Section 72A IT Act: Penalty for disclosure of information in breach of lawful contract
Information Technology Act, 2000
Section 72A IT Act at a Glance
Section 72A IT Act imposes a penalty up to ₹25 lakh when a person or intermediary accesses personal information under a lawful contract and discloses it without consent or in breach of contract, intending or knowing likely wrongful loss or gain.
Section 72A IT Act Bare Act Text
72A. Penalty for disclosure of information in breach of lawful contract.
Save as otherwise provided in this Act or any other law for the time being in force, any person including an intermediary who, while providing services under the terms of lawful contract, has secured access to any material containing personal information about another person, with the intent to cause or knowing that he is likely to cause wrongful loss or wrongful gain discloses, without the consent of the person concerned, or in breach of a lawful contract, such material to any other person, shall be liable to penalty which may extend to twenty-five lakh rupees.
Amendments to this section
- Ins. by Act 10 of 2009, s. 37, (w.e.f. 27-10-2009).
- Subs. by Act 18 of 2023, s. 2 and Schedule, for "Punishment" (w.e.f. 30-11-2023).
- Subs. by Act 18 of 2023, s. 2 and Schedule, for certain word (w.e.f. 30-11-2023).
Section 72A IT Act in Simple Words
Section 72A IT Act imposes a monetary penalty for the improper disclosure of personal information accessed while providing services under a lawful contract. Section 72A IT Act applies to any person, explicitly including an intermediary (a term defined in Section 2 IT Act), except where the IT Act or any other law in force provides otherwise.
For Section 72A IT Act to apply, the person or intermediary must first have secured access to material containing personal information about another person while providing services under the terms of a lawful contract. Next, that material must be disclosed to any other person either without the consent of the person concerned or in breach of a lawful contract.
Section 72A IT Act also requires a specific mental state: the person making the disclosure must act with the intent to cause wrongful loss or wrongful gain, or with knowledge that the act is likely to cause wrongful loss or wrongful gain. When all of these conditions are met, the person is liable to a penalty of up to ₹25 lakh.
Section 72A IT Act was inserted by Act 10 of 2009 with effect from 27 October 2009. By Act 18 of 2023 (with effect from 30 November 2023), the word 'Penalty' replaced 'Punishment' in the heading and certain words in the text were substituted, making Section 72A IT Act a penalty provision.
When Section 72A IT Act Applies
- No other provision of the IT Act or any other law in force provides otherwise.
- A person, including an intermediary, secures access to material containing personal information about another person while providing services under the terms of a lawful contract.
- The person discloses that material to any other person.
- The disclosure is made either without the consent of the person concerned or in breach of a lawful contract.
- The disclosure is made with the intent to cause wrongful loss or wrongful gain, or with knowledge that the act is likely to cause wrongful loss or wrongful gain.
Example of Section 72A IT Act
When Section 72A IT Act Does Not Apply
- Another provision of the IT Act or any other law in force provides otherwise.
- Access to the material containing personal information was not secured while providing services under the terms of a lawful contract.
- The disclosure is made without intent to cause wrongful loss or wrongful gain, and without knowledge that wrongful loss or wrongful gain is likely to be caused.
- The disclosure is made with the consent of the person concerned and does not breach a lawful contract.
FAQs on Section 72A IT Act
What is Section 72A IT Act?▼
Section 72A IT Act makes any person, including an intermediary, liable to a monetary penalty for disclosing material containing personal information accessed while providing services under a lawful contract, when done without the person's consent or in breach of contract and with intent or knowledge of likely wrongful loss or gain. Unless the IT Act or another law in force provides otherwise, the penalty is up to ₹25 lakh.
What is the maximum penalty under Section 72A IT Act?▼
Up to ₹25 lakh. Under Section 72A IT Act as amended by Act 18 of 2023 (with effect from 30 November 2023), a person who contravenes the provision is liable to a penalty of up to ₹25 lakh.
Does Section 72A IT Act apply to intermediaries?▼
Yes. Section 72A IT Act explicitly covers 'any person including an intermediary' who secures access to material containing personal information while providing services under a lawful contract.
Does an accidental leak without intent or knowledge of likely wrongful loss or gain attract Section 72A IT Act?▼
No. Section 72A IT Act applies only when the disclosure is made with the intent to cause wrongful loss or wrongful gain, or knowing that the act is likely to cause wrongful loss or wrongful gain.
Does Section 72A IT Act carry a higher penalty than Section 72 IT Act?▼
Yes. Section 72A IT Act carries a penalty of up to ₹25 lakh for disclosing personal information accessed under a lawful service contract with intent or knowledge of likely wrongful loss or gain. Section 72 IT Act carries a penalty of up to ₹5 lakh for disclosing material accessed using statutory powers under the IT Act without consent.
Have questions about Section 72A IT Act?
Ask NyayGuru about your situation and get an answer based on the Information Technology Act, 2000.
Ask NyayGuru →Disclaimer: This is for informational purposes only. Always consult a qualified advocate for legal advice.
Sources: Bare Act Text, Information Technology Act, 2000 ·