top of page
Search

How to Prepare for the Omission of Section 43A of the Information Technology Act

Writer: Kaustav Chowdhury
Kaustav Chowdhury
2 hours ago
5 min read

The Digital Personal Data Protection Act, 2023 is usually described as adding obligations. It also takes a remedy away. Section 44(2)(a) omits section 43A of the Information Technology Act, 2000, which is the provision under which a person affected by a data breach has been able to claim compensation from the body corporate that held the data. The replacement regime penalises, but it does not compensate.

Step 1: Fix the Commencement Position

Section 44(2) is in the group that comes into force eighteen months after publication of the commencement notification G.S.R. 843(E) dated November 13, 2025, which falls in May 2027. Section 44(1) and section 44(3) commenced at once, so the three sub-sections of section 44 do not move together.

Until then section 43A remains available. A claim that can be brought now is worth assessing now, and an advice that treats the provision as gone is wrong on status for another cycle of limitation.

Step 2: Know What the Omitted Provision Actually Gave

Section 43A provides that where a body corporate possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates is negligent in implementing and maintaining reasonable security practices and procedures, and thereby causes wrongful loss or wrongful gain to any person, it shall be liable to pay damages by way of compensation to the person so affected.

Four elements follow, and each is a pleading point. A body corporate, which the Explanation extends to a firm, a sole proprietorship or another association of individuals engaged in commercial or professional activities. Sensitive personal data in a resource it owns, controls or operates. Negligence in implementing and maintaining reasonable security practices and procedures. And resulting wrongful loss or wrongful gain.

Step 3: Note What the Replacement Does Not Do

The Digital Personal Data Protection Act creates penalties payable on a determination by the Data Protection Board. It does not create a right to compensation for a data principal, and the penalties are not payable to the person affected.

So the honest summary for a client is that after the omission takes effect the statutory route to money for the individual closes, while the route to a penalty against the organisation opens. Advising otherwise, in either direction, is the error to avoid.

Step 4: Assess Live Claims Against the Clock

Any claim founded on section 43A should be assessed on the assumption that the provision will not be there indefinitely. Identify the affected persons, the sensitive personal data involved, the security failure relied on and the loss or gain said to have resulted, and date each element.

Where a claim is viable, the question of when to bring it is now a question about the provision's own life and not only about limitation. Where it is marginal, say so, because a claim filed late in the day on thin facts is a worse outcome than a claim not brought.

Step 5: Re-paper Contractual Security Standards

The Explanation to section 43A defines reasonable security practices and procedures as practices designed to protect the information from unauthorised access, damage, use, modification, disclosure or impairment, as specified in an agreement between the parties or in any law in force, and in the absence of either, as prescribed by the Central Government in consultation with such professional bodies or associations as it may deem fit.

That is the sleeper. The standard could be set by the contract, so a great many vendor agreements point at the statutory concept rather than describing the controls. When the section goes, a clause that borrows its language loses its anchor. Specify the controls in the agreement itself rather than by reference.

Step 6: Keep the Rest of the Remedy Map in View

The omission removes one statutory claim. It does not touch a claim in contract for breach of a security obligation, a claim founded on the constitutional right to privacy against the State, a consumer complaint where the relationship is one of service, or regulatory action by a sectoral regulator.

So the advice is a map rather than a single door. Record which routes a given client has, because the one that is being withdrawn is the one most commonly cited in notices and the least likely to be the only one available.

Step 7: Brief the Board on the Change of Exposure

For an organisation the change is not simply good news. Compensation under section 43A is owed to affected persons and is bounded by their loss. A penalty determined by the Data Protection Board is owed to the State and is bounded by the Schedule rather than by what anyone lost.

Put both propositions in the same paper when the exposure is reported upward, and avoid quantifying the second until the Board's practice exists. The useful work in the meantime is evidence of the security measures actually in place, which answers a negligence allegation today and a penalty factor later.

Common Pitfalls to Avoid

  • Treating section 43A as already gone: Section 44(2) commences with the eighteen month tranche, so the provision remains available until then.

  • Assuming all of section 44 moves together: Sub-sections (1) and (3) commenced on publication and sub-section (2) did not.

  • Telling a client the new Act compensates: It provides for penalties determined by the Data Protection Board, not damages payable to the person affected.

  • Reading body corporate narrowly: The Explanation extends it to a firm, a sole proprietorship or another association of individuals engaged in commercial or professional activities.

  • Leaving contracts pointing at the statute: The Explanation lets an agreement set the security standard, so a clause that borrows the statutory language loses its anchor when the section goes.

  • Forgetting the fault standard: Section 43A turns on negligence in implementing and maintaining reasonable security practices and procedures, not on the breach alone.

  • Presenting the omission as a reduction in exposure: Compensation is bounded by loss; a penalty is bounded by the Schedule.

Key Statutory Provisions

  • Section 44 of the Digital Personal Data Protection Act, 2023: Amendments to certain Acts. Sub-section (2) amends the Information Technology Act, 2000, and clause (a) of that sub-section provides that section 43A shall be omitted, together with two consequential changes elsewhere in that Act.

  • Section 43A of the Information Technology Act, 2000: Compensation for failure to protect data. A body corporate possessing, dealing or handling sensitive personal data or information in a computer resource which it owns, controls or operates, and negligent in implementing and maintaining reasonable security practices and procedures, thereby causing wrongful loss or wrongful gain to any person, is liable to pay damages by way of compensation to the person so affected; with the Explanation defining body corporate, reasonable security practices and procedures, and sensitive personal data or information.

Sources and References


Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers should consult a qualified legal professional for advice specific to their circumstances.

Comments

bottom of page