Section 43A IT Act: Compensation for Negligent Handling of Sensitive Personal Data

Section 43A of the Information Technology Act, 2000 makes a body corporate pay compensation when it holds sensitive personal data, is negligent in implementing and maintaining reasonable security practices, and that negligence causes wrongful loss or wrongful gain to any person. Claims up to ₹5 crore go to the Adjudicating Officer under s.46; larger claims go to a civil court. Section 43A stays in force until 13 May 2027, when s.44(2) of the Digital Personal Data Protection Act, 2023 omits it and the DPDP regime, with penalties up to ₹250 crore, takes over.

What Section 43A actually requires

Read the section as four ingredients. All four must be present for a claim to succeed:

1. A body corporate. The section uses a wide definition: any company, and also a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities. A private college run by a trust or society, a private hospital, a diagnostic lab and a coaching institute are usually within it. Whether a particular government body is covered depends on its structure, so a government department should not assume it is either in or out.
2. Sensitive personal data or information that it possesses, deals with or handles in a computer resource it owns, controls or operates.
3. Negligence in implementing and maintaining reasonable security practices and procedures.
4. Wrongful loss or wrongful gain to any person as a result.

No hacker, crime or intention need be proved. A spreadsheet open to “anyone with the link” can be enough.

What counts as sensitive personal data

Rule 3 of the SPDI Rules, 2011 lists the categories. Sensitive personal data means personal information relating to:

• passwords;
• financial information such as bank account, credit card, debit card or other payment instrument details;
• physical, physiological and mental health condition;
• sexual orientation;
• medical records and history;
• biometric information;
• any of the above given to the body corporate for providing a service, or received by it for processing under a lawful contract.

Information freely available in the public domain, or furnished under the RTI Act or any other law, is excluded. For an institution, think health records, bank and fee payment details, biometric attendance data and passwords.

What “reasonable security practices” means

The Explanation to s.43A says reasonable security practices are those agreed between the parties, or specified by law, or, failing both, prescribed by the Central Government. Rule 8 of the SPDI Rules fills this in:

• A body corporate complies if it has a documented information security programme with managerial, technical, operational and physical controls proportionate to the information it protects.
• The international standard IS/ISO/IEC 27001 is named as one such standard.
• Bodies that follow IS/ISO/IEC 27001 or an approved code are deemed compliant if they are audited at least once a year, or when they significantly upgrade processes and computer resources, by an independent auditor approved by the Central Government.

The other Rules require a privacy policy on the website (Rule 4), written consent before collecting sensitive data (Rule 5) and prior permission before disclosing it to a third party, save for lawful government requests (Rule 6). An institution with none of these will find “negligence” hard to deny.

Practical exposure: three institutions

A private nursing college in Indore. The admission cell emails a sheet of 400 applicants’ Aadhaar-linked bank details and medical fitness certificates to the wrong mailing list. Applicants receive fraud calls the following week. Health data and financial data are both sensitive. The question will be: what practice stopped one clerk sending that file outside?

A multi-speciality hospital in Lucknow. Its lab-report portal lets anyone change the number at the end of the report link and see another patient’s report. That is medical records exposed through a basic design flaw. A patient who suffers loss has a s.43A claim against the hospital.

A coaching institute in Kota. Its fee-app vendor sells the student database. The institute faces s.43A claims; the vendor faces s.72A. A contract binding the vendor to security and confidentiality is the institute’s best protection.

Where an offence under the IT Act is also involved, s.85 makes persons in charge answerable unless they prove lack of knowledge or due diligence. Documented security practice is that evidence.

What changes on 13 May 2027

The DPDP Act, 2023 and the DPDP Rules, 2025 bring their main obligations into force from 13 May 2027, and on that date s.44(2) of the DPDP Act omits s.43A. Three differences matter:

• From compensation to penalty. s.43A gives the affected person compensation. The DPDP Act gives the Data Protection Board power to impose penalties up to ₹250 crore for failure to take reasonable security safeguards, and up to ₹200 crore for failure to notify a breach or for breach of children’s data obligations.
• All personal data. Not only sensitive data, and including paper data later digitised.
• Breach intimation. A personal data breach must be intimated to the Board and to each affected person.

The work done now (a policy, an audit, vendor clauses, a data map) carries straight over to DPDP compliance.

Frequently asked questions

Does Section 43A apply to a government college?

It depends on whether the body is a “body corporate” engaged in commercial or professional activities. From 13 May 2027, the DPDP Act applies to government bodies unless specifically exempted.

Is there an upper limit on compensation?

s.43A itself sets no ceiling. The Adjudicating Officer under s.46 decides claims up to ₹5 crore; larger claims go to the civil court.

Must a data leak be reported to anyone today?

Yes. Data breaches and data leaks are reportable to CERT-In within 6 hours under its Directions of 28 April 2022.

Quick quiz

For administrators, IT cells and data officers: Cyber Crime Law for Offices and Institutions, ₹599. It is a certificate of completion, not a professional qualification.

Sources

• Information Technology Act, 2000: ss.43, 43A (with Explanation), 46, 66, 72A, 85
• Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011: Rules 3, 4, 5, 6 and 8
• Digital Personal Data Protection Act, 2023: ss.8 and 44(2), and Schedule (penalties)
• Digital Personal Data Protection Rules, 2025
• CERT-In Directions under s.70B(6) of the IT Act, dated 28 April 2022

This page is for education and general information, not legal advice for a specific case. Law as on 29 October 2026.