The Eighth principle of Data Protection Act 1998 requires that, "Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data". And as we all aware that India is not in the list of countries that are considered by EEA offering adequate level of protection. So how do companies in India protect your data?

Indian Contract Act 1872:

The act could be found at the following link:

The above act applies in India and the parties can enter in to contracts to set out safeguards that are not too dissimilar to those used in the UK and elsewhere in the EU to set out the contractual obligations between them for and the processing of personal data. In the event of a breach the contract should provide for remedies available.


Information Technology Act 2000:

The act could be found at the following link:

The Information Technology Act which came into force in the year 2000 and is the only act to date which covers the key issues of data protection, albeit not every matter. According to the section 2 (1) (o) of the Act, "Data" means a representation of information, knowledge, facts, concepts or instructions which are being prepared or have been prepared in a formalised manner, and is intended to be processed, is being processed or has been processed in a computer system or computer network. , .and may be in any form (including computer printouts magnetic or optical storage media, punched cards, punched tapes) or stored internally in the memory of the computer". Furthermore the explanation to section 43 provides the definition of "computer data base" which means a representation of information, knowledge, facts, concepts or instructions in text, image, audio, video that are being prepared or have been prepared in a formalised manner or have been produced by a computer, computer system or computer network and are intended for use in a computer, computer system or computer network; It also provides that accessing data in an unauthorised way is a criminal offence and it could also raise civil liabilities for unauthorised access and assistance providing for access. Section 66 of the act provides provision against hacking and section 70 and 72 provides provision to protect data stored in protected system and protection against breach of confidentiality and privacy of the data, respectively.

It also provides means of resolving grievances that includes "Fast Track Courts".

Constitution of India:

The Constitution of India could be found by using this link:

This right is conferred on the citizens of India under article 21 and it is called 'Right to Life'. The law of privacy is the recognition of the individual's right to be let alone and not to have his personal space violated. The term 'privacy' denotes the rightful claim of the individual to determine the extent to which he wishes to share of himself with others and his control over the time, place and circumstances to communicate with others. It means that he has the right to withdraw or to participate or to control dissemination of information about him as it is his own personal possession.

The Personal Data Protection Bill, 2006:

The proposed bill could be found by using this link:

This bill is primarily based on foreign legislations and was introduced in Rajya Sabha (Council of States) on 8th December 2006. But unfortunately, the bill is still pending in the house. The rationale behind this bill is to provide protection of personal data and information of an individual collected for a particular purpose by one organization, and to control the way of its usage by another organization for commercial or other purposes. It also entitles the individual to claim compensation or damages due to disclosure of personal data or information of any individual without his consent and for matters connected with the Act or incidental to the Act.


Manmeet Singh, assistant to Izaz Ali (izaz.ali@lawdit.co.uk). Izaz Ali is a commercial lawyer who specialises in information technology law and intellectual property law with an emphasis on IT, escrow and buying and selling online businesses.