up to three years and/or fine up to Rs. 2 lakh.
• Section 66C IT Act (Identity theft): Imprisonment up to three years and fine up to Rs. 1 lakh.
• Offences under Section 66E and Section 66C of the IT Act are cognizable and non-bailable. Section 351 BNS (without aggravated threat) is bailable and cognizable.

Jurisdiction — Where to File the Case

For doxxing, you can file an FIR at the cybercrime police station in your city — most major cities now have a dedicated cybercrime cell under the state police. Alternatively, file at the local police station with territorial jurisdiction over your residence, since the harm (threatening calls, harassment) was received there. As held in Shreya Singhal v. Union of India, 2015, online speech causing harm falls within the jurisdiction where the effect is felt. For private complaints, the jurisdictional Judicial Magistrate First Class covers matters under Section 351 BNS. Getting jurisdiction right from the outset prevents delays caused by transfers or objections later.

What if Police Refuse to File FIR?

This does happen in cybercrime cases, particularly when officers at a local station are unfamiliar with IT Act offences. Here's what you can do:

• Submit a written complaint to the Superintendent of Police (SP) or Commissioner of Police under Section 173(4) BNSS, requesting directions for FIR registration.
• File a private complaint directly before the Judicial Magistrate First Class under Section 175(3) BNSS — the Magistrate can direct the police to investigate.
• File a complaint on the National Cybercrime Reporting Portal (cybercrime.gov.in), which routes to the state cybercrime cell and creates accountability.
• As a last resort, approach the High Court under Article 226 of the Constitution for a writ of mandamus directing the police to register the FIR — a remedy confirmed in Lalita Kumari v. Government of UP, 2014, where the Supreme Court held that registration of FIR is mandatory for cognizable offences.

Now, before you act, understand that a well-drafted written complaint — one that names the sections, attaches screenshots, and cites Lalita Kumari v. Government of UP, 2014 — often shakes the station out of inertia without needing to go up to the SP at all.

Rights of the Accused

If any person is accused in connection with this matter, their rights under law include:

• Right against self-incrimination under Article 20(3) of the Constitution — no person can be compelled to be a witness against themselves.
• Right to legal representation under Article 22 — every arrested person has the right to consult an advocate of their choice.
• Right to be produced before a Magistrate within 24 hours of arrest, as mandated under Article 22(2) and Section 57 BNSS.
• Right to a copy of the FIR and to be informed of the grounds of arrest under Section 47 BNSS.
• Right to bail in bailable matters as a matter of right, and to apply for bail in non-bailable matters before the Magistrate or Sessions Court.

Bail Provisions

Offences under Section 66E IT Act are non-bailable. The accused must apply for regular bail under Section 480 BNSS before the Magistrate or under Section 483 BNSS before the Sessions Court. If an arrest is anticipated, an application for anticipatory bail under Section 482 BNSS before the Sessions Court or High Court is the appropriate route. Bail conditions typically include surrendering the passport, not contacting the complainant, and cooperating with the investigation. For offences under Section 351 BNS (bailable), bail is available as a matter of right at the police station itself. Courts in cybercrime cases do look at the volume and severity of the digital conduct before deciding bail conditions — and in doxxing matters where harassment was sustained and documented, courts don't treat it lightly.

Quashing of FIR / Case

An accused may approach the High Court under Section 528 BNSS (which replaces Section 482 CrPC) to seek quashing of the FIR. Grounds typically include absence of a cognizable offence on the face of the complaint, abuse of the legal process, or a genuine settlement between the parties. As the Supreme Court held in State of Haryana v. Bhajan Lal, 1992, quashing is appropriate where the allegations do not disclose any offence or are inherently improbable. In doxxing cases where the harm is well-documented, quashing petitions by accused persons tend to face a high threshold. Courts are generally reluctant to quash where clear digital evidence of harassment exists. Make no mistake — a folder full of timestamped screenshots makes the accused's quashing petition an uphill task from day one.

If You Are the Victim

• Document everything before reporting — screenshots with visible URLs and timestamps are critical. Use a screen recording tool if needed.
• File a complaint on cybercrime.gov.in and note the complaint number for future reference.
• Contact your telecom provider (such as Airtel or BSNL) to report harassing numbers and request call records for the period in question.
• Approach the platforms (Instagram, Reddit, Telegram, or whichever platforms are involved) with formal takedown requests, citing violation of their community standards and your legal rights under Section 66E IT Act.
• Engage an advocate promptly to supervise the FIR process — don't rely solely on a verbal complaint at a local police station for matters this complex.

Documents You Must Keep Ready

• Aadhaar card and PAN card as identity proof
• Screenshots of posts, threads, or messages where personal information was disclosed
• URLs of the pages or profiles involved (saved as PDFs or archived using archive.org)
• Call logs showing threatening or harassing calls received
• Records of any messages or emails received from harassers
• Proof of your residential address (utility bill, rental agreement) to establish where harm was received
• Any prior communications showing the dispute that triggered the doxxing
• Complaint acknowledgement from cybercrime.gov.in or police station

What Evidence Is Required?

• Screenshots with metadata: Images showing the posts with visible timestamps, platform names, and usernames of those who posted.
• Call logs: Records from your mobile service provider showing incoming calls from identified or unknown numbers during the harassment period.
• Platform data: Requests can be made to platforms for account-holder information under Section 91 BNSS through the investigating officer.
• Witness statements: Friends, family, or colleagues who also received or saw the doxxed content can provide supporting affidavits.
• Internet Service Provider (ISP) logs: IP address records traceable to the accused — obtainable through a court-directed preservation request.
• Expert report: A certified cyber forensic expert's report can authenticate the electronic evidence for admissibility under the Information Technology Act and the Bharatiya Sakshya Adhiniyam, 2023.

How the Police Behave in Such Cases

Cybercrime cells in larger cities like Bengaluru, Pune, and Hyderabad are generally more equipped to handle doxxing complaints, but at local police stations, officers may initially downplay the matter or suggest it's a "social media issue." Don't accept that. Make no mistake — doxxing involving threatening calls is a cognizable offence and FIR registration is mandatory per Lalita Kumari v. Government of UP, 2014. Persistence, a properly drafted written complaint, and an advocate's involvement tend to shift police responsiveness significantly. Investigators will typically seek platform data and call records once the FIR is registered.

Timeline of Legal Process

• Week 1-2: File cybercrime complaint online and at the police station; collect and preserve all digital evidence.
• Week 2-4: FIR registration (or SP/Magistrate intervention if initially refused); cybercrime cell takes over investigation.
• Month 1-3: Police issue notices to platforms for data; examine call records; identify accused persons.
• Month 3-6: Arrests or summoning of accused; chargesheet filed before Magistrate within 60 days of arrest (Section 193 BNSS).
• Month 6-12: Cognizance by Magistrate; framing of charges.
• Year 1-3: Trial proceedings — evidence, cross-