How the New Law Changes the IT Act

IT Act vs DPDP Act, 2023 (Part 1)

By Ajit Kakkar, Advocate | AgreyaLegal

This is Part 1 of a three-part series on IT Act compliance under the DPDP Act, 2023. Part 1: How the DPDP Act changes the IT Act (you are here) Part 2: Where your IT Act compliance helps Part 3: Where IT Act compliance falls short

Quick Summary for easy understanding

• The DPDP Act does not repeal the IT Act; the two laws run side by side.
• Section 43A of the IT Act and the SPDI Rules, 2011 end on 13 May 2027.
• The DPDP Act is added to the proviso to Section 81, so the IT Act’s overriding clause cannot restrict DPDP rights.
• Section 43 of the IT Act (unauthorised access) continues to apply.

---

Does Your Old Compliance Still Count?

For over a decade, Indian companies have built their privacy policies, security systems and internal codes around the Information Technology Act, 2000 (“IT Act”) and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”).

The Digital Personal Data Protection Act, 2023 (“DPDP Act”) changes the landscape. The Central Government notified the DPDP Rules, 2025 and the commencement notification (G.S.R. 843(E)) on 13 November 2025, starting a phased, 18-month rollout.

So every board, compliance officer and in-house counsel is asking: does the work we have already done count? The short answer is partly. This series explains why, beginning with how the DPDP Act actually changes the IT Act.

The constitutional foundation for all of this is the nine-judge decision in Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1, where the Supreme Court declared privacy a fundamental right under Article 21 and urged the State to create a robust data protection regime. The DPDP Act is the legislative response to that call. Ubi jus ibi remedium (where there is a right, there is a remedy).

---

DPDP Act Implementation Dates

Date	What comes into force
13 November 2025	Definitions, Data Protection Board (Sections 18–26), rule-making powers, and amendments to the TRAI Act and RTI Act (Section 44(1) and (3))
13 November 2026	Consent Manager provisions (Section 6(9))
13 May 2027	Core duties (Sections 3–17), penalties (Section 33), and IT Act amendments under Section 44(2), including omission of Section 43A

---

How the DPDP Act Changes the IT Act

The DPDP Act works in legislative harmony (consistent, side-by-side operation) with the IT Act. Section 44(2) makes three targeted changes, all effective from 13 May 2027.

1. Section 43A is omitted

Section 43A made a body corporate liable to pay compensation if it was negligent in maintaining “reasonable security practices” for sensitive personal data, causing wrongful loss or gain. Clause (ob) of Section 87(2), the rule-making power behind the SPDI Rules, is also omitted.

Result: the SPDI Rules stay in force until 13 May 2027 and lapse after that. Until then, companies must comply with both regimes.

2. Section 81’s proviso is widened

Section 81 gives the IT Act an overriding effect (it prevails over any inconsistent law). Its proviso already protected the Copyright Act, 1957 and the Patents Act, 1970 from this override. The DPDP Act is now added to that proviso, so the IT Act cannot be used to cut down rights under the DPDP Act.

This matters because the Supreme Court has given Section 81 real teeth. In Sharat Babu Digumarti v. Government (NCT of Delhi), (2017) 2 SCC 18, the Court held that the IT Act, as a special law with an overriding clause, prevails over the general law on the same subject. Lex specialis derogat legi generali (a special law overrides a general law). The amendment ensures the DPDP Act is not swallowed by that override.

3. Both laws run together

Section 38 of the DPDP Act states that it operates in addition to, and not in derogation of (without taking away from) any other law. Section 43 of the IT Act, CERT-In reporting, intermediary rules and retention duties all continue alongside the new regime.

---

What This Means for Your Business

• Before 13 May 2027: keep complying with Section 43A and the SPDI Rules, while preparing for the DPDP Act.
• After 13 May 2027: compensation claims under Section 43A end, but penalties under the DPDP Act begin, alongside surviving IT Act duties.
• Always: treat the two laws as parallel tracks, not as one replacing the other.

In Part 2, we look at the IT Act duties that give you a head start under the DPDP Act: security, incident reporting, retention and cross-border reach.

Read Part 2: Where Your IT Act Compliance Helps →

---

Frequently Asked Questions

1. Does the DPDP Act, 2023 repeal the IT Act, 2000? No. The DPDP Act makes only targeted amendments to the IT Act through Section 44(2), most importantly omitting Section 43A. Section 38 of the DPDP Act confirms that both laws run together.

2. Do companies still need to follow the SPDI Rules, 2011? Yes, until 13 May 2027. On that date, Section 43A and Section 87(2)(ob) of the IT Act are omitted, and the SPDI Rules lapse.

3. Does Section 43 of the IT Act still apply after the DPDP rollout? Yes. Only Section 43A is omitted. Unauthorised access, copying or damage by a third party remains actionable under Section 43, while the DPDP Act deals with the Data Fiduciary’s own failure to safeguard data.

---

This note is general information and is not legal advice. The law may have changed since it was written, and how it applies depends on the facts of each case.

All posts