Section 72 IT Act: Penalty for Breach of confidentiality and privacy

Information Technology Act, 2000

Section 72 IT Act at a Glance

Section 72 IT Act applies when someone who obtained access to electronic records or other material using powers under the IT Act, its rules, or its regulations discloses that material to another person without consent, imposing a penalty up to ₹5 lakh.

Section 72 IT Act Bare Act Text

72. Penalty for Breach of confidentiality and privacy.

Save as otherwise provided in this Act or any other law for the time being in force, if any person who, in pursuance of any of the powers conferred under this Act, rules or regulations made thereunder, has secured access to any electronic record, book, register, correspondence, information, document or other material without the consent of the person concerned discloses such electronic record, book, register, correspondence, information, document or other material to any other person shall be liable to penalty which may extend to five lakh rupees.

Amendments to this section
  • Subs. by Act 18 of 2023, s. 2 and Schedule, for certain words (w.e.f. 30-11-2023).

Section 72 IT Act in Simple Words

Section 72 IT Act imposes a monetary penalty when confidentiality and privacy are breached by a person who accessed records through statutory powers under the IT Act. Unlike Section 72A IT Act (which covers access gained while providing services under a lawful contract), Section 72 IT Act applies where a person has secured access in pursuance of powers conferred under the IT Act, or under rules or regulations made under the IT Act.

The protected material covered by Section 72 IT Act is broad: any electronic record (a term defined in Section 2 IT Act), book, register, correspondence, information, document, or other material. If the person who secured access under those statutory powers discloses that material to any other person without the consent of the person concerned, the person making the disclosure becomes liable to a penalty of up to ₹5 lakh.

Section 72 IT Act opens with an exception: the rule applies except as otherwise provided in the IT Act or in any other law in force at the time. Section 72 IT Act was amended by Act 18 of 2023 with effect from 30 November 2023.

When Section 72 IT Act Applies

  • No other provision of the IT Act or any other law in force provides otherwise.
  • A person secures access to an electronic record, book, register, correspondence, information, document, or other material in pursuance of powers conferred under the IT Act, its rules, or its regulations.
  • The person concerned has not consented.
  • That electronic record or other material is disclosed to any other person.

Example of Section 72 IT Act

Cyril, exercising inspection powers conferred under the IT Act, secures access to electronic records and correspondence belonging to Shabnam at an office in Rajkot without Shabnam's consent. Instead of keeping those records confidential, Cyril shares copies of Shabnam's correspondence with Anthony, a business acquaintance, without Shabnam's consent. No provision of the IT Act or any other law in force authorises that disclosure to Anthony. Under Section 72 IT Act, Cyril is liable to a penalty of up to ₹5 lakh.

When Section 72 IT Act Does Not Apply

  • Another provision of the IT Act or any other law in force provides otherwise.
  • The person concerned has given consent.
  • Access to the electronic record, document, or other material was not secured in pursuance of powers conferred under the IT Act, its rules, or its regulations.
  • The material accessed under those statutory powers is not disclosed to any other person.

FAQs on Section 72 IT Act

What is Section 72 IT Act?▼

Section 72 IT Act imposes a monetary penalty on any person who, after securing access to electronic records, documents, correspondence, or other material using powers conferred under the IT Act or its rules or regulations, discloses that material to another person without the consent of the person concerned. Unless the IT Act or another law in force provides otherwise, the person making the disclosure is liable to a penalty of up to ₹5 lakh.

What is the maximum penalty under Section 72 IT Act?▼

Up to ₹5 lakh. Section 72 IT Act makes the person who discloses the material liable to a penalty that may extend to ₹5 lakh.

Does Section 72 IT Act apply to a private contractor who leaks customer data obtained under a service contract?▼

No. Section 72 IT Act covers only someone who secured access in pursuance of powers conferred under the IT Act or its rules or regulations. Disclosure of personal information accessed while providing services under a lawful contract is dealt with separately under Section 72A IT Act.

Does Section 72 IT Act cover physical books and registers as well as electronic records?▼

Yes. Section 72 IT Act explicitly lists any electronic record, book, register, correspondence, information, document, or other material accessed under powers conferred by the IT Act, its rules, or its regulations.

Does Section 72 IT Act apply if another law requires or permits the disclosure?▼

No. Section 72 IT Act begins with 'Save as otherwise provided in this Act or any other law for the time being in force', so disclosures authorised or required by the IT Act or another law in force are excluded.

Have questions about Section 72 IT Act?

Ask NyayGuru about your situation and get an answer based on the Information Technology Act, 2000.

Ask NyayGuru →

Disclaimer: This is for informational purposes only. Always consult a qualified advocate for legal advice.

Sources: Bare Act Text, Information Technology Act, 2000 ·