Jacob Mathew v State of Punjab: negligence and liability

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Cyber law

A question that arrives before the courts in every serious data breach, payment failure and platform outage is the one Jacob Mathew v State of Punjab (2005) answered for professionals: when does carelessness become a crime? The Supreme Court held that mere negligence — a want of care, a lapse, a mistake — is not enough to attract criminal liability. For the conduct to be criminal, the negligence must be of so high a degree, a gross or reckless disregard of duty, that it can fairly be described as criminal. Simple negligence remains a civil wrong, remedied by damages, not by prosecution.

Read that rule into a cyber crime setting and it does real work. A bank that is slow to patch a system, an IT administrator who misconfigures a server, a company that mishandles the personal data it holds — these are failures of care, and the law's ordinary response to them is compensation under the Information Technology Act, 2000, not a criminal charge. A criminal case needs something more: dishonest or fraudulent intention, or negligence so gross that it crosses into recklessness.

What the case was about

The matter began with the death of a patient and a criminal charge of negligence against the doctor who had attended him. The proceedings asked the Supreme Court to decide whether the attending professional could be prosecuted on an allegation of ordinary want of care. The court examined the difference between the standard of care that a civil suit applies and the far higher threshold that a criminal charge demands, and it held that the two had been conflated.

The judgment also warned against the mechanical prosecution of professionals. It observed that a criminal charge is not the ordinary remedy for a lapse in professional judgment, and that a professional is not negligent merely because the outcome was bad. The reasoning was framed for doctors, but the court stated the principle in general terms, and it has since been applied to other professionals and to failures of duty that carry no element of dishonesty.

The threshold the court set

Negligence is not automatically a crime

The court distinguished between negligence as a civil wrong and negligence as an offence. In a civil suit, a want of reasonable care that causes loss is actionable, and the remedy is damages. In a criminal case, the same want of care is not enough. The prosecution must show the higher degree that the law describes as gross — conduct showing an indifference to the safety or rights of others, or a reckless disregard of the consequences, rather than an honest error.

The professional standard

The court also endorsed the principle, drawn from the well-known professional negligence standard, that a professional is not negligent if the course adopted is accepted as proper by a responsible body of professionals in the same field. In other words, the law does not judge a professional by hindsight after a bad outcome; it asks whether the conduct fell within a recognised and reasonable practice at the time.

To hold a professional criminally liable for negligence, the negligence must be of such a degree that it is gross, not a mere failure of the highest standards of care.

Prosecution was not to be routine

Finally, the court laid down safeguards before a professional could be prosecuted for negligence, including the need for an independent opinion on the allegation before the machinery of criminal law was set in motion. The point was not to shield wrongdoing but to insist that a criminal prosecution, with its power to arrest and its permanent effect on reputation, be a considered step and not an automatic one.

Why this matters far beyond medicine

Cyber crime law is full of conduct that looks negligent but carries no dishonesty. Data can be exposed because a password was weak, a server was unpatched, a backup was misconfigured, or a link was clicked by an employee who had been trained badly. A payment can fail because a gateway was not maintained. A platform can be late to take down a forged profile. Each of these is a failure of care. In each of them, the person who suffers wants someone held responsible — and the honest legal question is whether the responsibility is civil or criminal.

The answer, following Jacob Mathew, is that failure of care points first to the civil side. The Information Technology Act, 2000 gives the person affected a direct civil remedy: section 43 makes a person who, without permission, accesses, downloads, damages or disrupts a computer resource liable to pay compensation to the affected person, and section 43A makes a body corporate that holds sensitive personal data and fails to protect it liable to pay compensation for that failure. These are civil liabilities, enforced through the adjudicating machinery under the Act or a civil suit.

The sections that decide civil versus criminal

The Information Technology Act, 2000 draws the line by intention. Section 66 punishes computer-related offences only where the conduct is dishonest or fraudulent — the section does not reach a careless act. Section 66D punishes cheating by personation using a computer resource, again requiring deception. Section 66E, which punishes the intentional capturing and publishing of a private area of a person, turns on intention and consent, not on error. Section 72 punishes a person who has secured access to a document or information and then discloses it without consent — an act of deliberate disclosure, not a mishap. Where a person dies in an incident involving alleged negligence, the pre-2024 provision is section 304A of the Indian Penal Code, and for later conduct the corresponding provision in the Bharatiya Nyaya Sanhita, 2023 applies.

Section 79 sits on the other side of the line. It gives an intermediary a safe harbour from liability for third-party content where the conditions of the Act and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 are satisfied. The rules require due diligence, grievance redressal and timely action; a platform that meets them is not criminally liable for what its users post. A platform that fails them may lose the safe harbour, but losing it does not by itself convert negligence into an offence, and this is where litigants most often overstate their case.

What a victim of a data failure should do

1. Document the failure: preserve screenshots, notices, error messages and the dates on which you alerted the organisation.
2. Complain in writing to the organisation's data protection or grievance officer, and keep the acknowledgment.
3. If money was taken, report to the bank and to the 1930 helpline or cybercrime.gov.in within the shortest possible time.
4. Where the loss flows from a failure to protect data by a body corporate, consider a claim under section 43A of the IT Act, 2000, alongside any complaint of a dishonest act.
5. If the conduct shows knowledge and intention — someone inside the organisation who sold or leaked the data — frame the criminal complaint around that, not around the weak password.
6. Do not allow a genuine criminal case to be presented as a negligence case, or a genuine negligence case to be inflated into a criminal one, because a court will notice.

What decides the outcome

The mentally decisive question for a court is what the person knew and intended. Where the record shows an employee who knowingly sold data, copied files or bypassed controls, the criminal side is engaged. Where it shows only a lapse, a bad process or an honest mistake, the civil side is engaged. Degree matters too: even without dishonesty, negligence can become criminal if it is gross enough, and courts will examine how foreseeable the harm was, whether warnings were ignored, and whether the conduct showed a reckless disregard of others.

One area remains unsettled. The exact point at which a cyber failure crosses from civil to criminal negligence has not been mapped with precision, and courts have taken a case-by-case approach. A victim or a company facing an allegation should therefore treat the boundary as something to be argued on the facts, rather than assumed.

The duty to warn and the duty to act

When a court asks whether a failure was gross, it often asks what the organisation knew and when it knew it. A company that discovers a vulnerability, keeps it to itself and leaves customers exposed is in a very different position from one that discovers the same vulnerability and repairs it promptly. Warnings matter in the same way: a platform told repeatedly about a forged profile and doing nothing has ignored the signs, while a platform that acted within a reasonable time has not. For the person who has suffered the loss, the practical lesson is to keep a dated record of what you told the organisation and when, because that record is what can shift an honest lapse towards a reckless one.

Common mistakes

• Filing a criminal complaint for what is really a compensation claim, and losing credibility in the process.
• Ignoring the civil remedies under sections 43 and 43A of the IT Act, which are often faster and more certain than a prosecution.
• Assuming that a platform's failure to act makes it the offender; the intermediary rules and section 79 have to be addressed.
• Failing to preserve the internal record — logs, emails, tickets — that would show whether the failure was honest or deliberate.

Where a company is your adversary, the choice between a compensation claim and a criminal complaint is strategic, and it is often possible to pursue both in parallel. Our pages on civil litigation and the cyber crime lawyer in Kolkata set out the two routes, and the deeper reading is on our cyber crime blog.

When to involve a lawyer

If you have suffered loss from a data failure and are unsure whether it is a pay-out matter or a police matter, or if you or your company is facing a criminal complaint over what you believe was an honest lapse, the line drawn by Jacob Mathew is the argument that will decide the case. Counsel can assess the record, frame the claim on the right side of the civil and criminal divide, and resist an attempt to inflate negligence into an offence. To discuss a specific matter, reach the chambers through the contact page.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Ravinder Singh v State of Punjab: when is it cheating?
• State of Haryana v Bhajan Lal: quashing a cyber crime FIR
• Subramanian Swamy v Union of India: cyber defamation
• Shreya Singhal v Union of India: Impact on Cyber Law
• K.S. Puttaswamy v Union of India: privacy and cyber crime
• Arjun Panditrao Khotkar v Kailash Kushanrao Gorantyal

Cyber crime lawyer in your city · Bank account freeze help · Contact