Where Your IT Act Compliance Helps

By Ajit Kakkar, Advocate | AgreyaLegal New Delhi

This is Part 2 of a three-part series on IT Act compliance under the DPDP Act, 2023. Part 1: How the DPDP Act changes the IT Act Part 2: Where your IT Act compliance helps (you are here) Part 3: Where IT Act compliance falls short

Quick Summary

• Security systems built under Section 43A are a strong base for Section 8(5) of the DPDP Act.
• A working CERT-In reporting process is the backbone of a DPDP breach-response plan.
• Your Section 67C retention log helps decide what to keep and what to erase.
• Foreign companies serving Indian users were already within the reach of Indian law under Section 75.

Introduction

In Part 1, we saw that the DPDP Act does not replace the IT Act; the two run side by side, and Section 43A ends on 13 May 2027. The good news is that years of IT Act compliance are not wasted. In four areas, the groundwork you have already laid gives you a real head start.

1. Security Safeguards (Section 43A IT Act → Section 8(5) DPDP Act)

Section 43A required reasonable security practices for sensitive personal data. Section 8(5) of the DPDP Act requires reasonable security safeguards for all personal data, and Rule 6 of the DPDP Rules lists minimum measures such as encryption, access control, logging and backups.

Tribunals have already treated security lapses seriously. In IDBI Bank v. Ramesh Kumar Gupta (TDSAT, 2019), the appellate tribunal upheld compensation against a bank for failing to maintain a robust security system against phishing, holding that an entity handling sensitive data carries this duty without exception.

Takeaway: your existing encryption, access controls and ISO 27001-style policies are a strong foundation. Extend them to all personal data, not just SPDI.

Section 43 of the IT Act, which penalises unauthorised access, copying, damage or deletion of data, also remains fully in force.

2. Incident Reporting (Section 70B IT Act)

Under Section 70B and the CERT-In Directions of 28 April 2022, cyber incidents must be reported to CERT-In within six hours. Under Section 8(6) of the DPDP Act and Rule 7 of the DPDP Rules, a personal data breach must be reported to the Data Protection Board and to each affected Data Principal, with a detailed report to the Board within 72 hours.

Takeaway: a company already able to detect, escalate and report to CERT-In has the backbone of a DPDP breach process. Build one unified incident plan with two reporting tracks, rather than two separate plans. This avoids duplication (needless repetition of effort) and keeps your response consistent.

3. Data Retention (Section 67C IT Act)

Section 67C requires intermediaries to preserve specified information for the period the Central Government prescribes, with up to three years’ imprisonment and a fine for wilful breach. The DPDP Act requires erasure once the purpose is served (Section 8(7)), but allows retention where another law requires it.

Takeaway: your Section 67C retention log becomes a ready-made map of what must be kept and what must be deleted.

4. Cross-Border Reach (Section 75 IT Act → Section 3(b) DPDP Act)

Section 75 applies the IT Act to contraventions committed outside India involving a computer system located in India. Section 3(b) of the DPDP Act covers processing outside India connected with offering goods or services to Data Principals in India.

Indian courts have not hesitated to apply such reach. In Swami Ramdev v. Facebook Inc. (Delhi High Court, 2019), the Court directed global takedown of content uploaded from India, relying on the extra-territorial (beyond India’s borders) scope of the IT Act.

Takeaway: foreign companies serving Indian users have long been within the reach of Indian law. The DPDP Act makes that reach explicit for personal data.

Summary: What Carries Over

IT Act duty	DPDP Act equivalent	How much it helps
Section 43A security practices	Section 8(5), Rule 6 security safeguards	High, but extend to all personal data
Section 70B CERT-In reporting	Section 8(6), Rule 7 breach reporting	High, add Board and individual notices
Section 67C retention	Section 8(7) erasure, with legal-retention exception	Moderate, use as a retention map
Section 75 extra-territorial reach	Section 3(b) territorial scope	High, already applicable to foreign firms

But a head start is not the finish line. In Part 3, we examine the nine areas where IT Act compliance falls short, and what to do about each before 13 May 2027.

Read Part 3: Where IT Act Compliance Falls Short →

Frequently Asked Questions

1. Must a breach be reported to both CERT-In and the Data Protection Board? In most cases, yes. The two duties arise under separate statutes and serve different purposes: CERT-In handles cyber security incidents, while the Board handles personal data breaches. Further clarity is expected as the Board begins deciding cases.

2. Does the DPDP Act apply to foreign companies? Yes. Under Section 3(b), it applies to processing outside India if it is connected with offering goods or services to Data Principals in India.

3. Are security measures under Section 43A enough for the DPDP Act? They are a strong starting point, but Section 43A covered only sensitive data. The DPDP Act requires reasonable security safeguards for all personal data, with the minimum measures listed in Rule 6.

This note is general information and is not legal advice. The law may have changed since it was written, and how it applies depends on the facts of each case.

All posts