IT Act vs DPDP Act, 2023 (Part 3): Where IT Act Compliance Falls Short

By Ajit Kakkar, Advocate | AgreyaLegal, New Delhi

This is Part 3 of a three-part series on IT Act compliance under the DPDP Act, 2023. Part 1: How the DPDP Act changes the IT Act Part 2: Where your IT Act compliance helps Part 3: Where IT Act compliance falls short (you are here)

Quick Summary

• The DPDP Act covers all digital personal data, not just “sensitive” data.
• It adds new duties on consent, individual rights, children’s data, erasure, vendors and Significant Data Fiduciaries.
• Penalties rise to ₹250 crore, and IT Act safe harbour does not protect against DPDP liability.
• A ten-step checklist to close the gaps before 13 May 2027.

Introduction

In Part 2, we saw where IT Act compliance gives you a head start. But the DPDP Act is purposely wide, and in nine areas your existing compliance simply does not reach. Here they are, each with the action required.

1. Scope: All Personal Data, Not Just “Sensitive” Data

The SPDI Rules applied to body corporates and focused on a closed list of “sensitive” data such as passwords, financial and health information. The DPDP Act applies to all digital personal data (and non-digital data later digitised), however ordinary, such as a name or a phone number, processed in India, irrespective of the Data Principal’s nationality.

2. Notice and Consent

The SPDI Rules required a privacy policy and written consent only for sensitive data. Under Sections 5 and 6 of the DPDP Act, consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. Rule 3 requires a standalone, plain-language notice. Pre-ticked boxes and implied consent will not qualify.

Courts flagged the weakness of “take it or leave it” consent long before the DPDP Act. In Karmanya Singh Sareen v. Union of India, (2016) 233 DLT 436 (Del), the Delhi High Court restrained WhatsApp from sharing data of users who exited the service before its 2016 policy change; the matter is now pending before a Constitution Bench of the Supreme Court. Volenti non fit injuria (no wrong is done to one who consents) holds only where the consent is genuine.

Action: redesign consent notices and privacy policies.

3. Rights of Individuals

The SPDI Rules offered limited rights, such as reviewing and withdrawing consent. Sections 11 to 14 of the DPDP Act give Data Principals the rights to access, correction, completion, erasure, grievance redressal and nomination.

The courts had already recognised the right to erasure in substance. In Zulfiqar Ahman Khan v. Quintillion Business Media (Delhi High Court, 2019) and Jorawer Singh Mundy v. Union of India (Delhi High Court, 2021), the Court recognised the “right to be forgotten” as part of the right to privacy and directed removal of online content.

Action: set up request-handling workflows, timelines and records.

4. Children’s Data

The IT Act framework has no specific protection for children. Section 9 of the DPDP Act and Rule 10 require verifiable parental consent before processing a child’s data and prohibit tracking, behavioural monitoring and targeted advertising directed at children.

In the Aadhaar judgment, Justice K.S. Puttaswamy (Retd.) v. Union of India, (2019) 1 SCC 1, the Supreme Court held that enrolment of children requires parental consent and that children must be allowed to exit on attaining majority.

Action: deploy age-assurance and parental-verification systems.

5. Data Erasure

The IT Act has no general rule requiring deletion once data is no longer needed. The DPDP Act does (Section 8(7)), and Rule 8 adds time-bound erasure for certain large platforms after a period of user inactivity, with prior notice to the user. Cessante ratione legis, cessat ipsa lex (when the reason for a rule ends, the rule itself ends): when the purpose ends, the data should go.

The Aadhaar judgment anticipated this too, reading down the retention of authentication records and stressing data minimisation (collecting only what is needed) and storage limitation.

Action: create retention schedules and automated deletion routines.

6. Vendors and Data Processors

The IT Act does not regulate the relationship between a data owner and its vendors. Under Section 8(1) and 8(2) of the DPDP Act, the Data Fiduciary remains responsible for processing done on its behalf, and may engage a Processor only under a valid contract. Qui facit per alium facit per se (he who acts through another acts himself).

Action: revise vendor contracts with clear security, breach-notice, audit and deletion clauses.

7. Significant Data Fiduciaries

The IT Act imposes no extra duties on large or high-risk data handlers. Section 10 of the DPDP Act and Rule 13 require Significant Data Fiduciaries to appoint a Data Protection Officer based in India, an independent data auditor, and to conduct annual Data Protection Impact Assessments and audits, from 13 May 2027.

8. Penalties: A Huge Jump

Under Section 46 of the IT Act, an Adjudicating Officer decides compensation claims up to ₹5 crore (larger claims go to civil courts). This is a compensatory model. Under Section 33 and the Schedule of the DPDP Act, the Data Protection Board can impose penalties of up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore for failing to report a breach or for breaching child-data duties. The money goes to the Consolidated Fund of India, not to the victim.

9. Safe Harbour Does Not Carry Over

Section 79 of the IT Act protects intermediaries from liability for third-party content if they observe due diligence. The Supreme Court in Shreya Singhal v. Union of India, (2015) 5 SCC 1, read down Section 79 so that intermediaries must act on actual knowledge through a court order or government notification. The Bombay High Court in Kunal Kamra v. Union of India (2024) struck down the government “fact check unit” rule, reinforcing that safe harbour cannot be diluted by executive rules.

But the DPDP Act has no equivalent safe harbour. An intermediary that decides the purpose and means of processing its users’ data is a Data Fiduciary for that data and bears full DPDP obligations.

IT Act vs DPDP Act: Comparison at a Glance

Issue	IT Act, 2000 / SPDI Rules, 2011	DPDP Act, 2023 / DPDP Rules, 2025
Data covered	Sensitive personal data only	All digital personal data
Consent	Written consent for SPDI	Free, specific, informed, unambiguous, affirmative
Individual rights	Review, withdraw	Access, correction, erasure, grievance, nomination
Children	No specific rule	Verifiable parental consent, no tracking or targeted ads
Erasure	No general rule	Mandatory once purpose is served
Vendors	Not regulated	Fiduciary liable; written contract needed
Large data handlers	No extra duties	SDF: DPO, audits, DPIA
Breach reporting	CERT-In (6 hours)	Board and affected persons (detailed report in 72 hours)
Consequence	Compensation up to ₹5 crore before AO	Penalty up to ₹250 crore by the Board

Practical Compliance Checklist Before 13 May 2027

1. Map your data: list all personal data, not only SPDI.
2. Redesign notices and consent flows: clear, standalone, plain language; no pre-ticked boxes.
3. Extend security controls from SPDI to all personal data, in line with Rule 6.
4. Build one incident plan with two tracks: CERT-In and the Data Protection Board.
5. Set retention and deletion schedules, using your Section 67C log as a starting point.
6. Create rights-request workflows for access, correction and erasure.
7. Introduce age assurance and parental consent where children use your service.
8. Revise all vendor and processor contracts.
9. Assess whether you may be notified as a Significant Data Fiduciary.
10. Train staff and document everything. Ignorantia juris non excusat (ignorance of the law is no excuse).

Conclusion to the Series

The DPDP Act and the IT Act are built to work side by side, not to replace each other. Your existing security protocols, incident response systems and privacy policies are valuable assets that will reduce the effort of DPDP compliance. But they are a starting point, not the finish line.

The DPDP Act demands clearer consent, tighter data handling, real rights for individuals and far heavier consequences for failure. With 13 May 2027 approaching, companies that begin their gap analysis now will be best placed to meet the deadline and to earn the trust of the people whose data they hold.

Missed the earlier parts? Read Part 1 and Part 2.

For advice on DPDP Act gap assessments, policy redesign, vendor contracts or breach-response planning, contact AgreyaLegal, New Delhi 

Frequently Asked Questions

1. If a company is IT Act and SPDI compliant, is it DPDP compliant? No. SPDI compliance is a useful base, but the DPDP Act covers all personal data and adds new duties on consent, rights, children’s data, erasure, vendors and Significant Data Fiduciaries.

2. What is the maximum penalty under the DPDP Act? Up to ₹250 crore per instance for failing to take reasonable security safeguards to prevent a personal data breach.

3. Is a company liable for a data breach caused by its vendor? Yes. Under Section 8(1) of the DPDP Act, the Data Fiduciary remains responsible for processing done on its behalf by a Data Processor.

4. Do pre-ticked consent boxes count under the DPDP Act? No. Consent must be given by a clear affirmative action under Section 6, so pre-ticked boxes and implied consent will not qualify.

This note is general information and is not legal advice. The law may have changed since it was written, and how it applies depends on the facts of each case.

All posts