Information Technology Act 2000 Section 72: Breach of Confidentiality and Privacy (2026)

Explainer · Cyber Law · IT Act

Updated for 2026 · Claw Editorial

Section 72 of the Information Technology Act, 2000 punishes a breach of confidentiality and privacy. It targets a person who, having obtained access to electronic records or information by using the powers given under the Act, then discloses that material to someone else without the consent of the person concerned. The punishment is imprisonment up to two years, or a fine up to one lakh rupees, or both. The section is narrower than people expect, so this explainer sets out exactly what it covers, how it differs from the wider Section 72A, the punishment, and the key points. Last verified October 2026.

01The short answer

Section 72 punishes a particular kind of confidentiality breach. It applies to a person who got access to electronic records, registers, correspondence or information by using a power given under the IT Act, and who then discloses that material to another person without consent.

The punishment is jail up to two years, or a fine up to one lakh rupees, or both. In practice it mainly targets officials and others who access data through statutory powers and then leak it.

02What Section 72 says

Section 72 provides that any person who, in pursuance of any of the powers conferred under the Act or its rules and regulations, has secured access to any electronic record, book, register, correspondence, information, document or other material, and who then discloses it to any other person without the consent of the person concerned, commits the offence.

Two ingredients must be present:

• Access gained through a power under the Act: the person got the material because the IT Act or its rules gave them the authority to access it; and
• Disclosure without consent: they passed that material to someone else without the consent of the person it relates to.

This is why the section is often described as protecting the confidentiality of material that officials, adjudicating officers and others handle under the Act.

03Why it is narrower than it looks

The heading says "breach of confidentiality and privacy", which sounds like a general data privacy law. It is not. Section 72 is tied to access secured "in pursuance of powers conferred under this Act". So it does not cover an ordinary employee or company that leaks customer data in the course of business, because that access did not come from a power under the IT Act.

General data protection is now governed by the Digital Personal Data Protection Act, 2023, which has also omitted the old Section 43A of the IT Act. For leaks that happen in breach of a contract, the relevant provision is Section 72A, explained next.

04Section 72 and Section 72A

Section 72A was added by the 2008 amendment to fill the gap, and it is the wider provision most data-leak situations fall under.

So if an employee or vendor who handles your data under a contract leaks it for gain, Section 72A is usually the right provision, not Section 72.

05Punishment and procedure

The punishment under Section 72 is imprisonment for a term which may extend to two years, or a fine which may extend to one lakh rupees, or both. Under Section 72A it is higher: imprisonment up to three years, or a fine up to five lakh rupees, or both.

A police officer not below the rank of Inspector investigates offences under the Act under Section 78, and the cognizable and bailable status follows Section 77B. Because the term under Section 72 is up to two years, it falls on the bailable side of that scheme.

06A practical note

Choose the right section for the facts. If someone accessed your computer or data without permission, that is Sections 43 and 66. If a person who had lawful access under the IT Act leaked your material, that is Section 72. If an employee or vendor leaked personal information in breach of a contract, that is Section 72A, and the DPDP Act may also apply.

For any of these, gather the evidence of the leak and file a complaint through the cyber crime route; see how to file a cyber crime complaint.

07Where Claw fits

Claw is an all-in-one legaltech platform for Indian advocates, law firms, and corporate legal teams, combining AI-based case search, an AI legal assistant (Legal GPT), case management, and compliance automation across all Indian courts and tribunals.

Because Section 72 and Section 72A are narrowly worded, how they are charged and decided depends heavily on earlier rulings and on the interplay with the data protection law. Claw lets you search more than 30 crore judgments and orders, with Supreme Court decisions from 1950 and High Court decisions from 1990, in under 5 seconds, so you can see how confidentiality-breach charges have been treated. You can also track a live FIR, charge sheet or appeal by party or advocate name across 9,102 courts, benches and forums, and get the next hearing date without scanning cause lists by hand. Claw does not use the documents you upload to train its AI models.

Create a free Claw account to track a Section 72 or 72A case or appeal and follow every hearing, and use case search across Indian courts to find how the offence has been applied in similar matters.

08Sources and further reading

• India Code (Information Technology Act, 2000, bare text): indiacode.nic.in
• PRS Legislative Research (IT Act and amendments): prsindia.org
• Ministry of Electronics and IT (MeitY): meity.gov.in
• Claw: clawlaw.in

This explainer is general information, not legal advice. The law changes through amendments and judgments, so check the current text and take advice from counsel before you act.

09Frequently asked questions