Save as otherwise provided in this Act or any other law for the time being in force , any person who, in pursuance of any of the powers conferred under this Act, rules or regulations made thereunder, has secured access to any electronic record, book, register, correspondence, information, document or other material without the consent of the person concerned discloses such electronic record, book, register, correspondence, information, document or other material to any other person shall be punished with imprisonment for a term which may extend to two years , or with fine which may extend to one lakh rupees , or with both.
Legal Commentary & Landmark Judgments: Section 72
Section 72 of the Information Technology Act prescribes criminal penalties of imprisonment up to two years and fine up to one lakh rupees for breach of confidentiality and unauthorized disclosure of electronic records in breach of lawful contract.
Section 72A extends this to service providers who, having secured access to personal information while providing services under a contract, disclose such information without consent or in breach of the lawful contract, causing wrongful loss or wrongful gain.
Section 72A is the primary statutory weapon used against rogue BPO employees, call center executives, and cloud service technicians who steal, leak, or sell customer databases to third-party telemarketers or competitors in breach of non-disclosure agreements (NDAs).