Data protection in cyberspace — Intellectual Property Rights I Notes

Data protection in cyberspace

In 2011 a Pune call-centre worker sold thousands of customers’ credit-card details for a few thousand rupees. The victims had never met the seller and lived in another country — yet Indian law had to answer for the leak. Data protection is the law that makes the holder of your personal data responsible for keeping it safe.

What data protection means

Data protection is the body of law that regulates how personal and sensitive data is handled — collected, stored, processed and shared — and protects individuals against its misuse. In cyberspace, where vast quantities of personal data (names, passwords, financial and health details) are held by companies, the risk of leaks, theft and misuse is enormous — so the law imposes duties on those who hold the data.

Under the IT Act, 2000:

s.43A — where a body corporate handling sensitive personal data is negligent in maintaining reasonable security practices and thereby causes wrongful loss or gain, it is liable to pay compensation to the affected person.
s.72 — a person who, having secured access to records under the Act, discloses them without consent, is punishable (up to 2 years or fine).
s.72A — disclosure of personal information in breach of a lawful contract is an offence (up to 3 years or fine up to ₹5 lakh).
The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 define “sensitive personal data” (passwords, financial data, health, biometrics, etc.) and prescribe security standards.

⚠️ The IT Act’s data-protection provisions are now supplemented by the Digital Personal Data Protection Act, 2023 — India’s first dedicated data-protection statute, which creates enforceable rights of data principals and duties of data fiduciaries. Do not describe s.43A as India’s only data-protection law; mention the 2023 Act as the modern framework.

Information Technology Act, 2000, s.43A: “Where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate shall be liable to pay damages by way of compensation to the person so affected.”

In Simple Terms: Data protection makes the companies that hold your personal information responsible for keeping it safe. Under the IT Act, a careless company that leaks sensitive data must pay compensation (s.43A), and wrongful disclosure is an offence (ss.72, 72A). The new Digital Personal Data Protection Act, 2023 is India’s dedicated data-protection law.

🧩 WORKED EXAMPLE — the leaked customer database

Facts. A company stores customers’ financial data without proper security; a hacker steals it and customers suffer loss.

Rule. s.43A — a body corporate negligent in maintaining reasonable security practices over sensitive personal data must compensate those harmed.

Apply. The company handled sensitive financial data, failed to keep reasonable security, and its negligence caused wrongful loss to customers — every element of s.43A is met.

Conclusion. The company is liable to pay compensation under s.43A (and the affected persons now also have rights under the DPDP Act, 2023).

flowchart TD
    DP["Data protection in cyberspace"]:::root
    DP --> S43A["s.43A — compensation for negligent security"]:::leaf
    DP --> S72["ss.72, 72A — offence to disclose without consent / in breach"]:::leaf
    DP --> RULES["SPDI Rules, 2011 — define sensitive data & standards"]:::leaf
    DP --> DPDP["Digital Personal Data Protection Act, 2023 — dedicated law"]:::leaf
    classDef root fill:#FFF8DC,stroke:#000,color:#000;
    classDef leaf fill:#E6F3FF,stroke:#1E3A8A,color:#000;

Case Laws

Justice K.S. Puttaswamy v Union of India (2017) — the Supreme Court held informational privacy to be a fundamental right, the constitutional foundation of data-protection law.
Shreya Singhal v Union of India (2015) — read down s.79 and the intermediary rules, shaping how data held by intermediaries is regulated.

📄 Full notes + Question Bank (₹199) — every topic in depth, model answers to all past KSLU questions, in one printable PDF. Get the bundle · 10 Solved Problems · All Intellectual Property Rights I topics