Data protection law in India has changed significantly, and many students and professionals still confuse the old framework with the new one. Understanding IT Act vs DPDP Act is essential today, since both statutes deal with digital information but serve very different purposes. The Information Technology Act, 2000 was India’s first major cyber law, built primarily to give legal recognition to electronic transactions and address cyber crimes. The Digital Personal Data Protection Act, 2023, known as the DPDP Act, is India’s first dedicated personal data protection law, focused specifically on how personal data is collected, used, and stored. This article is written mainly for law students and legal professionals who need clarity on how these two laws interact, though anyone curious about their digital rights will find it useful.
Background and Context
The IT Act, 2000 was enacted to support e-commerce and give legal validity to electronic records and digital signatures. It also introduced cybercrime provisions, but its data protection coverage was limited to a few sections and subordinate rules. The DPDP Act, 2023 was passed after years of deliberation following the recognition of privacy as a fundamental right, and it replaces the earlier data protection framework that existed only through IT Act rules.
Key Provisions of the IT Act, 2000
- Section 43A: Requires body corporates handling sensitive personal data to maintain reasonable security practices, and makes them liable to pay compensation for negligence causing wrongful loss. ‘
- Section 66: Punishes computer related offences such as hacking, with imprisonment up to three years or fine.
- Section 66C: Punishes identity theft, including fraudulent use of another person’s password or unique identification.
- Section 66E: Punishes violation of privacy, such as capturing or publishing images of a person’s private area without consent.
- Section 72: Punishes breach of confidentiality and privacy by persons who access electronic records under statutory powers.
- Section 79: Provides safe harbour to intermediaries, meaning platforms are not liable for third party content if they follow due diligence rules.
Key Provisions of the DPDP Act, 2023
- Section 2: Defines key terms such as “data fiduciary”, meaning the entity deciding the purpose of processing personal data, and “data principal”, meaning the individual to whom the data relates.
- Section 4 to 6: Lay down the grounds for lawful processing, primarily consent, and specify that consent must be free, specific, informed, and unambiguous.
- Section 8: Places obligations on data fiduciaries, including ensuring data accuracy and implementing reasonable security safeguards.
- Section 9: Provides special protection for children’s data, requiring verifiable parental consent before processing.
- Section 11 to 14: Grant rights to data principals, including the right to access information, the right to correction and erasure, and the right to grievance redressal.
- Section 16: Empowers the central government to restrict cross border transfer of personal data to certain countries.
- Section 25 to 26: Establish the Data Protection Board of India to handle complaints and impose penalties.
Comparing the Two Laws
| Feature | IT Act, 2000 | DPDP Act, 2023 |
|---|---|---|
| Primary Purpose | Legal recognition of electronic records and cyber crime | Protection of personal data of individuals |
| Scope | Broad, covers e-commerce, digital signatures, cyber offences | Narrow and focused, covers only personal data processing |
| Regulator | Ministry of Electronics and Information Technology, CERT-In | Data Protection Board of India |
| Consent Requirement | Not explicitly mandated for all data | Mandatory, informed consent central to processing |
| Penalty Structure | Fine or imprisonment depending on offence | Monetary penalty up to 250 crore rupees for serious breaches |
| Children’s Data | No specific provision | Verifiable parental consent required under Section 9 |
Rights and Obligations at a Glance
Under the DPDP Act, individuals hold rights such as:
- Right to obtain a summary of personal data being processed.
- Right to correction and erasure of inaccurate or outdated data.
- Right to nominate another person to exercise rights in case of death or incapacity.
- Right to file a complaint with the Data Protection Board.
Data fiduciaries, in turn, must:
- Notify individuals of data breaches without undue delay.
- Implement reasonable security safeguards to prevent breaches.
- Appoint a Data Protection Officer if classified as a significant data fiduciary.
Procedure for Grievance Redressal
The DPDP Act creates a structured complaint process. A data principal first raises a grievance with the data fiduciary directly. If unresolved, the complaint can be escalated to the Data Protection Board of India, which has powers similar to a civil court to investigate and impose penalties.
Penalties Under Both Laws
Penalties under the IT Act depend on the specific offence and can include both imprisonment and fine. Penalties under the DPDP Act are purely monetary, but can be substantial, going up to 250 crore rupees for failure to take reasonable security measures leading to a data breach, and up to 200 crore rupees for non-compliance with obligations relating to children’s data.
Frequently Asked Questions
No, it replaces only the data protection related rules under the IT Act, while cyber crime and intermediary provisions of the IT Act continue to apply.
Consent is the primary ground, but processing is also allowed for certain legitimate uses specified under the Act, such as compliance with law or medical emergencies.
The Data Protection Board of India, established under the Act, handles enforcement and complaints.
Yes, it applies to processing of personal data of individuals in India even if the processing entity is located outside India, if it involves offering goods or services in India.
It must notify affected individuals and the Data Protection Board without undue delay, as required under the Act.
Overlap is possible, but each law addresses different aspects, meaning the IT Act may apply to the cyber crime element while the DPDP Act addresses the data protection failure.
Want to dive deeper? Check out this resource for more insights.
