Compensation for failure to protect data
Section 43A of the Information Technology Act, 2000 deals with compensation for failure to protect data. Where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain t The Act came into force on 17 Oct 2000.
1 [43A. Compensation for failure to protect data.--Where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate shall be liable to pay damages by way of compensation to the person so affected.
Explanation.--For the purposes of this section,--
(i) "body corporate" means any company and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities;
(ii) "reasonable security practices and procedures" means security practices and procedures designed to protect such information from unauthorised access, damage, use, modification, disclosure or impairment, as may be specified in an agreement between the parties or as may be specified in any law for the time being in force and in the absence of such agreement or any law, such reasonable security practices and procedures, as may be prescribed by the Central Government in consultation with such professional bodies or associations as it may deem fit;
(iii) "sensitive personal data or information" means such personal information as may be prescribed by the Central Government in consultation with such professional bodies or associations as it may deem fit.]
Section 43A, The Information Technology Act, 2000 (Act 21 of 2000).
Cross-references
Extracted from the operative text of the enactments themselves. Every destination below exists in our corpus.
Referred to by 1
Related judgements & precedents
These are some judgments that construed this section, and hold precedence value. They hold authority on how to read, interpret and use this section.
-
Ramaditya Tiwari v. Canara Bank
Court's Decision & Legal Precedent
HC Final Order order-1.pdf. Index date 2024-11-25. DATE-CHECK flagged 2024-07-19 / 2024-10-25 (false positive: RFP date 19.07.2024 and prior interim 25.10.2024); header is DATED THIS THE 25TH DAY OF NOVEMBER, 2024. Karnataka DB Anjaria CJ / K.V. Aravind. WP 28476/2024 (GM-RES-PIL). Isolates IT 43A Explanation (ii)/(iii) reasonable security practices and sensitive personal data plus SPDI Rules 2011; a bank EMV-card RFP must require vendor compliance with 43A/SPDI Rules. Bank revised the draft contract to do so; PIL disposed. Map it-act 43A only. Do not pad IT 79 or DPDP Act.
On this section: IT Act 43A and the SPDI Rules 2011 require a body corporate handling card/banking data to adopt reasonable security practices; a bank RFP must stipulate that compliance (Ramaditya Tiwari).
The holding above is the ratio decidendi as extracted from the judgment by eCourts India, reproduced unaltered — it is a rendering of the court's reasoning, not a substitute for its words. Read the order itself before relying on it.
Made under this section, and citing it
1 instrument states that it was made under this provision — the power to make it comes from here, so a change to any of them changes what this section requires in practice. Newest first.
Another 2 instruments name this provision in its title or its text without being made under it.
Questions about Section 43A
What have the courts held on Section 43A of the Information Technology Act?
Ramaditya Tiwari v. Canara Bank (25 Nov 2024) is the leading judgment on this section among those set out below: IT Act 43A and the SPDI Rules 2011 require a body corporate handling card/banking data to adopt reasonable security practices; a bank RFP must stipulate that compliance (Ramaditya Tiwari).
How do I find court cases under Section 43A of the Information Technology Act?
In judgments and charge sheets this section is written several ways, and each form finds a different set of orders. These search the full text of every order eCourtsIndia holds, best matches first: IT Act 43A, section 43A IT Act, section 43A of the Information Technology Act. People searching for it also type it act 43a malayalam and it act 43a punishment. Each opens the full list of orders on eCourtsIndia, where it can be narrowed by court, year and outcome. 1 reported judgment on this section is set out on this page, beginning with Ramaditya Tiwari v. Canara Bank (25 Nov 2024).
What should I read with Section 43A of the Information Technology Act, and has it changed?
1 other provision in this corpus refers back to it. The rules and notifications made under it are where it actually bites, and there is one: most recently The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. (2011).
When did Section 43A of the Information Technology Act come into force?
Section 43A of the Information Technology Act, commonly called data protection, and cited as IT Act 43A, came into force on 17 Oct 2000, having been enacted on 09 Jun 2000. It is in force as at the date shown on this page.
Other sections of this Act
- 2. Definitions1304 words
- 87. Power of Central Government to make rules877 words
- 43. Penalty and compensation for damage to computer, computer system, etc506 words
- 46. Power to adjudicate370 words
- 89. Power of Controller to make regulations345 words
- 70B. Indian Computer Emergency Response Team to serve as national agency for incident response326 words
Source and method. Compiled from the enactments of Parliament and of the State legislatures as published on India Code, and republished together with commentary and other original matter under section 52(1)(q)(ii) of the Copyright Act, 1957. Structured, cross-referenced and maintained by eCourtsIndia. Text as in force on 15 Oct 2026. This page is not a substitute for legal advice.