Chapter I II III IV V VI VII VIII IX X
Sections 1-3 4-11 12-17 18-22 23 24-28 29-39 40-41 42-48 49-68
Title Preliminary Data Protection Obligations Grounds for Processing Personal Data Grounds for processing Sensitive personal Data Personal and Sensitive Personal Data of Children Data Principal Rights Transparency and Accountability Measures Transfer of Personal data outside India Exemptions Data Protection Authority of India
Chapter XI XII XIII XIV XV   Schedule 1 Schedule 2    
Sections 69-78 79-89 90-96 97 98-112          
Title Penalties and Remedies Appellate Tribunal Offences Transitional Provisions Miscellaneous Preamble Amendment to ITA 2000 Amendment to RTI Act 2005 PDF Copy of the Proposed Act Srikrishna Committee Report

CHAPTER XIII

CHAPTER XIII OFFENCES

90. Obtaining, transferring or selling of personal data contrary to the Act.—

Any person who alone or jointly with others, knowingly or intentionally or recklessly, in contravention of the provisions of this Act—

(a) obtains personal data; or

(b) discloses personal data; or

(c) transfers personal data to another person; or

(d) sells or offers to sell personal data to another person, which results in significant harm to a data principal, then such person shall be punishable with imprisonment for a term not exceeding three years or shall be liable to a fine which may extend up to rupees two lakh or both.


91. Obtaining, transferring or selling of sensitive personal data contrary to the Act.—

Any person who alone or jointly with others, knowingly or intentionally or recklessly, in contravention of the provisions of this Act—

(a) obtains sensitive personal data; or

(b) discloses sensitive personal data; or

(c) transfers sensitive personal data to another person; or

(d) sells or offers to sell sensitive personal data to another person,

which results in harm to a data principal, then such person shall be punishable with imprisonment for a term not exceeding five years or shall be liable to a fine which may extend up to rupees three lakhs or both.


92. Re-identification and processing of de-identified personal data. —

(1) Any person who, knowingly or intentionally or recklessly—

(a) re-identifies personal data which has been de-identified by a data fiduciary or a data processor, as the case may be; or

(b) re-identifies and processes such personal data as mentioned in clause (a) without the consent of such data fiduciary or data processor, then such person shall be punishable with imprisonment for a term not exceeding three years or shall be liable to a fine which may extend up to rupees two lakh or both.

(2) Nothing contained in sub-section (1) shall render any such person liable to any punishment provided under this section, if she proves that—

(a) the personal data belongs to the person charged with the offence under sub-section (1); or

(b) the data principal whose personal data is in question has explicitly consented to such re-identification or processing as per the provisions of this Act.


93. Offences to be cognizable and non-bailable.—

Notwithstanding anything contained in the Code of Criminal Procedure, 1973 (2 of 1974), an offence punishable under this Act shall be cognizable and non-bailable.


94. Power to investigate offences.—

Notwithstanding anything contained in the Code of Criminal Procedure, 1973 (2 of 1974), a police officer not below the rank of Inspector shall investigate any offence under this Act.


95. Offences by companies.—

(1) Where an offence under this Act has been committed by a company, every person who, at the time the offence was committed was in charge of, and was responsible to, the company for the conduct of the business of the company, as well as the company, shall be deemed to be guilty of the offence and shall be liable to be proceeded against and punished accordingly.

(2) Nothing contained in sub-section (1) shall render any such person liable to any punishment provided in this Act, if she proves that the offence was committed without her knowledge or that she had exercised all due diligence to prevent the commission of such offence.

(3) Notwithstanding anything contained in sub-section (1), where an offence under this Act has been committed by a company and it is proved that the offence has been committed with the consent or connivance of, or is attributable to any neglect on the part of, any director, manager, secretary or other officer of the company, such director, manager, secretary or other officer shall also be deemed to be guilty of the offence and shall be liable to be proceeded against and punished accordingly.

Explanation.- For the purpose of this section—

(a) “company” means any body corporate, and includes—

(i) a firm; and

(ii) an association of persons or a body of individuals whether incorporated or not.

(b) “director” in relation to—

(i) a firm, means a partner in the firm;

(ii) an association of persons or a body of individuals, means any member controlling affairs thereof.

96. Offences by Central or State Government departments. —

(1) Where an offence under this Act has been committed by any department of the Central or State Government, or any authority of the State, the head of the department or authority shall be deemed to be guilty of the offence and shall be liable to be proceeded against and punished accordingly.

(2) Nothing contained in sub-section (1) shall render any such person liable to any punishment provided in this Act, if she proves that the offence was committed without her knowledge or that she had exercised all due diligence to prevent the commission of such offence.

(3) Notwithstanding anything contained in sub-section (1), where an offence under this Act has been committed by a department of the Central or State Government, or any authority of the State and it is proved that the offence has been committed with the consent or connivance of, or is attributable to any neglect on the part of, any officer, other than the head of the department or authority, such officer shall also be deemed to be guilty of the offence and shall be liable to be proceeded against and punished accordingly.


Chapter I II III IV V VI VII VIII IX X
Sections 1-3 4-11 12-17 18-22 23 24-28 29-39 40-41 42-48 49-68
Title Preliminary Data Protection Obligations Grounds for Processing Personal Data Grounds for processing Sensitive personal Data Personal and Sensitive Personal Data of Children Data Principal Rights Transparency and Accountability Measures Transfer of Personal data outside India Exemptions Data Protection Authority of India
Chapter XI XII XIII XIV XV   Schedule 1 Schedule 2    
Sections 69-78 79-89 90-96 97 98-112          
Title Penalties and Remedies Appellate Tribunal Offences Transitional Provisions Miscellaneous Preamble Amendment to ITA 2000 Amendment to RTI Act 2005 PDF Copy of the Proposed Act Srikrishna Committee Report