India. Sectoral privacy. Act
IT Act s43A/72AInformation Technology Act, 2000 - sections 43A and 72A
Partly verified
Medium confidence.Original IT Act dates and s72A penalty from general knowledge, not re-verified this session; s43A omission confirmed from DPDP Act s44(2) text. IT Act s1(2) extends to offences outside India involving Indian computer systems (s75).
§1Summary
- Synopsis
Section 43A makes a body corporate handling sensitive personal data liable to pay compensation if negligent security causes wrongful loss or gain. Section 72A criminalises disclosure of personal information obtained under a lawful contract, without consent and with intent to cause wrongful loss or gain.
- Key themes
- Unique features
Interim, negligence-based privacy regime limited to 'sensitive personal data or information'; s72A survives the DPDP Act while s43A is repealed when DPDP's core provisions start.
- SaaS relevance
Until 13 May 2027 any SaaS body corporate handling SPDI of Indian users must maintain reasonable security practices (e.g. ISO 27001) to avoid s43A compensation claims; s72A criminal exposure for unauthorised disclosure continues.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- None under these sections (see CERT-In Directions)
- DPO
- No
- Cross-border transfers
- See SPDI Rules 2011
- Maximum penalty
- s43A: uncapped compensation; s72A: up to 3 years' imprisonment and/or fine up to INR 5 lakh
§3Dates
- Key dates
- Adopted
- In force
- Sections 43A and 72A inserted by IT (Amendment) Act 2008 (in force 2009-10-27). DPDP Act s44(2) omits s43A (and rule-making clause s87(2)(ob)) with effect from 2027-05-13.
§4Text and authority
- Text
- Authoritative text indiacode.nic.in
- Authority
- Adjudicating officers under IT Act / courts; MeitY
§5Where it applies
- Domestic law of
- India
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Original IT Act dates and s72A penalty from general knowledge, not re-verified this session; s43A omission confirmed from DPDP Act s44(2) text. IT Act s1(2) extends to offences outside India involving Indian computer systems (s75).