Section 72A explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Section 72A of the Information Technology Act, 2000 deals with any person, including an intermediary, who while providing services under the terms of a lawful contract has secured access to material containing personal information about another person and discloses it with the intent or knowledge the section states. As printed it carries imprisonment up to three years, or fine up to five lakh rupees, or both; an item of the Jan Vishwas (Amendment of Provisions) Act, 2023 changes the marginal heading to "Penalty" and the consequence to "liable to penalty which may extend to twenty-five lakh rupees". This article follows the consolidated text consulted (the Act as amended by the Information Technology (Amendment) Act, 2008), then the amendment; later amendments and the current position should be checked.
Section 72A applies to any person including an intermediary who, while providing services under the terms of a lawful contract, has secured access to material containing personal information about another person and, with intent to cause or knowing that he is likely to cause wrongful loss or wrongful gain, discloses it without the consent of the person concerned, or in breach of a lawful contract. As printed: imprisonment up to three years, or fine up to five lakh rupees, or both. As amended by the Jan Vishwas (Amendment of Provisions) Act, 2023: "liable to penalty which may extend to twenty-five lakh rupees".
What section 72A says, as printed
The copy prints: "Save as otherwise provided in this Act or any other law for the time being in force, any person including an intermediary who, while providing services under the terms of lawful contract, has secured access to any material containing personal information about another person, with the intent to cause or knowing that he is likely to cause wrongful loss or wrongful gain discloses, without the consent of the person concerned, or in breach of a lawful contract, such material to any other person, shall be punished with imprisonment for a term which may extend to three years, or with fine which may extend to five lakh rupees, or with both."
The marginal heading in the copy reads "Punishment for disclosure of information in breach of lawful contract".
The elements are:
- A saving clause: "save as otherwise provided in this Act or any other law for the time being in force".
- A person: "any person including an intermediary". "Intermediary" is defined in section 2(1)(w); our article on section 2 explains the definition.
- Providing services under the terms of lawful contract. The access must come while providing services under a lawful contract.
- Material containing personal information about another person. The Act does not define "personal information" in this section.
- A state of mind: "with the intent to cause or knowing that he is likely to cause wrongful loss or wrongful gain".
- Disclosure to any other person, "without the consent of the person concerned, or in breach of a lawful contract".
Because the second limb of the disclosure ("or in breach of a lawful contract") is joined to the first by "or", the section can be engaged where there was no consent from the person concerned, or where the disclosure was in breach of a lawful contract. A reader should check how the words are read together with the state of mind.
If you provide outsourced services such as payroll, customer support, hosting or analytics, a non-disclosure and confidentiality agreement that sets out what may be disclosed, to whom and on what consent, is a practical step that works alongside the Act.
The Jan Vishwas amendment
Item (K) of Schedule item 32 of the Jan Vishwas (Amendment of Provisions) Act, 2023 reads: in section 72A, in the marginal heading, for the word "Punishment", the word "Penalty" shall be substituted; and for the words "punished with imprisonment for a term which may extend to three years, or with fine which may extend to five lakh rupees, or with both", the words "liable to penalty which may extend to twenty-five lakh rupees" shall be substituted.
| Provision | As printed in the consolidated copy | As amended by the Jan Vishwas (Amendment of Provisions) Act, 2023 |
|---|---|---|
| Marginal heading | "Punishment for disclosure of information in breach of lawful contract" | "Penalty for disclosure of information in breach of lawful contract" |
| Consequence | "shall be punished with imprisonment for a term which may extend to three years, or with fine which may extend to five lakh rupees, or with both" | "shall be liable to penalty which may extend to twenty-five lakh rupees" |
Imprisonment is replaced by a penalty, and this article infers nothing more than that. Who imposes the penalty is read from section 46 as amended by the same item, which speaks of contraventions "under this Act". Commencement of the Jan Vishwas (Amendment of Provisions) Act, 2023 is by notification, with different dates for different enactments, and no date is in the sources used for this article. Check whether the amendment to section 72A has been brought into force.
Section 72A beside section 72
Our article on section 72 compares the two sections in a table. In short, section 72 concerns a person who secured access in pursuance of powers conferred under the Act, rules or regulations; section 72A concerns a person who secured access while providing services under a lawful contract, and it adds the state of mind of intent or knowledge of wrongful loss or wrongful gain.
Other laws on personal data
Section 44(2) of the Digital Personal Data Protection Act, 2023 amends this Act in three places: section 43A, the proviso to section 81 and clause (ob) of section 87(2). Section 72A is not among them. Those changes are explained in our articles on section 43A and on section 44 of the Digital Personal Data Protection Act, 2023. For a general account of the data protection law itself, see our introduction to the Digital Personal Data Protection Act, 2023.
Related provisions
Sections 77A, 77B and 78 apply to offences under the Act as printed. Section 77A allows compounding of offences "other than offences for which the punishment for life or imprisonment for a term exceeding three years has been provided", with two provisos; section 77B prints "the offence punishable with imprisonment of three years and above shall be cognizable and the offence punishable with imprisonment of three years shall be bailable", which we quote and do not apply further; section 78 says a police officer not below the rank of shall investigate any offence under the Act. Section 85 deals with offences by companies. The Act refers to the Code of Criminal Procedure, 1973; check the current procedural law for the corresponding provisions.
A worked example
Rajiv Analytics Private Limited, an invented firm, provides customer-support services to Shree Tel Retail Private Limited under a written contract. A team member of Rajiv Analytics, while working under that contract, has access to a spreadsheet of customer names and phone numbers. He gives the spreadsheet to a third party who markets to those customers, in the expectation of a payment, without the retailer's consent. On the words of section 72A, the questions are whether he was providing services under the terms of a lawful contract, whether the spreadsheet is material containing personal information about another person, whether he had the intent, or knew that he was likely to cause wrongful loss or wrongful gain, and whether the disclosure was without the consent of the person concerned or in breach of the contract. Rajiv Analytics should look at its own contract terms, including terms such as those found in a service agreement or an outsourcing agreement.
Need help with a confidentiality or data-sharing contract?
If you provide or buy services that involve access to personal information, our team can review the contract terms against section 72A and help you set clear limits on disclosure. See our non-disclosure agreement service.
Key takeaways
- Section 72A applies to any person including an intermediary who, while providing services under a lawful contract, discloses personal information with the stated intent or knowledge.
- As printed: imprisonment up to three years, or fine up to five lakh rupees, or both.
- As amended by the Jan Vishwas (Amendment of Provisions) Act, 2023: marginal heading "Penalty" and "liable to penalty which may extend to twenty-five lakh rupees".
- Check whether the amendment has been brought into force; no date is in the sources.
Read next
- Section 72 of the Information Technology Act, 2000: breach of confidentiality and privacy
- Section 43A of the Information Technology Act, 2000: compensation for failure to protect data
- Section 44 of the Digital Personal Data Protection Act, 2023: amendments to the IT Act, RTI Act and TRAI Act
- Data Processing Agreement Template: DPDP compliance
Disclaimer: Based on a consolidated copy of the Information Technology Act, 2000 as amended by the Information Technology (Amendment) Act, 2008, on the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 as originally notified on 25 February 2021 and on the CERT-In Directions of 28 April 2022, read with the amendments made to the Act by the Jan Vishwas (Amendment of Provisions) Act, 2023 and by section 44 of the Digital Personal Data Protection Act, 2023, as consulted on 2 October 2026. Commencement notifications, other amendments, rules, directions and the current position of each provision are not covered and should be checked. This article is general information, not legal advice; check the official text before acting.