Data Protection — Tech Evolutions

Entry	Year	Description	Impact
Information Technology (Amendment) Act, 2008	2008	This amendment introduced Section 43A and Section 72A to the IT Act, 2000. Section 43A made a body corporate liable to pay compensation for negligence in implementing and maintaining reasonable security practices and procedures, resulting in wrongful loss or gain to any person. Section 72A prescribed punishment for disclosure of information in breach of lawful contract.	These sections provided the first specific legal recourse for data breaches and unauthorized disclosure of sensitive personal data in India. While limited in scope and not a comprehensive data protection law, they laid the groundwork for recognizing data security liabilities and were the primary legal provisions for data protection before the DPDP Act, 2023.
Digital Personal Data Protection Act, 2023	2023	While not an amendment to the IT Act, the DPDP Act, 2023, is a standalone, comprehensive data protection law that significantly supersedes and complements certain aspects of the IT Act, 2000, particularly concerning personal data. It repeals Section 43A of the IT Act, 2000, and makes consequential amendments to other laws, establishing a new, dedicated framework for personal data protection.	This Act marks a paradigm shift, moving from a reactive, compensation-focused approach under the IT Act to a proactive, rights-based, and regulatory framework for personal data. It establishes a dedicated Data Protection Board, defines clear rights for data principals, and imposes stringent obligations and penalties on data fiduciaries, fundamentally reshaping India's data governance landscape.