Section 43A explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Section 43A of the Information Technology Act, 2000 makes a body corporate liable to pay damages by way of compensation if it is negligent in implementing and maintaining reasonable security practices and procedures for sensitive personal data or information and thereby causes wrongful loss or wrongful gain to any person. Section 44(2)(a) of the Digital Personal Data Protection Act, 2023 provides that section 43A "shall be omitted".
As printed in the consolidated copy: a body corporate that possesses, deals with or handles sensitive personal data or information in a computer resource which it owns, controls or operates, and is negligent in implementing and maintaining reasonable security practices and procedures, thereby causing wrongful loss or wrongful gain to any person, is liable to pay damages by way of compensation to the person so affected. As amended by section 44 of the Digital Personal Data Protection Act, 2023: "section 43A shall be omitted". No amount is printed in section 43A.
Source and scope
This article follows the consolidated text consulted (the Act as amended by the Information Technology (Amendment) Act, 2008). Later amendments and the current position of the section should be checked. The section is printed in square brackets in the copy, as the 2008 insertion. The amendment is applied below from the text of section 44(2) of the Digital Personal Data Protection Act, 2023. If your business handles customer or employee information and wants its security arrangements reviewed, a legal due diligence review is a practical step.
Section 43A as printed in the consolidated copy
"Where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate shall be liable to pay damages by way of compensation to the person so affected."
The conditions, taken one by one:
| Element | What the words say |
|---|---|
| Who | A body corporate |
| What it holds | Sensitive personal data or information, "possessing, dealing or handling" |
| Where | In a computer resource which it owns, controls or operates |
| Fault | Negligent in implementing and maintaining reasonable security practices and procedures |
| Harm | Wrongful loss or wrongful gain to any person |
| Consequence | Liable to pay damages by way of compensation to the person so affected |
All the elements must be present. A security lapse that causes neither wrongful loss nor wrongful gain does not meet the harm element. The text prints no amount or ceiling for the compensation, and this article states none.
The Explanation
The section has an Explanation with three definitions:
- Body corporate means "any company and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities". So the term is wider than a company.
- Reasonable security practices and procedures means security practices and procedures designed to protect such information from unauthorized access, damage, use, modification, disclosure or impairment, "as may be specified in an agreement between the parties or as may be specified in any law for the time being in force and in the absence of such agreement or any law, such reasonable security practices and procedures, as may be prescribed by the Central Government in consultation with such professional bodies or associations as it may deem fit". The order is: first the agreement between the parties, then any law in force, then, failing both, what the Central Government prescribes.
- Sensitive personal data or information means "such personal information as may be prescribed by the Central Government in consultation with such professional bodies or associations as it may deem fit". The detail is left to rules. The rules are not in the sources used for this article and no category of information is named here.
Our practical posts on reasonable security safeguards under section 8 of the DPDP Act and the DPDP compliance checklist for businesses discuss security duties under that separate Act.
Section 43A as amended by the Digital Personal Data Protection Act, 2023
Section 44(2) of the Digital Personal Data Protection Act, 2023 says: "The Information Technology Act, 2000 shall be amended in the following manner, namely:— (a) section 43A shall be omitted; ... and (c) in section 87, in sub-section (2), clause (ob) shall be omitted."
| As printed in the consolidated copy | As amended by section 44(2) of the Digital Personal Data Protection Act, 2023 | |
|---|---|---|
| Section 43A | Body corporate liable to pay damages by way of compensation for negligence in security practices causing wrongful loss or gain | "section 43A shall be omitted" |
| Section 87(2)(ob) | "the reasonable security practices and procedures and sensitive personal data or information under section 43-A" appears among the matters on which the Central Government may make rules | "clause (ob) shall be omitted" |
Clause (ob) of section 87(2) is the rule-making clause that matches section 43A; see our article on sections 86 and 87: removal of difficulties and rules.
Commencement. Section 1(2) of the Digital Personal Data Protection Act, 2023 provides that it comes into force on a date the Central Government appoints by notification, and different dates may be appointed for different provisions. The Act commences in stages, and no date for section 44 is in the sources used here. This article does not say which of the two versions is in force. Check whether section 44(2) has been brought into force before relying on section 43A or on its omission. Our post on section 44 of the Digital Personal Data Protection Act, 2023: amendments to the IT Act, RTI Act and TRAI Act looks at that section of the other Act.
How section 43A relates to section 43
Section 43 (see our article on section 43: compensation for damage to a computer and unauthorised access) lists acts done by a person without permission. Section 43A is different in kind: it concerns a body corporate's negligence in keeping security practices for sensitive data it holds. Section 43 prints no amount; neither does section 43A.
Why the elements matter in practice
- Negligence is the standard; the section does not speak of intention.
- "Reasonable" security practices are measured first against the parties' agreement, so a written contract with customers or vendors matters. See our guide on a data processing agreement template under the DPDP Act for how contracts deal with security obligations in that Act's context.
- "Wrongful loss or wrongful gain" must be shown for the claim.
- The computer resource must be one the body corporate owns, controls or operates.
A worked example
Sunrise Health Labs Private Limited stores patient records on its own server. The contract with its partner clinics says that records must be encrypted at rest. A staff member leaves a backup unencrypted, and a third party obtains it, causing a patient wrongful loss. On the words of the printed section, Sunrise is a body corporate; patient records could be sensitive personal data or information if so prescribed; the computer resource is one it owns, controls or operates; the agreement between the parties is the first measure of "reasonable security practices and procedures"; and, if Sunrise was negligent and wrongful loss followed, it would be liable to pay damages by way of compensation to the patient. Whether section 43A is in force in that form, or has been omitted by section 44(2)(a) of the Digital Personal Data Protection Act, 2023, is a matter to check at the date of the event.
Need help with data security obligations?
If your company holds customer, employee or patient information, we can review your contracts and security arrangements against both section 43A as printed and the amendment. Ask for a legal due diligence review and bring your security policy and key contracts.
Key takeaways
- Section 43A as printed makes a negligent body corporate liable to pay compensation where wrongful loss or wrongful gain follows.
- "Body corporate" includes a firm, sole proprietorship or association engaged in commercial or professional activities.
- Reasonable security practices are measured first by agreement, then by law, then by what is prescribed.
- Section 44(2)(a) of the Digital Personal Data Protection Act, 2023 provides that section 43A shall be omitted, together with clause (ob) of section 87(2).
- Commencement is by notification in stages; no date is in the sources, so check before relying on either version.
Read next
- Section 43: compensation for damage to a computer and unauthorised access
- Sections 86 and 87: removal of difficulties and Central Government rules
- Section 44 of the Digital Personal Data Protection Act, 2023: amendments to the IT Act, RTI Act and TRAI Act
- Introduction to the Digital Personal Data Protection Act, 2023
Disclaimer: Based on a consolidated copy of the Information Technology Act, 2000 as amended by the Information Technology (Amendment) Act, 2008, on the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 as originally notified on 25 February 2021 and on the CERT-In Directions of 28 April 2022, read with the amendments made to the Act by the Jan Vishwas (Amendment of Provisions) Act, 2023 and by section 44 of the Digital Personal Data Protection Act, 2023, as consulted on 2 October 2026. Commencement notifications, other amendments, rules, directions and the current position of each provision are not covered and should be checked. This article is general information, not legal advice; check the official text before acting.