Data Protection Laws in India
Written By
Koustubh Athavale
Share
-
Link copied to clipboard!https://treelife.in/legal/data-protection-laws-in-india/
-
-
-
-
AI Summary
- India currently lacks a single comprehensive data protection statute, though the Information Technology Act, 2000 and the IT Rules serve as the primary legislative safeguards for data privacy.
- Section 43A of the IT Act (inserted by the 2008 amendment) addresses unauthorized access and leakage of sensitive personal information, with claims up to ₹5 crore heard by an Adjudicating Officer and claims exceeding ₹5 crore heard by a competent court.
- Appeals against orders under Section 43A lie with the Cyber Appellate Tribunal.
- Section 72A of the IT Act penalizes disclosure of personal information in breach of a lawful contract.
- The Supreme Court first recognized data protection as part of the right to privacy in the 2017 Aadhaar judgment, directing the government to enact dedicated data protection legislation.
- The Puttaswamy judgment established the right to privacy as a fundamental right under the Indian Constitution, forming the constitutional basis for subsequent data protection bills.
- The Personal Data Protection Bill, 2018, drafted by a committee headed by retired Chief Justice B N Srikrishna, was later withdrawn by the Ministry of Electronics and Information Technology (MeitY).
- The Digital Personal Data Protection Bill, 2022 was released in November 2022 for public comments and sets out obligations for Data Fiduciaries, cross-border data transfer provisions, and penalties for contravention.
- The 2022 Bill defines a child as a person under 18 years and mandates parental consent for collecting a child's personal data.
Blog Content Overview
India’s Growth Brings Data Privacy and Protection into Focus: Understanding the Current Data Protection and Privacy Laws in India
India has rapidly grown in technology and economy, but this growth has also brought up the issue of data privacy and protection. Unfortunately, India has lacked any substantive legislative framework focusing primarily on data privacy and protection privacy laws in India. However, the government has formed a committee of experts to draft a data protection bill. The first bill in 2006 was based on the European data privacy directive, highlighting the need for stronger laws like the data protection laws in Europe.
Current Legislative Safeguards: IT Act and IT Rules
Data protection safeguards in India are mainly provided by the Information Technology (IT) Act, 2000, and IT Rules, which constitute inter-alia, the data privacy laws in India. These regulations provide the basic legislative safeguards for data security, privacy, and protection in India. The amendment of IT Act, 2008 added Sections 43A and 72A. Section 43 and 43A deal with unauthorized access of information and leakage of sensitive personal information while the Adjudicating officer (when claim or damages amounts upto 5 crores) or competent court (where claim exceeds beyond 5 crores) appointed under the Act can handle such cases and any appeal from such order passed shall lie with the Cyber Appellate Tribunals. Section 72 deals with disclosure of information in breach of contract and punishment for it, underlining the importance of data privacy regulations in India.
Judicial Safeguards After the AADHAR Judgment: The Need for Personal Data Protection
Data protection was first recognized by the Supreme Court in 2017 in the Aadhar Judgment, emphasizing the need for stronger data privacy laws. The court demanded the enactment of a proper legislation on data protection which should conform with the right to privacy of the individual, and the Personal Data Protection Bill, 2018 was created after this judgment. However, the same has been withdrawn and a new bill – Digital Personal Data Protection Bill, 2022 (2022 Bill) has been released in November 2022 for inviting comments from public. The 2022 Bill recognizes various rights and duties of the citizen and the obligations of the Data Fiduciary to use the collected data lawfully extending to include data collected for offshore/ cross border arrangements, and lays out the penalty for contravention.
Data Protection Bill 2022: The Need for Stronger Data Protection Laws
The committee of experts headed by retired Chief Justice BN Srikrishna had drafted the Personal Data Protection Bill in 2018. However, considering the ever evolving technology and data breaches and the increasing number of citizens using and relying on digital platforms, the Ministry of Electronics and Information Technology (MeitY) withdrew the 2018 Bill and replaced it with the comprehensive 2022 Bill. The Bill also defines a child (person under the age of 18 years) and states that parents’ consent is required for data collection from a child.
In Conclusion: Balancing Data Protection and Growth
According to the Supreme Court in the Puttaswamy judgment, the right to privacy is a fundamental right. The government policy on data protection must not dissuade framing any policy for the growth of the digital economy, to the extent that it doesn’t infringe on personal data privacy. India has one of the world’s largest population and a lot of sectors are unorganised and data is easily breached. As businesses operate in a globalized world, there is also a need to follow international data protection laws. Therefore, understanding right to privacy and data protection in India is crucial as we move towards a digitalized future. The establishment of a data protection authority and regularising how data is collected and used in India will go a long way in achieving this balance between data protection and growth.
FAQ’s
A: In India, sharing personal data without permission is not legal. The Information Technology (IT) Act, 2000, and IT Rules, 2011, provide the basic legislative safeguards for data security, privacy, and protection in India.
Q: Is data sharing legal in India?
A: Data sharing is legal in India, but only if the consent of the individuals whose data is being shared has been obtained prior. The Digital Personal Data Protection Bill, 2022, aims to enhance data protection in India by providing a framework for securing personal data, regulating its processing, and preventing misuse.
Q: Why is data privacy important?
A: Data privacy is important because it ensures that individuals have control over their personal information and can decide who can access it, how it is used, and for what purpose. Data privacy also plays an important role in preventing identity theft, fraud, and other forms of cybercrime.
Q: What are the 7 rules of data protection?
A: The 7 rules of data protection are transparency, accountability, purpose limitation, data minimization, accuracy, storage limitation, and security. Transparency involves informing individuals how their data is used, while accountability refers to taking responsibility for processing the data. Purpose limitation means that personal data collection and processing should only be done for specific, legitimate purposes. Data minimization aims to ensure that only the minimum amount of data is collected and processed. Accuracy involves ensuring that personal data is correct and up-to-date. Storage limitation refers to the idea that personal data should only be kept for as long as necessary. Finally, security involves protecting personal data against unauthorized access, loss, or damage.
About the Author
Share
-
Link copied to clipboard!https://treelife.in/legal/data-protection-laws-in-india/
-
-
-
-
Koustubh Athavale
Senior Associate | Legal | koustubh.a@treelife.in
Provides expertise in commercial contracts, dispute resolution, and data privacy. Leverages extensive experience in the startup ecosystem to deliver tailored legal solutions for diverse business needs.
We Are Problem Solvers. And Take Accountability.
Related Posts
Data Fiduciary vs Data Processor: Redrafting Your B2B Vendor DPAs Under the DPDP Act 2023
Most Indian B2B contracts signed before 2024 were not written with the Digital Personal Data Protection Act, 2023 in mind....
Learn More
Who Owns the Prompt? Modifying Employee IP Assignment Clauses for the GenAI Era
Most Indian employment agreements assign to the employer everything an employee creates, develops, or invents during employment. That clause was...
Learn More
The AI Indemnity Trap: Negotiating Liability When Third-Party Algorithms Hallucinate
Every founder who has embedded a third-party AI model into their product has read an indemnity clause that sounds reassuring....
Learn More
© 2026 Treelife Ventures Services Private Limited. All Rights Reserved.