Section 43A IT Act: Compensation for failure to protect data

Information Technology Act, 2000

Section 43A IT Act at a Glance

Section 43A IT Act covers a body corporate handling sensitive personal data in a computer resource it owns, controls, or operates. Negligence in implementing and maintaining reasonable security practices that causes wrongful loss or wrongful gain makes it liable to pay compensation.

Section 43A IT Act Bare Act Text

43A. Compensation for failure to protect data.
Where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate shall be liable to pay damages by way of compensation to the person so affected.
Explanation.—For the purposes of this section,—
(i) “body corporate” means any company and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities;
(ii) “reasonable security practices and procedures” means security practices and procedures designed to protect such information from unauthorised access, damage, use, modification, disclosure or impairment, as may be specified in an agreement between the parties or as may be specified in any law for the time being in force and in the absence of such agreement or any law, such reasonable security practices and procedures, as may be prescribed by the Central Government in consultation with such professional bodies or associations as it may deem fit;
(iii) “sensitive personal data or information” means such personal information as may be prescribed by the Central Government in consultation with such professional bodies or associations as it may deem fit.

Amendments to this section

Ins. by s. 22, ibid. (w.e.f. 27-10-2009).

Section 43A IT Act in Simple Words

Section 43A IT Act makes a body corporate liable to pay damages by way of compensation, meaning money paid to make good the harm suffered, when a failure to protect sensitive personal data causes wrongful loss or wrongful gain. Under Section 43A IT Act, liability arises where a body corporate possesses, deals with, or handles any sensitive personal data or information in a computer resource that the body corporate owns, controls, or operates, is negligent in implementing and maintaining reasonable security practices and procedures, and thereby causes wrongful loss or wrongful gain to any person. Where those requirements are met, the body corporate is under a civil liability to pay damages by way of compensation to the affected person. Act 10 of 2009 inserted Section 43A IT Act with effect from 27 October 2009.

Clause (i) of the Explanation to Section 43A IT Act defines 'body corporate' for Section 43A IT Act. It means any company and also includes a firm, a sole proprietorship, or any other association of individuals engaged in commercial or professional activities.

Clause (ii) of the Explanation to Section 43A IT Act defines 'reasonable security practices and procedures' as security practices and procedures designed to protect sensitive personal data or information from unauthorised access, damage, use, modification, disclosure, or impairment. Those practices and procedures may be specified in an agreement between the parties or in any law for the time being in force. In the absence of both such an agreement and any law, they are such reasonable security practices and procedures as may be prescribed by the Central Government in consultation with such professional bodies or associations as the Central Government deems fit.

Clause (iii) of the Explanation to Section 43A IT Act defines 'sensitive personal data or information' for Section 43A IT Act. It means such personal information as may be prescribed by the Central Government in consultation with such professional bodies or associations as the Central Government deems fit.

When Section 43A IT Act Applies

The entity is a body corporate, meaning any company, or a firm, sole proprietorship, or other association of individuals engaged in commercial or professional activities.
The body corporate possesses, deals with, or handles sensitive personal data or information (personal information prescribed by the Central Government in consultation with professional bodies or associations).
That sensitive personal data or information is in a computer resource that the body corporate owns, controls, or operates.
The body corporate is negligent in implementing and maintaining reasonable security practices and procedures (specified by agreement between the parties, by a law in force, or, in the absence of both, prescribed by the Central Government).
That negligence causes wrongful loss or wrongful gain to any person, making the body corporate liable to pay damages by way of compensation to the affected person.

Example of Section 43A IT Act

A diagnostic clinic run by a private company in Kannur stores patients' prescribed sensitive personal information on a database server that the company owns and operates. Under the clinic's written patient agreement, the company must maintain access controls and user authentication to protect that information from unauthorised access and disclosure. The company negligently leaves the database server open on the internet without those agreed access controls, and an intruder copies the records of a patient, Hemant, and uses them to cause wrongful loss to Hemant. Because the company handled sensitive personal information in a computer resource it owned and operated, was negligent in implementing and maintaining the agreed security practices, and caused wrongful loss, the company is liable under Section 43A IT Act to pay damages by way of compensation to Hemant.

When Section 43A IT Act Does Not Apply

Section 43A IT Act applies only to a body corporate, defined as a company, or a firm, sole proprietorship, or other association of individuals engaged in commercial or professional activities.
Section 43A IT Act applies only where sensitive personal data or information (as prescribed by the Central Government) is possessed, dealt with, or handled in a computer resource that the body corporate owns, controls, or operates.
There is no negligence by the body corporate in implementing and maintaining reasonable security practices and procedures.
No wrongful loss or wrongful gain is caused to any person as a result of the body corporate's negligence.

FAQs on Section 43A IT Act

What is Section 43A IT Act?▼

Section 43A IT Act makes a body corporate liable to pay damages by way of compensation when it possesses, deals with, or handles sensitive personal data or information in a computer resource it owns, controls, or operates and is negligent in implementing and maintaining reasonable security practices and procedures. That civil liability applies where the negligence causes wrongful loss or wrongful gain to any person.

Is Section 43A IT Act still in force?▼

Yes, for now. Section 44(2)(a) of the Digital Personal Data Protection Act, 2023 omits Section 43A IT Act, but notification G.S.R. 843(E) dated 13 November 2025 brings that provision into force only on 13 May 2027. Until then, Section 43A IT Act applies.

Does Section 43A IT Act cover a partnership firm or a sole proprietorship?▼

Yes, when engaged in commercial or professional activities. Under Clause (i) of the Explanation to Section 43A IT Act, 'body corporate' means any company and includes a firm, a sole proprietorship, or another association of individuals engaged in commercial or professional activities.

How are reasonable security practices and procedures set under Section 43A IT Act?▼

By an agreement between the parties, by a law in force, or, if neither exists, by Central Government prescription. Under Clause (ii) of the Explanation to Section 43A IT Act, practices prescribed by the Central Government in consultation with professional bodies or associations apply in the absence of an agreement or a law in force.

Is negligence without wrongful loss or wrongful gain enough for liability under Section 43A IT Act?▼

No. Under Section 43A IT Act, a body corporate is liable to pay compensation only where negligence in implementing and maintaining reasonable security practices and procedures causes wrongful loss or wrongful gain to a person.

Does Section 43A IT Act specify a cap on the compensation payable?▼

No. Section 43A IT Act states that the negligent body corporate is liable to pay damages by way of compensation to the affected person and sets no upper limit in Section 43A IT Act.

Have questions about Section 43A IT Act?

Ask NyayGuru about your situation and get an answer based on the Information Technology Act, 2000.

Ask NyayGuru →

Disclaimer: This is for informational purposes only. Always consult a qualified advocate for legal advice.

Sources: Bare Act Text, Information Technology Act, 2000 ·