Information Technology Act, 2000
India’s main law on electronic records, cybercrime and intermediaries, which has also governed data protection until now.
The IT Act, 2000 is India's main law on electronic records, cybercrime and online intermediaries. Until the DPDP Act takes over, its Section 43A and the SPDI Rules also covered data protection.
Meaning of Information Technology Act, 2000
Section 43A of the IT Act and the SPDI Rules, 2011 required companies to protect sensitive personal data. The DPDP Act replaces that regime when its amending provision comes into force. Other parts of the IT Act, such as cybercrime provisions and CERT-In powers, continue.
The Information Technology Act, 2000 was passed to give legal recognition to electronic records and digital signatures and to deal with computer-related offences. It was never a complete privacy law, but for two decades it was the nearest India had. Section 43A, inserted in 2008, made a body corporate liable to pay compensation if it was negligent in implementing reasonable security practices for sensitive personal data and caused wrongful loss or gain. The SPDI Rules, 2011 explained what "reasonable security practices" and "sensitive personal data" meant.
Section 44(2) of the DPDP Act amends the IT Act by omitting Section 43A, along with a related clause in Section 87(2) and a small cross-reference in Section 81, so that data protection is handled by the new Act and the Board. Because the Act's main obligations take effect in stages, with the principal duties scheduled for 13 May 2027, organisations should check commencement notifications before treating the old regime as repealed, and plan to run to the new standard from the start.
Large parts of the IT Act carry on. Sections 43 and 66 deal with unauthorised access and computer-related offences. Section 69A lets the Government direct blocking of information. The IT Act's intermediary rules set due diligence duties for platforms. Section 70B establishes CERT-In, whose 2022 directions require reporting of specified cyber incidents within six hours and retention of logs for 180 days within India. Section 72A punishes disclosure of personal information in breach of a lawful contract.
The two statutes also share vocabulary. Section 38 makes the DPDP Act additional to other laws, so an incident can trigger obligations under both: a CERT-In report and a breach intimation to the Board and affected Data Principals. The Appellate Tribunal for DPDP appeals is the body recognised under the TRAI Act, whose list Section 44(1) updates.
Examples of Information Technology Act, 2000
A company that followed the SPDI Rules now builds its programme around the DPDP Act, but still reports incidents to CERT-In under the IT Act.
A BPO that handled customer data under the SPDI Rules reviews its client contracts. It keeps its security certification, adds DPDP-style processor clauses on breach reporting and erasure, and continues to log access for CERT-In purposes.
A cloud provider receives a Section 69A blocking direction concerning a customer's site and, separately, runs a DPDP compliance programme. It handles the blocking order under the IT Act process and does not confuse it with Section 37 of the DPDP Act.
An insurer that relied on Section 43A risk assessments moves to a DPDP risk register. It maps penalty ceilings to its top threats and asks its IRDAI-facing team to confirm which sector rules continue.
Why Information Technology Act, 2000 matters
Many compliance teams built their programmes around Section 43A and the SPDI Rules: a privacy policy, written consent for sensitive data and an ISO 27001-style security framework. That foundation helps, but it is not enough. The DPDP Act covers all digital personal data, not only a list of sensitive categories, and carries penalties up to ₹250 crore for security failures, compared with an open-ended compensation claim under the old regime.
Because the IT Act continues to apply for cybercrime, intermediaries and CERT-In reporting, one incident can mean four obligations at once: a CERT-In report, a Board intimation, notices to affected people, and possibly a police complaint. A team that thinks the IT Act has disappeared will miss the first and last of these.
How it works in practice
- 1Create a two-column map of your current programme: what you do because of the IT Act and SPDI Rules, and what the DPDP Act and Rules now require. Retain the former where it still applies and fill gaps in the latter.
- 2Keep your CERT-In process alive: contact point, six-hour reporting capability and 180-day log retention in India. Align it with the Rule 7 breach workflow so one incident record feeds both reports.
- 3Replace the SPDI-style privacy policy with a Rule 3 notice that is itemised, in plain language and explains withdrawal and complaint routes. Plan consent refresh for existing customers where needed.
- 4Update contracts. Where you relied on Section 43A for liability allocation with vendors, rewrite clauses around Section 8 and Rule 6 safeguards.
- 5Train legal and security staff on the transition timeline and set a review date after each commencement notification.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Believing the whole IT Act is replaced. Only Section 43A and a few related clauses are amended. Cybercrime, intermediary and CERT-In provisions remain.
Assuming SPDI compliance equals DPDP compliance. The new Act has a different notice, consent, breach and rights framework.
Dropping CERT-In reporting after DPDP preparation. The two reporting duties exist side by side.
Switching policies too early or too late. Check commencement dates so the right regime applies at the right time.
Compliance tips
Keep one incident register that records the CERT-In report, the Board intimation and notices to individuals.
Preserve your security framework certificates. Rule 6 safeguards map well to many ISO-based controls.
Replace the term "sensitive personal data" in contracts with DPDP language where appropriate.
Appoint someone to watch MeitY notifications on commencement dates and Rules updates.
Common questions about Information Technology Act, 2000
Is the IT Act repealed by the DPDP Act?
No. The DPDP Act only amends it, including omitting Section 43A under Section 44(2). Provisions on offences, intermediaries, blocking and CERT-In stay in force and continue to apply alongside the DPDP Act.
What replaces Section 43A of the IT Act?
The DPDP Act's own framework: [reasonable security safeguards](term/reasonable-security-safeguards) under Section 8(5), breach reporting under Section 8(6), and penalties decided by the [Data Protection Board](term/data-protection-board-of-india) under Section 33, in place of a compensation claim for negligence.
Do I still report incidents to CERT-In after the DPDP Act?
Yes. CERT-In directions under the IT Act continue to require reporting of specified cyber incidents within six hours. A [personal data breach](term/personal-data-breach) may also need a report to the Board and notice to affected individuals.
When does the IT Act stop covering data protection?
When the Section 44(2) amendment commences, which is expected alongside the Act's main obligations on 13 May 2027. Confirm against the latest MeitY commencement notification and keep complying with the existing regime until then.