In short
The Information Technology Act, 2000 (IT Act) is India’s core cyber law. Section 43A makes a business pay compensation if it handles sensitive personal data and negligently fails to protect it. The 2011 SPDI Rules spell out what protecting it means: a privacy policy, consent, limits on sharing, a grievance officer and a documented, audited security programme. These duties apply today and are due to be replaced by the DPDP Act in May 2027, but the Act’s offences and CERT-In’s powers stay.
Who it applies to
- Body corporates handling sensitive personal data. Section 43A defines a body corporate widely: a company, a firm, a sole proprietor or any other group of people in commercial or professional activity. Size does not matter.
- Sensitive personal data is a closed list in Rule 3: passwords; financial information such as bank account, credit or debit card or other payment details; physical, physiological and mental health; sexual orientation; medical records and history; and biometric information. Information freely available in the public domain is excluded.
- Everyone who uses computer systems, for the offences in Sections 43, 66, 66C and 72A.
- Platforms that host other people’s content, such as marketplaces or portals with user posts, if they want protection as intermediaries under Section 79.
What it means for your website
- Publish a privacy policy. Rule 4 requires it on your website. It must state what you collect, why, who you share it with and the security practices you follow.
- Get consent before collecting sensitive data. Rule 5 asks for consent in writing, by letter, fax or email. A 2011 government press note accepted consent given by any means of electronic communication.
- Tell people why. Before collection, people must know the purpose, who will receive the data, and the name and address of the business collecting and keeping it.
- Offer a way out. People may refuse to give sensitive data, and may withdraw consent later. You may then decline the service that needs it.
- Name a grievance officer. Publish their name and contact details on the website. Grievances must be resolved within one month.
- For user-content platforms: Section 79 protects an intermediary from liability for third-party content only if it follows the due diligence in the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. These include published terms of use and privacy policy, and a grievance officer. The 2021 Rules have been amended several times, so check the current timelines.
What it means for your software
Collect only what the purpose needs
Rule 5 allows sensitive data to be collected only for a lawful purpose connected to your business, and only when necessary. It must be used only for that purpose and kept no longer than needed, unless another law requires it. In software this means no optional fields that quietly collect health or bank details, and a retention period for each record type.
Consent and correction
Your system should record that consent was given, when, and for what. People can ask to review their data and correct it. An ERP, CRM or HR system needs a way to find a person’s records, correct them and note the change.
Disclosure and transfer
Rule 6 requires the person’s prior permission before sensitive data is shared with a third party. The exceptions are government agencies authorised by law, and disclosures required by a legal order. Rule 7 allows transfer to another business, in India or abroad, only if it ensures the same level of protection. The transfer must also be needed for a lawful contract with the person, or have their consent. In practice: log every export and integration that sends sensitive data out, and back each one with a contract.
Reasonable security practices
Rule 8 treats a business as compliant if it has a comprehensive, documented information security programme with controls suited to the data it protects. IS/ISO/IEC 27001 is named as one standard that meets this. Other codes of practice need Central Government approval. The programme must be audited at least once a year, and again after a significant upgrade, by an independent auditor approved by the government. For software, that means role-based access, encrypted passwords and payment data, access logs and a change record an auditor can check.
Offences that shape system design
- Section 43: accessing, downloading, introducing a virus, damaging a system or denying access without permission. The person affected can claim compensation.
- Section 66: the same acts done dishonestly or fraudulently are a crime, with up to three years in prison, a fine up to ₹5 lakh, or both.
- Section 66C: fraudulent use of someone’s password, electronic signature or other unique identification feature. Up to three years in prison and a fine up to ₹1 lakh.
- Section 72A: disclosing personal information obtained under a contract, without consent or in breach of the contract, to cause wrongful loss or gain. Up to three years in prison, a fine up to ₹5 lakh, or both.
These make strong authentication, least-privilege access and an audit trail worth having for evidence, not only for compliance. If an insider leaks data, logs show who did what.
Incident reporting
Section 70B sets up CERT-In, India’s national agency for cyber incidents. Its 2022 Directions require many incidents to be reported within 6 hours and logs to be kept for 180 days. See CERT-In Directions.
How the DPDP Act changes this
Section 44(2) of the Digital Personal Data Protection Act, 2023 omits Section 43A from the IT Act. It also removes the rule-making power behind the SPDI Rules, so the Rules fall away with it. This change is in the last phase of the DPDP Act, due in May 2027. Published analyses differ on the exact day, so confirm it against the official notification. Until then, both regimes can apply: the SPDI Rules now, and the DPDP Act’s duties as they phase in. Sections 43, 66, 66C, 72A and 70B are not touched by this change.
Checklist
- Find every place your website and systems collect passwords, financial, health or biometric data.
- Publish a privacy policy that matches what you actually collect, share and protect.
- Add a consent step before collecting sensitive data, and store a record of it.
- Appoint a grievance officer, publish their details, and track grievances to closure within one month.
- List every third party that receives sensitive data, and check each has a contract and equal protection.
- Write down your information security programme, based on ISO/IEC 27001 or an approved code.
- Arrange an independent audit at least once a year, and after any major system change.
- Turn on role-based access, encryption for sensitive fields, and access and change logs.
- Plan the move to the DPDP Act before May 2027: notices, consent records, rights requests and erasure.
How Kreon helps
We build the ERP, CRM, HR and app systems that hold this data with role-based access, encrypted sensitive fields, consent records and access logs from the start. Kreon ERP keeps a full audit trail of every change, with the values before and after and the option to revert. We have built systems that passed independent VAPT, and we can review an existing system against the SPDI Rules and the DPDP Act.