One Act leaves the field, the other takes over

The Digital Personal Data Protection Act, 2023 does not repeal the Information Technology Act, 2000. It takes over one job the IT Act did, which was making companies liable for failing to protect sensitive personal data, and it deletes the provision that did it. Sec. 44(2)(a) of the DPDP Act says that section 43A of the IT Act "shall be omitted".

Everything else in the IT Act stays: cyber offences, the intermediary rules, the powers to block content and the rest. This page is about the data protection slice only.

What section 43A and the SPDI Rules did

Section 43A of the IT Act made a body corporate that possessed, dealt with or handled sensitive personal data or information in a computer resource it owned or controlled liable to pay compensation if it was negligent in maintaining reasonable security practices and procedures and caused wrongful loss or gain to someone. The detail came from the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, usually called the SPDI Rules, made under that section. They covered a privacy policy, written consent for collecting sensitive data, and a security standard.

Three features define that regime. It protected only a defined category of sensitive data. It bound only a body corporate. And its remedy was compensation to the person harmed, not a regulator penalty.

What Sec. 44(2) of the DPDP Act actually changes

Sec. 44(2) amends the IT Act in three ways. Clause (a) omits section 43A. Clause (b) adds a reference to the DPDP Act in the proviso to section 81. Clause (c) omits clause (ob) of section 87(2). You can read all three in the bare Act.

The omission is the one that matters for compliance. Once it takes effect, the compensation route under section 43A is gone and the duties move to the DPDP Act. The Act is not in force in one stroke: Sec. 1(2) allows different dates for different provisions, so check the commencement notification for when Sec. 44(2) bites. The timeline page sets out the dates the Rules fix for the substantive duties.

Side by side: scope, trigger, duties

Scope of data. The SPDI Rules reached a list of sensitive categories. The DPDP Act reaches "digital personal data", meaning any data about an individual who is identifiable by or in relation to it, under Sec. 2(t) and 2(n). There is no sensitive tier.

Who is bound. Section 43A bound a body corporate. The DPDP Act binds a Data Fiduciary, which Sec. 2(i) defines as any person who alone or with others decides the purpose and means of processing. That includes individuals acting in a business capacity, firms and bodies that are not companies, and it reaches processing outside India connected with offering goods or services to people in India under Sec. 3(b). Whether you are caught is covered in does the DPDP Act apply to my organisation.

What triggers liability. Section 43A turned on negligence in security and resulting wrongful loss or gain. Under the DPDP Act, Sec. 8(5) requires reasonable security safeguards to prevent personal data breach, and the failure is itself penalisable, without proof that a particular person suffered a loss.

Beyond security. The SPDI Rules 2011 had partial analogues for sensitive data only: a privacy policy (Rule 4), written consent (Rule 5(1)), notice of purpose and recipients (Rule 5(3)), review and amendment of data (Rule 5(6)), an option to withdraw consent (Rule 5(7)) and a grievance officer (Rule 5(9)). The DPDP Act extends these to all digital personal data and adds withdrawal parity under Sec. 6(4), the Sec. 8(7) erasure duty, nomination under Sec. 14 and Board enforcement.

Penalties: compensation becomes a Board penalty

Under section 43A the remedy was compensation. Under the DPDP Act, the Data Protection Board may, under Sec. 33(1), impose a monetary penalty specified in the Schedule, but only after an inquiry concludes that a breach is significant and the person has been heard. The Schedule sets ceilings: up to 250 crore rupees for failing to take reasonable security safeguards under Sec. 8(5), and up to 200 crore rupees each for failing to notify a breach under Sec. 8(6) and for breaching the children's obligations under Sec. 9. The amount depends on the factors in Sec. 33(2), including the nature, gravity and duration of the breach, and whether the person mitigated its effects. Detail is in DPDP penalties.

The Schedule is a penalty table, not a compensation scheme: it does not hand money to the person harmed. Whether the DPDP Act leaves a person any route to compensation is a question for counsel; this page does not answer it.

Who wins when laws overlap

Sec. 38(1) says the DPDP Act is in addition to and not in derogation of any other law in force. Sec. 38(2) says that on a conflict the DPDP Act's provision prevails to the extent of the conflict. Two consequences follow. First, sector law that sets a retention period or a reporting duty still sits beside the Act; Sec. 8(7) itself accommodates retention "necessary for compliance with any law". Second, a rule in another law that is weaker than the Act on consent or notice does not protect you.

What to do if you built to the SPDI Rules

An SPDI-era programme gives you a head start on security and a privacy policy. It does not give you the rest. Four gaps are common:

1. Consent that was collected once, in bulk, for sensitive data only. Under Sec. 6(1) it must be specific to a purpose and limited to the data that purpose needs, for all personal data.
2. No withdrawal path. Sec. 6(4) requires withdrawal to be as easy as giving consent.
3. No breach intimation process. Sec. 8(6) and Rule 7 require intimation to the Board and to each affected Data Principal.
4. No answer to a rights request. Sec. 11 to 14 and Rule 14 expect one.

The DPDP compliance checklist takes these in order.