IT Act Section 72A: What Counts as Unlawful Disclosure of Personal Information

By LegalInk Editorial · 2026-09-05

IT Act Section 72A: What Counts as Unlawful Disclosure of Personal Information

Section 72A of the Information Technology Act, 2000 makes it a punishable offence to disclose personal information obtained under a lawful contract — without the subject's consent and with intent to cause, or knowing it is likely to cause, wrongful gain or wrongful loss. It sits in the criminal chapter of the statute and carries imprisonment of up to three years, a fine of up to five lakh rupees, or both. Crucially, the disclosure need not actually cause harm: the intent or knowledge of likely harm is the operative threshold.

What Section 72A Actually Says

Section 72A of the Information Technology Act, 2000 targets a specific fact pattern: a person who secured access to personal information about another pursuant to a lawful contract discloses that information without the consent of the person concerned. The disclosure must be made either with intent to cause wrongful gain or wrongful loss, or knowing that it is likely to cause wrongful gain or wrongful loss.

The wrong lies in the disclosure, not the acquisition. Because proof of actual gain or loss is not required, the analysis turns almost entirely on the accused's mental state at the time of disclosure.

What "Personal Information" Means Here

Section 72A of the Information Technology Act, 2000 does not itself exhaustively define "personal information." The term is understood to cover information relating to a natural person that is capable of identifying or affecting that person, particularly where it was shared in a contractual relationship and was not otherwise public. Courts read the provision alongside the broader scheme of the statute, which elsewhere addresses data-handling obligations.

The Contractual Nexus Is Essential

The gravamen of Section 72A of the Information Technology Act, 2000 is that the access was lawful — the accused legitimately received the information by virtue of a contract. This distinguishes it from provisions dealing with unauthorised access, such as Section 66 of the Information Technology Act, 2000. The wrongdoing is disclosing the data in breach of the express or implied duty of confidence attached to that contractual relationship.

Who Section 72A Binds

Service Providers and Data Handlers

Section 72A of the Information Technology Act, 2000 applies to "any person" who has received personal information under a lawful contract. That reach is wide enough to capture:

• cloud service providers holding customer data under a subscription agreement;
• SaaS platforms processing personal data of their clients' end-users under data processing terms;
• outsourcing vendors and IT service contractors accessing employee or customer records under a master service agreement;
• analytics firms operating under data-sharing contracts.

The definition of "intermediary" under Section 2 of the Information Technology Act, 2000 overlaps with the typical profile of entities that handle third-party personal information at scale. But intermediary status claimed for other purposes does not immunise an entity from criminal liability under Section 72A of the Information Technology Act, 2000 when it is the disclosing party acting outside its contractual authority.

Individual Employees and Officers

Because the provision targets "any person," it reaches employees and officers who independently disclose personal information accessed in their professional capacity — even where the employer has not authorised the disclosure. In-house counsel advising on employee offboarding, data-room access, or vendor transitions should treat individual exposure under Section 72A of the Information Technology Act, 2000 as a live consideration.

How Section 72A Relates to Section 43A

Section 43A of the Information Technology Act, 2000 addresses an adjacent problem: the civil liability of a body corporate that handles "sensitive personal data or information" and is negligent in maintaining reasonable security practices, causing wrongful loss or gain. It creates a compensatory remedy, not a criminal one.

The two provisions address different wrongs. Section 43A of the Information Technology Act, 2000 is triggered by inadequate security leading to a breach. Section 72A of the Information Technology Act, 2000 is triggered by a deliberate or knowing disclosure in breach of a contractual obligation.

A single incident can engage both. If an employee shares a client dataset with a competitor, the corporate entity may face civil liability under Section 43A of the Information Technology Act, 2000 for inadequate security, while the individual — and potentially the entity through its directing mind — faces criminal exposure under Section 72A of the Information Technology Act, 2000. In-house counsel should treat the two as complementary and map contractual confidentiality obligations to both.

Practical Implications for Contracts and Policies

Drafting Confidentiality and Data Handling Clauses

Section 72A of the Information Technology Act, 2000 reinforces why confidentiality clauses in vendor agreements, employment contracts, and data processing addenda must be specific about the scope of permitted use and disclosure. A general duty of confidentiality is the foundation — but the statutory prohibition operates independently of how precisely the contract is worded.

When reviewing or drafting data processing agreements, vendor contracts, or non-disclosure agreements that touch personal information, the LegalInk custom drafting tool can help structure clauses that reflect both contractual and statutory obligations.

Access Controls and Audit Trails

Because the offence depends on the information being accessed under a lawful contract, entities should maintain clear records of who accessed what, and under which contractual authority. This matters for internal governance and, when an allegation arises, for establishing whether an individual acted within or outside the scope of their authorised access.

For questions on how a specific fact pattern may engage Section 72A of the Information Technology Act, 2000 or Section 43A of the Information Technology Act, 2000, the LegalInk AI assistant can help structure the analysis and identify the relevant elements.

Frequently Asked Questions

Does Section 72A of the Information Technology Act, 2000 apply to disclosures within the same company?

Potentially, yes. If an employee accesses personal information under an employment or service relationship and discloses it beyond their authorised scope — with the requisite intent or knowledge — the provision can apply. The "lawful contract" element is satisfied by the employment or service agreement itself.

Is the offence under Section 72A of the Information Technology Act, 2000 compoundable?

Section 72A of the Information Technology Act, 2000 provides for imprisonment of up to three years, a fine of up to five lakh rupees, or both. Whether it is compoundable turns on the applicable procedural rules, and in-house counsel should verify the current position before relying on it.

Does Section 72A of the Information Technology Act, 2000 cover cross-border disclosures?

The statute does not expressly limit Section 72A of the Information Technology Act, 2000 to disclosures within India. Where a person subject to Indian jurisdiction discloses information obtained under a contract governed by Indian law to a foreign entity, without consent and with the requisite intent, a strong argument exists that the provision is engaged. Settled precedent on the jurisdictional question remains limited.

Can a SaaS company be prosecuted under Section 72A of the Information Technology Act, 2000, or only individuals?

The provision refers to "any person," and Section 85 of the Information Technology Act, 2000 provides for the liability of companies through the directing mind principle. Both the company and responsible officers may face exposure where the disclosure is attributable to the corporate entity's acts or omissions.

Working through the interaction between contractual confidentiality obligations and statutory liability under the Information Technology Act, 2000 is a recurring task for in-house teams at technology and SaaS companies. Practitioners looking to organise their analysis or draft compliant agreements can explore the tools at legalink.co.in.

Statute citations in this article are verified against LegalInk's verified law registry before publication. Always confirm the current text of any provision before relying on it.

← Back to all posts