Section 44: Amendments to Certain Acts
Section 44 closes out the Act with three consequential amendments to existing laws — the Telecom Regulatory Authority of India Act, the Information Technology Act, and the Right to Information Act — needed to make the rest of the Act's machinery actually fit into India's existing legal framework.
Quick summary
What Section 44 says
- Sub-section (1) — amends Section 14 of the Telecom Regulatory Authority of India Act, 1997, substituting sub-clauses in clause (c) to add references to the Appellate Tribunal under the Information Technology Act, 2000; the Appellate Tribunal under the Airports Economic Regulatory Authority of India Act, 2008; and the Appellate Tribunal under the Digital Personal Data Protection Act, 2023.
- Sub-section (2) — amends the Information Technology Act, 2000: (a) omits Section 43A (the IT Act's own prior compensation provision for failure to protect sensitive personal data); (b) in the proviso to Section 81, inserts a reference to the Digital Personal Data Protection Act, 2023 alongside the existing reference to the Patents Act, 1970; and (c) omits clause (ob) of Section 87(2).
- Sub-section (3) — amends Section 8(1)(j) of the Right to Information Act, 2005, substituting it with a new clause exempting “information which relates to personal information” from mandatory disclosure.
Breaking it down
Sub-section (1) is what legally connects the DPDP Act's Appellate Tribunal to the existing TRAI Act framework. Since Section 2(a) of the DPDP Act defines the Appellate Tribunal by reference to the body established under the TRAI Act, this amendment updates that Act's own list of tribunals it covers to formally recognise its new role hearing DPDP appeals too — alongside doing the same for the IT Act and Airports Economic Regulatory Authority Act's tribunals.
Sub-section (2)(a)'s removal of IT Act Section 43A is a significant handover, not a minor tidy-up. Section 43A was previously India's primary statutory compensation provision for a body corporate's failure to protect sensitive personal data. Omitting it reflects that the DPDP Act now occupies this space as India's dedicated data-protection framework, rather than the two regimes continuing to operate in parallel.
Sub-section (2)(b)'s cross-reference insertion is a smaller, technical update. It adds the DPDP Act alongside the existing Patents Act reference in the IT Act's Section 81 proviso, which addresses how the IT Act's provisions interact with other specific laws.
Sub-section (3)'s RTI Act amendment updates a long-standing personal-information exemption. The Right to Information Act has always allowed withholding personal information that would otherwise invade privacy without serving public interest; this amendment updates the specific wording of that exemption clause to align with the DPDP Act's own framework and terminology for personal information.
Why this section matters
A new Act rarely operates in a vacuum — it has to be stitched into the existing body of law it overlaps with. Section 44 is that stitching: making sure the DPDP Act's Appellate Tribunal is properly recognised within the pre-existing TRAI Act structure, retiring the now-duplicative IT Act provision the DPDP Act supersedes, and aligning the RTI Act's personal-information exemption with the new framework.
Real-world example
What changed for organisations that previously relied on IT Act Section 43A
Before the DPDP Act, Section 43A of the Information Technology Act, 2000 was the main statutory basis for a body corporate being liable to pay compensation for failing to protect sensitive personal data.
- After Section 44(2)(a)'s omission of Section 43A — that specific IT Act provision is no longer part of the compensation framework — the DPDP Act's own penalty and enforcement structure under Sections 27, 28 and 33 now occupies this ground instead.
- Organisations that previously structured data-breach risk assessments around IT Act Section 43A exposure — need to reorient that analysis around the DPDP Act's own framework — the Schedule's penalty ceilings under Section 33, and the Board's enforcement powers under Sections 27 and 28.
Who needs to care about this section
- Legal teams who previously tracked IT Act Section 43A compliance — need to understand that framework has been superseded by the DPDP Act's own enforcement and penalty structure.
- Anyone dealing with the RTI Act's personal-information exemption — should be aware its wording has been updated by this section to align with the DPDP Act.
- Legal teams tracking the DPDP Appellate Tribunal's institutional basis — sub-section (1) is the formal amendment recognising its role within the pre-existing TRAI Act structure.