Section 43 IT Act: Compensation for failure to protect data

Section 43 of Information Technology Act: Compensation for failure to protect data

Official Bare Act Text

Override / Mandate Mens Rea (Intent) Actus Reus (Conduct) Punishment Limitation Monetary

If any person without permission of the owner or any other person who is in charge of a computer, computer system or computer network,—

(a) accesses or secures access to such computer, computer system or computer network;

(b) downloads, copies or extracts any data, computer data base or information from such computer, computer system or computer network including information or data held or stored in any removable storage medium;

(c) introduces or causes to be introduced any computer contaminant or computer virus into any computer, computer system or computer network;

(d) damages or causes to be damaged any computer, computer system or computer network, data, computer data base or any other programmes residing in such computer, computer system or computer network;

(e) disrupts or causes disruption of any computer, computer system or computer network;

(f) denies or causes the denial of access to any person authorised to access any computer, computer system or computer network by any means;

(g) provides any assistance to any person to facilitate access to a computer, computer system or computer network in contravention of the provisions of this Act, rules or regulations made thereunder;

(h) charges the services availed of by a person to the account of another person by tampering with or manipulating any computer, computer system, or computer network;

(i) destroys, deletes or alters any information residing in a computer resource or diminishes its value or utility or affects it injuriously by any means;

(j) steal, conceals, destroys or alters or causes any person to steal, conceal, destroy or alter any computer source code used for a computer resource with an intention to cause damage,

he shall be liable to pay damages by way of compensation to the person so affected.

Legal Commentary & Landmark Judgments: Section 43

Section 43 of the Information Technology Act (read with Section 43A) establishes statutory liability and uncapped compensation against corporate bodies for failure to protect sensitive personal data under 'reasonable security practices', and penalizes unauthorized access or disruption to computer systems.

Digital Infrastructure Jurisdiction: Section 43 creates comprehensive civil liability for cyber wrongs, while Section 43A imposes strict corporate liability for data breaches.
Core Legal Standard: Where a body corporate possessing, dealing, or handling sensitive personal data or information (SPDI) in a computer resource is negligent in implementing reasonable security practices (such as ISO 27001, encryption, and comprehensive data privacy controls) and thereby causes wrongful loss or wrongful gain, it is liable to pay damages by way of compensation to the affected person.

The Adjudicating Officer appointed under Section 46 possesses plenary powers of a civil court to assess damages and award multi-crore compensation without any statutory ceiling.

Key Landmark Precedents:

Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1: A historic Nine-Judge Constitution Bench recognized informational privacy as a fundamental right under Article 21, affirming that entities handling personal data are under a constitutional and statutory obligation of data protection and stewardship.
Syed Asifuddin v. State of Andhra Pradesh (2005 Cri LJ 4314): The High Court held that mobile networks, databases, and embedded system code fall within the definition of computer systems; unauthorized access or extraction of customer credentials constitutes a statutory wrong under the IT Act.

Legal Commentary:

Section 43 and 43A form the bedrock of cybersecurity compliance in India. Digital aggregators, commercial banks, and healthcare institutions face strict civil compensation claims before State IT Secretaries (acting as Adjudicating Officers) if customer passwords, Aadhaar data, or financial credentials are leaked due to substandard security.

Section 43: Compensation for failure to protect data

Section 43 of Information Technology Act: Compensation for failure to protect data

Legal Commentary & Landmark Judgments: Section 43