India: IT Act and Related Rules
India is transitioning from a sectoral IT Act framework to an omnibus data protection statute.
IT Act layer
Section 43A provides compensation for failure to implement reasonable security practices for sensitive personal data or information (SPDI). Section 72A creates criminal liability for disclosing personal information in breach of contract. The SPDI Rules 2011 define SPDI to include passwords, financial data, health data, sexual orientation, and biometrics. They require consent for collection, a privacy policy, purpose limitation, a grievance officer, and transfer only with consent or comparable protection, plus breach notice to affected individuals. CERT-In directions (2022) require incident reporting within 6 hours.
DPDP Act 2023
Omnibus law using Data Principal, Data Fiduciary, Significant Data Fiduciary, Consent Manager, and the Data Protection Board. It requires consent plus legitimate uses, notice, security, breach notification to the Board and individuals, erasure, and grievance redressal. Cross-border transfers are permitted except to countries the Central Government restricts (a negative list). There is no SPDI category; higher obligations attach to children's data and significant fiduciaries.
Worked example
An Indian hospital app stores health records on a US cloud. Under the SPDI Rules, health data is SPDI, so export needs consent or comparable protection and a privacy policy. Under the DPDP Act, the transfer is allowed unless the US is restricted; the hospital still owes security and breach notice.
Traps
- Assuming "sensitive data" survives under the DPDP Act.
- Mixing section 43A compensation with section 72A criminal penalty.
- Missing CERT-In's 6-hour reporting.