SPDI Rules 2011 and Section 43A Explained

The SPDI Rules 2011 were India's first detailed rules on personal data, and they still apply today. Made under section 43A of the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules require companies that handle sensitive personal data, such as passwords, bank and card details, health records and biometrics, to follow specific rules on consent, use, disclosure and transfer, and to maintain documented, audited security practices.

They are on their way out. The Digital Personal Data Protection Act, 2023 omits section 43A through its section 44(2), which is expected to take effect with the Act's substantive provisions. Until then, the SPDI Rules remain the operative standard for compensation claims after data breaches, and many contracts and audits still refer to them. This guide explains what they require, how they apply to IT service providers, the role of ISO/IEC 27001, and how to plan the move to the DPDP regime.

What are the SPDI Rules?

Section 43A of the IT Act makes a body corporate that possesses, deals with or handles sensitive personal data or information in a computer resource it owns, controls or operates, and is negligent in implementing and maintaining reasonable security practices and procedures, liable to pay compensation to the person affected if that negligence causes wrongful loss or gain. The section left "sensitive personal data" and "reasonable security practices" to be defined. The government did so in the SPDI Rules, notified on 11 April 2011 as G.S.R. 313(E).

Sensitive personal data or information (rule 3)

Personal information relating to:

Passwords.
Financial information such as bank account, credit card, debit card or other payment instrument details.
Physical, physiological and mental health condition.
Sexual orientation.
Medical records and history.
Biometric information.
Any detail relating to the above provided to the body corporate for providing a service, and information received under the above for processing or storage under a lawful contract or otherwise.

Information that is freely available, accessible in the public domain, or furnished under the Right to Information Act or other law is not treated as sensitive personal data.

History and why the rules were introduced

Section 43A was added by the IT (Amendment) Act, 2008, at a time when India's IT outsourcing industry was growing quickly and foreign clients were concerned about data protection in India. The rules were notified in April 2011 to give the section practical content. Industry raised concerns that consent and disclosure requirements written for organisations dealing directly with individuals would be unworkable for outsourcing providers processing client data. In August 2011 the government issued a clarification that the collection and disclosure obligations (rules 5 and 6) do not apply to a body corporate providing services relating to collection, storage, dealing or handling of sensitive personal data under a contractual obligation with another legal entity in or outside India, while those that collect directly from individuals remain bound.

The rules were a stop-gap until a full data protection law. That law arrived as the DPDP Act, 2023, whose section 44(2) omits section 43A.

Who must comply?

Body corporates, meaning any company, firm, sole proprietorship or other association of individuals engaged in commercial or professional activities, that collect, receive, possess, store, deal with or handle sensitive personal data.
Organisations collecting directly from individuals, such as banks, insurers, hospitals, e-commerce, fintech, health-tech and HR platforms, which have the full set of obligations.
IT and BPO service providers processing sensitive data under contract for clients, which, following the 2011 clarification, are not bound by rules 5 and 6 for that data but must still implement reasonable security practices under rule 8 and follow their contracts.

The rules apply to data in computer resources in India. Overseas clients of Indian IT companies typically impose their own laws, such as the GDPR or HIPAA, through contracts as well.

Key requirements

Privacy policy (rule 4)

A body corporate that collects, receives, possesses, stores, deals with or handles information must provide a privacy policy for handling personal information, including sensitive personal data, published on its website. It must state clearly its practices and policies, the type of information collected, the purpose of collection and usage, disclosure, and the reasonable security practices followed.

Collection (rule 5)

Obtain consent in writing (through letter, fax or email, which courts and practice have interpreted to include electronic means) from the provider of the information regarding the purpose of usage before collecting sensitive personal data.
Collect only for a lawful purpose connected with a function or activity of the body corporate, and only when necessary for that purpose.
Take reasonable steps to ensure the person knows that information is being collected, the purpose, the intended recipients, and the name and address of the agency collecting and retaining it.
Do not retain the information longer than required for the purposes for which it may lawfully be used, or as otherwise required by law.
Use the information only for the purpose for which it was collected.
Allow the provider to review and correct their information, and give an option not to provide data or to withdraw consent later (with the consequence that the service may not be provided).
Keep the information secure.
Designate a grievance officer, publish their name and contact details on the website, and resolve grievances expeditiously and within one month of receipt.

Disclosure (rule 6)

Disclosure of sensitive personal data to a third party requires prior permission from the provider, unless agreed in the contract between them or necessary for compliance with a legal obligation. Information must be shared with government agencies mandated by law to obtain it for verification of identity, prevention, detection, investigation and prosecution of offences, on a request in writing stating the purpose. The third party must not further disclose it. Publication of sensitive personal data is prohibited.

Transfer (rule 7)

Sensitive personal data may be transferred to another body corporate or person in India or another country only if that recipient ensures the same level of data protection required by the rules, and only if the transfer is necessary for the performance of a lawful contract or the provider has consented.

Reasonable security practices (rule 8)

A body corporate is considered to have complied with reasonable security practices if it has implemented security practices and standards and has a documented information security programme and policies containing managerial, technical, operational and physical security controls commensurate with the information assets being protected and the nature of the business. In a security breach, it may be called upon to show that it implemented these controls as documented. The rule names the international standard IS/ISO/IEC 27001 as one such standard. Industry associations may develop codes of best practices, which must be approved and notified by the government. Body corporates following IS/ISO/IEC 27001 or an approved code are deemed compliant if their implementation is certified or audited regularly by an auditor approved by the central government, at least once a year or when there is a significant upgrade of process and computer resource.

How to comply, step by step

Identify sensitive personal data across your systems: passwords, payment data, health and biometric information.
Classify your role for each data set: collecting directly from individuals, or processing under contract for a client.
Publish a privacy policy meeting rule 4.
Implement consent capture for collection, with records, and withdrawal handling.
Limit purposes, retention and disclosure, and document disclosures to government agencies.
Control transfers through contracts that require equivalent protection.
Appoint a grievance officer and track grievances to closure within one month.
Implement a documented security programme, ideally aligned with ISO/IEC 27001, and have it audited annually.
Align with CERT-In Directions for incident reporting and logs, and with the DPDP Rules as they take effect.

Documentation you will need

Published privacy policy.
Consent records for collection of sensitive personal data.
Data inventory and retention schedule.
Grievance officer appointment and grievance log.
Records of disclosures, including government requests.
Contracts covering transfers and processing.
Information security policies and the documented security programme.
Annual audit reports by an approved auditor, or ISO/IEC 27001 certification and audit reports.

Audits and enforcement

The rules require security practices to be audited at least annually or after significant upgrades. Compensation claims under section 43A are decided by adjudicating officers appointed under section 46 of the IT Act for claims up to five crore rupees, and by civil courts above that. There is no regulator dedicated to the SPDI Rules; enforcement has been through compensation claims, and through sector regulators and contracts that require compliance. Disclosure of personal information in breach of a lawful contract can also be an offence under section 72A of the IT Act.

The transition to the DPDP Act

The DPDP Act, 2023 and the DPDP Rules, 2025 replace the SPDI framework with broader obligations covering all digital personal data, not only sensitive categories, and with a regulator and penalties of up to 250 crore rupees. The commencement notification of November 2025 brought only certain provisions into force immediately; the DPDP Rules' substantive duties apply from May 2027, and section 44(2), which omits section 43A, was not among the provisions brought into force immediately. Until it takes effect, the SPDI Rules continue to apply. Practical steps:

Do not wait: DPDP consent, notice, security and breach duties are wider and need product work.
Extend the SPDI data inventory to cover all personal data.
Upgrade consent from "written consent for sensitive data" to the DPDP standard of free, specific, informed, unconditional and unambiguous consent with itemised notices.
Upgrade security to the DPDP Rule 6 safeguards, including one-year log retention.
Replace the one-month grievance process with DPDP-compliant rights and grievance handling.

Timeline and cost considerations

The rules have applied since 2011. Costs are mainly the security programme and its annual audit, privacy policy and consent mechanisms, grievance handling, and contract management. Investments made now in an ISO/IEC 27001 aligned programme carry over to the DPDP regime.

Benefits and consequences of non-compliance

Compliance reduces the risk of compensation claims after a breach, satisfies clients and regulators who still reference the rules, and creates a foundation for DPDP compliance. Non-compliance can lead to compensation awards under section 43A, which sets no fixed cap (claims up to five crore rupees go to adjudicating officers and larger claims to civil courts), criminal exposure under section 72A for wrongful disclosure, and contractual consequences.

Common mistakes and challenges for IT companies

Storing passwords in reversible form. Passwords are sensitive personal data; hash them with modern algorithms.
No published grievance officer.
Security programme without an annual independent audit.
Sharing sensitive data with vendors without contracts that require equivalent protection.
Assuming the 2011 clarification exempts processors from security duties. It does not; rule 8 still applies.
Treating SPDI compliance as DPDP readiness. The DPDP Act is much broader.

Best practices, tools and technologies

Hash passwords with bcrypt, scrypt or Argon2; never log them.
Tokenise or avoid storing card data; follow PCI DSS where cards are involved.
Encrypt health and biometric data at rest with managed keys.
Record consent with timestamps and purposes.
Run an ISO/IEC 27001 aligned ISMS with annual audits by a CERT-In empanelled or otherwise approved auditor.

We implement secure password storage, encryption, consent records and audit logging in web applications and maintain them under support plans.

How the SPDI Rules relate to other laws and frameworks

Law or framework	Relationship
IT Act, 2000	Parent Act; section 43A is the basis of the rules.
DPDP Act, 2023	Will replace the rules when section 44(2) takes effect.
CERT-In Directions	Separate incident reporting and log duties under section 70B.
ISO/IEC 27001	Named in rule 8 as a standard satisfying reasonable security practices when audited.
GDPR	Foreign law often imposed by contract on Indian processors alongside the SPDI Rules.

Real-world implementation examples

Adjudicating officers and courts have awarded compensation under section 43A in cases where banks and other companies failed to prevent unauthorised access to customer accounts, finding that the absence of adequate security practices made them liable. These decisions show that documented, implemented and audited security programmes are the practical defence under the rules.

An illustrative case for an Indian health-tech app: it collects medical history directly from users, so it publishes a privacy policy, obtains explicit consent at sign-up, appoints a grievance officer, encrypts health data, and has its ISO/IEC 27001 aligned programme audited annually. In parallel, it maps all personal data for the DPDP Rules and plans itemised notices and one-year log retention before May 2027.

Next steps

Inventory sensitive personal data and your role for each data set.
Check the privacy policy, consent and grievance officer requirements.
Have your security programme audited this year.
Review vendor contracts for equivalent protection.
Plan the move to DPDP duties now.

Frequently asked questions

Are the SPDI Rules still in force?

Yes, while section 43A of the IT Act remains in force. Section 44(2) of the DPDP Act will omit section 43A when it takes effect.

What counts as sensitive personal data under the SPDI Rules?

Passwords, financial information such as bank and card details, physical, physiological and mental health condition, sexual orientation, medical records and history, and biometric information.

Do the SPDI Rules apply to IT outsourcing companies?

Following the August 2011 clarification, the collection and disclosure rules do not apply to providers processing data under contract for another entity, but reasonable security practices still apply.

Is ISO 27001 mandatory under the SPDI Rules?

No. It is named as one standard that satisfies the requirement if audited, but other documented programmes and approved codes are allowed.

How often must security practices be audited?

At least once a year, or when there is a significant upgrade of process and computer resource, by an auditor approved by the central government.

What is the penalty for breaching the SPDI Rules?

Section 43A provides for compensation to affected persons where negligence in security causes wrongful loss or gain. Wrongful disclosure under contract can also be an offence under section 72A.

Do we need a grievance officer?

Yes, if you collect sensitive personal data from individuals. Their name and contact details must be published, and grievances resolved within one month.

Can sensitive data be transferred outside India?

Yes, if the recipient ensures the same level of protection and the transfer is necessary for a lawful contract or the person has consented.

How do the SPDI Rules differ from the DPDP Act?

The SPDI Rules cover only sensitive data and rely on compensation claims. The DPDP Act covers all digital personal data, has a regulator, detailed rights and breach duties, and large penalties.

What should we do to prepare for the DPDP Act?

Extend your data inventory to all personal data, upgrade consent and notices, implement DPDP security safeguards and breach intimation, and build rights handling ahead of May 2027.