Technology and Privacy — Ethical Standards

Entry	Year	Description	Impact
Information Technology (Amendment) Act, 2008	2008	This amendment to the IT Act, 2000, introduced Section 43A, which mandated corporate bodies holding sensitive personal data to implement reasonable security practices, and made them liable to pay damages for negligence. It also introduced Section 69, which gave the government powers for interception, monitoring, or decryption of any information through any computer resource, subject to certain conditions.	It was an early, albeit inadequate, attempt to introduce a corporate data protection liability regime. However, Section 69 became highly controversial as it expanded state surveillance powers. The overall framework was seen as insufficient to deal with the complexities of the modern data economy, paving the way for a comprehensive data protection law.
Digital Personal Data Protection Act, 2023	2023	This is not an amendment but a new, standalone Act that effectively replaces Section 43A of the IT Act. It establishes a comprehensive framework for the protection of digital personal data. It lays down principles for data processing, defines the rights of individuals (Data Principals) and the obligations of entities (Data Fiduciaries), and creates a Data Protection Board for enforcement and adjudication.	This Act marks a paradigm shift in India's approach to privacy, moving from a sectoral approach to a horizontal, economy-wide law. Its long-term impact will depend on the effectiveness of its implementation, the independence of the Data Protection Board, and how the judiciary interprets the broad exemptions granted to the state in light of the Puttaswamy judgment.