The SPDI Rules - An Early Attempt At Data Protection In India And Its Limitations

Author: LawSphereX

Category: Technology, Cyber & Privacy

Published: 2026-08-23T21:32:29.995Z

Updated: 2026-08-30T07:09:33.047Z

THE SPDI RULES: AN EARLY ATTEMPT AT DATA

PROTECTION IN INDIA AND ITS LIMITATIONS

Sudhanwa Sandeep Joshi, Government Law College, Mumbai

ABSTRACT

The Digital Personal Data Protection Act, 2023 received Presidential assent on August 11th 2023 – yet a year later, its rules remain unnotified, rendering it unenforceable. 1 Therefore, the currently applicable legislative framework for data protection in India remains Section 43A of the Information Technology Act, 2000 as well as its notified rules – the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”). This paper attempts to explore one of the earliest legislative recognitions of the right to privacy, and evaluate it against modern yardsticks as well as basic data protection principles.

It touches upon its advantages – such as the incorporation of OECD Guidelines, which gave it international credibility, as well as its disadvantages – such as blanket exemptions for the Government, as well as the largely procedural nature of the rules. It attempts to demonstrate why there is a need to implement the new data protection regime at the earliest, while at the same time lauds the SPDI rules as a novel and novice attempt at implementing a data protection regime in India. 1 Baker Mckenzie, ‘India: India’s Digital Personal Data Protection Act - What Should United States Companies Do Now? ’ (bakermckenzie. com2023) accessed 28 September 2024

1. 43A of the IT Act, 2000

Perhaps one of the earliest attempts to recognize the need of, and take steps in furtherance of data protection was the insertion of Section 43A into the Information Technology Act, 2000 (“IT Act”)2 by the Information Technology (Amendment) Act, 2008 (“IT Amendment 2008”)3. S. 43A provides “Compensation for failure to protect data” and holds any ‘body corporate’ (firm sole proprietorship or other association of individuals engaged in financial activity) liable for negligence and failure to implement reasonable security practices, which causes wrongful loss or gain to any person. This marked one of the earliest attempts at codification of digital privacy and data protection requirements in India.

While an argument might be made against its effectiveness in achieving its intended objective, especially given the lack of any concrete procedural restrictions on the storage/processing of data, it must be noted that as a preliminary attempt it largely focused on preventing negligence in the handling and possession of the data by imposing punitive action and doing right any damage caused in cases of such failure in the implementation of reasonable security practices. It notably did not factor in intentional misuse or misappropriation, directly, and instead only provided for punitive action or compensation to mitigate the damage caused in cases of failure and negligence pertaining to possessing, dealing, or handling sensitive data insofar as reasonable security practices were disregarded.

4 That is to say while the term “reasonable security practices” is wide enough to warrant consideration of authorization, collection and disclosure pertaining to handling or possessing sensitive information – being expressly stated under Explanation (ii), the verbatim of 43A ensures that unless there is actual damage (“wrongful loss or wrongful gain to a person”) caused, such a breach shall not definitively be under the ambit of S. 43A. 5 Therefore, this section does not explicitly recognize a digital right to privacy, as those which acknowledge the existence of rights, tend to penalize the very breach of such rights – following the common law principle & latin maxim of ubi jus ibi remedium meaning “Where there is a Right, there is a Remedy”, apart from doing right any incidental damage caused due to such breach. 6

2. SPDI Rules

In 2011, an overarching generic data protection arrangement was brought in the form of the

2 Information Technology Act 2000 (India)

3 Information Technology (Amendment) Act 2008 (India), s 22

4 State Bank of India v Shri. Chander Kalani 2018 SCC OnLine TDSAT 738 [17]

5 State Bank of India v Shri. Chander Kalani 2018 SCC OnLine TDSAT 738 [16]

6 Dhruv Green Field Ltd v Hukam Singh (2002) 6 SCC 416; DK Basu v State of W.B. (1997) 1 SCC 476; Atma Linga Reddy v Union of India (2008) 7 SCC 788.

Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”) notified under the aforementioned Section 43A7 and Section 87(2) of the IT Act, 2000. The SPDI Rules, partly inspired by the Organization for Economic Co-operation & Development (OECD) Privacy Guidelines – 19808 (“OECD Guidelines”), incorporate several of its core provisions from the OECD Guidelines such as collection limitation, purpose specification, use limitation and individual participation.

The SPDI Rules stress upon the requirement of a privacy policy (to be deployed by datahandling/possessing body corporates) – which should be clearly accessible, readable and legible in its letter and spirit containing the details about the information that it collects, the purpose of such collection and its usage thereafter, disclosure of information including sensitive personal data, and reasonable security practices and procedures adopted by such body corporate. 9 The collection of information, particularly sensitive information is heavily regulated under the SPDI Rules. The SPDI Rules incorporate the concept of, and define “Sensitive Personal Data or Information” to be inclusive of information pertaining to passwords, financial information, physical physiological and mental condition, sexual orientation, medical records and history, biometrics etc.

10 The following principles of international data protection jurisprudence were incorporated into the SPDI Rules: I.

Collection Limitation & Purpose Specification: A body corporate is required to obtain written consent of the individual whose sensitive data it seeks to collect, either by fax or by way of a letter, including the purpose for which the usage is authorized. 11 The body corporate is also restrained from collecting sensitive information unless it is necessary for the purpose, or for a lawful purpose connected with the functions of the body corporate. 12 It is also mandated that the person whose information is collected is 7 Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (India) 8 OECD, 'OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data' (OECD 2002) https://www. oecd-ilibrary.

org/science-and-technology/oecd-guidelines-on-the-protection-of-privacy-andtransborder-flows-of-personal-data_9789264196391-en accessed 28 September 2024 9 Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (India), r 4 10 Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (India), r 3 11 Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (India), r 5 12 Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (India), r 4 fully aware of the collection, purpose thereof, intended recipients of the information, details of the agency collecting, and the agency retaining the information. 13 II.

Use Limitation: The retention of data beyond the required period for the lawful purpose is also prohibited, as is (mis-) appropriation for any purpose other than that for which the data was collected. Disclosure of information too is regulated under the SPDI Rules, which mandate that any sensitive personal data cannot be disclosed to a third party without prior consent of the individual, unless it is provided for in the contract between the body corporate and the individual in question.14 III.

Individual Participation: Consent of the individual is central to the process, at any stage be it collecting, storing or processing. Provisions for the correction of personal data have been given in the rules, allowing the individual, upon his consent and supply of correct information – notwithstanding the fact that the burden for providing accurate information lies on the individual in question. Similarly, individual participation is ensured by allowing the individual to withdraw her consent any time while availing the services or otherwise, and to not provide information sought while collection itself.

However, in such cases the body corporate reserves the right to forfeit the provision of goods and/or services to an individual who did not provide sought after information or withdrew consent later, provided that the information was sought for the provision of such goods and/or services. 15 IV.

Grievance Redressal: The SPDI Rules also mandate the designation of a grievance safeguard for the right to privacy and data security in general as: I.

Governmental Impunity: The SPDI Rules are only applicable to body corporates, meaning they are not applicable to the Government. Concerningly, a body corporate has to share such information, without consent of the individual, to any government agency, upon receiving such request in writing containing the purpose for which the information is sought, and an affirmation to the effect that the information received shall not be published or shared with any other person.16 This prompts fears of totalitarianism in the digital realm, as there is virtually no check on arbitrary executive action. II.

Executive Overreach & Legal Nature of Rules: The SPDI Rules are executive rules – a form of delegated legislation and not a legislation (act) of the Parliament of India, therefore enjoying lower level of credibility and value in the legal system. 17 It also sparks concerns of potential executive overreach, as the rules provide a blanket impunity to the government to access sensitive personal data of individuals without any parliamentary accountability and/or judicial oversight. 18 The State (particularly the executive), being one of the interested parties in the handling and processing of personal data of individuals19 cannot sit in judgement of what constitutes a violation of citizens’ right to privacy.

It is the Parliament’s prerogative as the chief representor of the will of the people for creating a data protection regime which balances legitimate state interests with the right to privacy of citizens. The judiciary too, must oversee and intervene wherever the legislature steps out of its well-defined contours and attempts to curb the rights of citizens. The executive must only picture in for effective enforcement of the mechanism put in place by the parliament, and validated (expressly or impliedly) by the judiciary. Separation of Powers is essential, including in modern concepts such as data protection regulations, to guard against excesses of the State. III.

Scope

and Enforcement: The SPDI Rules only confine themselves to sensitive personal data20, and not personal data in general. This raises concerns as to its effectiveness compared to a comprehensive data protection regime. Further, being executive rules and not legislations of the parliament, they lack the same level of credibility and perceived weight in the eyes of the corporates and the citizenry alike. Also, the Cyber Appellate Tribunal (CyAT) which adjudicates disputes pertaining to the IT Act issued its last order in 2011, the same year that the rules were promulgated. 21 Therefore, there are questions regarding the credibility and the enforceability of the SPDI Rules.

In lieu of the lack of parliamentary authorization, judicial oversight and comprehensive & egalitarian rules, as well as want of a strong and reliable enforcement mechanism, the SPDI Rules prove to largely be symbolic and only of peripheral importance in data protection jurisprudence and the protection of the right to privacy.

3. Conclusion

Although the SPDI Rules and Section 43A of the IT Act cannot cater to the needs to the zettabyte era, they must be cherished as novel and noble attempts at introducing a data protection regime in India. Meanwhile, it would augur well for the citizens as well as the government of India to speedily implement the Digital Personal Data Protection Act, 2023 – which has been lying unenforced due to the lack of notification of its rules since over a year.

22 20 Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (India), r 3 21 Justice BN Srikrishna, 'A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians' (Committee of Experts, Ministry of Electronics & Information Technology 2018) Part I, Chapter 4(ii) 22 Baker Mckenzie, ‘India: India’s Digital Personal Data Protection Act - What Should United States Companies Do Now? ’ (bakermckenzie. com2023) accessed 28 September 2024.