Jan Vishwas Act 2023: what it changed in the IT Act, and what it left alone

Search for what the Information Technology Act, 2000 does about a data problem and you will usually be handed the Act as it stood before December 2023. The figures are wrong, the language is wrong, and in 5 places the sanction is wrong, because imprisonment was replaced by a monetary penalty.

The document that changed it is not an information technology statute. It is the Jan Vishwas (Amendment of Provisions) Act, 2023, an Act that amended dozens of unrelated enactments at once and gave each of them a numbered row in a Schedule. The Information Technology Act is row 32.

This page reads that row. Read as at 6 September 2026, against the Gazette print of Act No. 18 of 2023 and the India Code consolidated print of the Information Technology Act, both on file.

Why this matters on a DPDP site

Because the older Act is the one operating.

Section 44(2) of the DPDP Act 2023 directs that section 43A of the Information Technology Act be omitted, along with the rule making power in section 87(2)(ob). Paragraph (c) of notification G.S.R. 843(E) puts section 44(2) in the group that commences 18 months after publication, computed here as 13 May 2027 and interpretation until officially confirmed. So the handover has not happened, as set out in SPDI Rules 2011: still in force.

Which means that when somebody asks today what an Indian business risks over a security failure, a large part of the honest answer is in the Information Technology Act. And the version of that Act most summaries describe stopped being the law on 30 November 2023.

What the Act itself says, in 3 short sections

The whole of the amending work sits in a Schedule. The Act's own body is 4 sections, and 3 of them matter here.

Its long title states the project:

"An Act to amend certain enactments for decriminalising and rationalising offences to further enhance trust-based governance for ease of living and doing business."

Section 2 does the amending, by reference:

"The enactments mentioned in column (4) of the Schedule are hereby amended to the extent and in the manner mentioned in column (5) thereof."

And section 1(2) is the reason none of it commenced on the day it was printed:

"It shall come into force on such date as the Central Government may, by notification in the Official Gazette, appoint; and different dates may be appointed for amendments relating to different enactments mentioned in the Schedule."

That is the same commencement architecture as the DPDP Act's own section 1(2), and it has the same consequence: the Act's face fixes no date, and different enactments in the Schedule can start on different days. The Jan Vishwas print carries no date at all for the Information Technology Act group.

The date comes from somewhere else, and it is worth being exact about where. The India Code consolidated print of the Information Technology Act carries an amendment footnote at each amended place, and every one of them naming Act 18 of 2023 gives the same effective date, 30 November 2023. On page 22 alone there are 7 such footnotes. That print, not the Jan Vishwas Act, is this site's evidence for the date, and no commencement notification for these limbs is registered in this site's source registry.

Entry 32, limb by limb

Entry 32 of the Schedule reads 32, 2000, 21 and The Information Technology Act, 2000 across its first 4 columns. Column 5 holds 11 lettered limbs, (A) to (K), carrying 16 separate directions. It runs from page 60 to page 62.

The table below sets out 12 of the 16 directions. Both columns are quotations from the Schedule itself, so a reader can check either against the Gazette. The other 4 are set out in prose below, 3 of them because a 2 column table cannot carry what they do and the fourth, limb (K)(ii), because it belongs beside limb (K)(i) rather than 3 rows away from it.

The 4 directions not in that table are limb (C)(ii), which replaces the sanction in section 45 with a block of new text rather than a phrase, limb (D)(ii) and limb (E), which are omissions with nothing substituted, and limb (K)(ii), whose substituted words are the same as limb (F)'s and whose removed words are its own. The first 3 are set out below, and limb (K)(ii) is quoted in full in this page's sources.

5 sanctions became penalties, and 2 of the provisions still say "guilty of an offence"

Read the left column of that table again and a pattern appears that no figure captures. Limbs (A), (F), (G), (J) and the second half of (K) all remove the word punished, or the words on conviction, and all of them put in the word penalty.

Before 30 November 2023 a Certifying Authority that failed to surrender a suspended licence under section 33(2) faced up to 6 months in prison. An intermediary that knowingly failed to preserve information under section 67C(2) faced up to 3 years. A person who disclosed information secured under the Act in breach of section 72 faced up to 2 years, and a person who disclosed personal information in breach of a lawful contract under section 72A faced up to 3 years. In each of those the sanction on the print today is a monetary penalty and no term of imprisonment.

Here is the part that is easy to get wrong, and this site got it wrong in its own first draft. The Schedule replaced the SANCTION in all 5, and in 2 of them it left the surrounding words alone. Section 33(2) still reads that the person "shall be guilty of an offence and shall be" liable to penalty, and section 68(2) still reads that the person "shall be guilty of an offence and shall be liable" to penalty. Sections 67C(2), 72 and 72A carry no offence language at all: each simply says the person shall be liable to penalty.

So "decriminalisation" is the right word for 3 of the 5 and an approximation for the other 2, where the statute describes an offence and then prescribes only a penalty for it. This page does not resolve what that combination means; it records that the words are both there, because a summary that flattens them is describing a text the Gazette does not print.

Section 72A carries the clearest marker of the shift, because limb (K)(i) changes the marginal heading itself:

"( K ) In section 72A,— ( i ) in the marginal heading, for the word "Punishment", the word "Penalty" shall be substituted;"

That is a small direction with a large consequence for anybody drafting a data processing agreement. Section 72A is the provision most often cited in Indian contracts as the criminal exposure for a service provider that leaks personal information under a lawful contract. Since 30 November 2023 the print has carried no term of imprisonment under it and no longer heads it Punishment, and the ceiling on it rose from five lakh rupees to twenty five lakh rupees in the same movement.

Limb (H) is the one that does not fit the pattern and should not be described as decriminalisation. Section 69B(4) keeps imprisonment; the term comes down from 3 years to 1 year, and a fine ceiling of one crore rupees is added where the old text set no figure at all.

The 3 money limbs in section 44 are each exactly 10 times

Limb (B) is the crispest thing in the entry:

"( B ) In section 44,— ( i ) in clause ( a ), for the words "one lakh and fifty thousand", the words "fifteen lakh" shall be substituted; ( ii ) in clause ( b ), for the words "five thousand", the words "fifty thousand" shall be substituted; ( iii ) in clause ( c ), for the words "ten thousand", the words "one lakh" shall be substituted."

One lakh and fifty thousand to fifteen lakh. Five thousand to fifty thousand. Ten thousand to one lakh. Each figure multiplied by 10, and the structure of the section untouched: clause (a) is still a penalty for each failure to furnish a document, and clauses (b) and (c) are still daily penalties that run for as long as the failure continues.

The daily limbs are where the size sits. A failure to file a return under clause (b) now costs up to fifty thousand rupees a day, and a failure to maintain books or records under clause (c) up to one lakh rupees a day, against five thousand and ten thousand before. Over a year of continuing failure the arithmetic of clause (c) reaches a figure larger than most people expect from a provision they last read as a ten thousand rupee daily cap.

Section 45 was rebuilt, and what a company can be ordered to pay the person affected went up 40 times

Section 45 is the residuary provision: it catches a contravention of a subordinate instrument for which no penalty has been separately provided. It was amended twice.

Limb (C)(i) widens what it catches, replacing "rules or regulations" with "rules, regulations, directions or orders".

Limb (C)(ii) replaces the sanction entirely. The words it takes out are the only record on file of what section 45 used to say, because the consolidated print's own footnote for this change says merely for certain words:

"( ii ) for the words "compensation not exceeding twenty-five thousand rupees to the person affected by such contravention or a penalty not exceeding twenty-five thousand rupees", the following shall be substituted, namely:—"

And what goes in is this:

"penalty not exceeding one lakh rupees, in addition to compensation to the person affected by such contravention not exceeding— ( a ) ten lakh rupees, by an intermediary, company or body corporate; or ( b ) one lakh rupees, by any other person.".

3 changes are stacked in that one substitution, and they run in different directions.

The middle row is the one worth carrying away. Before 30 November 2023 section 45 reached a contravention of a rule or regulation made under the Information Technology Act for which no penalty was separately provided, and the person affected could be awarded at most twenty five thousand rupees. Limb (C)(i) then widened the trigger to a rule, regulation, direction or order, and limb (C)(ii) raised what the person affected can be awarded to up to ten lakh rupees where the contravener is an intermediary, company or body corporate and up to one lakh rupees where it is anybody else. Ten lakh is 40 times the old ceiling, and it sits in a provision almost nothing written about Indian data protection mentions.

Whether any given failure actually falls in section 45 is a separate question this page does not answer, because the section is residuary on its own terms and applies only where no penalty has been separately provided. That condition has to be tested against the instrument alleged to have been contravened.

Section 46 was widened, and 2 words came out of it

Limb (D) has 2 sub limbs and both matter to anybody asking who decides a claim:

"( D ) In section 46,— ( i ) in sub-section ( 1 ), for the words "under this Chapter", the words "under this Act" shall be substituted; ( ii ) in sub-section ( 1A ), the words "injury or" at both the places where they occur shall be omitted."

On this site's reading, sub limb (i) is a jurisdictional change of some size. Before, the adjudicating officer appointed under section 46 adjudged contraventions under this Chapter, which is Chapter IX. Now the officer adjudges contraventions under this Act. The office did not change; its reach did.

Sub limb (ii) is the omission this site has already caught an answer engine reproducing. Asked on 5 September 2026 who decides a data breach compensation claim, a generated answer quoted section 46(1A) as covering a claim for "injury or damage" not exceeding rupees five crore. Those 2 words were taken out at both places in that sub section on 30 November 2023, so an answer using them is quoting an Act that has not existed for nearly 3 years. The full reading is on can I sue under the DPDP Act, which sets out the section 43A route and the 5 crore adjudication limit around it.

Section 66A was finally taken off the statute book

Limb (E) is 1 sentence:

"( E ) Section 66A shall be omitted."

Section 66A was struck down by the Supreme Court in March 2015. It nonetheless remained printed in the Act for another 8 years, and the consolidated print records both events at the same place: the heading now sits in square brackets with a note that the section was omitted by Act 18 of 2023 with effect from 30 November 2023, and a separate footnote recording the 2015 order in Shreya Singhal v. Union of India. This site holds no copy of that judgment and cites the print for what the print records.

The CERT In consequence went up a hundredfold, and almost nobody says so

Limb (I) is 2 words in and 2 words out:

"( I ) In section 70B, in sub-section ( 7 ), for the words "one lakh", the words "one crore" shall be substituted."

Section 70B(6) is the power under which CERT In may call for information and give directions to service providers, intermediaries, data centres, body corporates and any other person. It is the power the CERT In directions of 28 April 2022 are issued under, and those directions are the reason an Indian organisation reports a cyber incident within 6 hours today, as set out in 72 hours to the Board, 6 hours to CERT In.

Section 70B(7) is what follows a failure to comply. On the print, the fine ceiling in it is now one crore rupees where it was one lakh. The imprisonment limb of 70B(7) is untouched by this Act.

Read that beside the DPDP Rules and the picture is not the one usually drawn. The Rule 7 breach duty owed to the Data Protection Board is in the group Rule 1(4) of the DPDP Rules 2025 puts 18 months out, read as corrigendum G.S.R. 892(E) substituted its closing words, and it has not commenced. Meanwhile the CERT In reporting duty has been running since 2022 and the money consequence attached to it was multiplied by 100 in 2023. The regime everybody is preparing for is dormant; the regime nobody writes about got sharper.

What entry 32 does not touch

This is the half that changes what a reader should conclude, and it is a set of measured absences rather than an argument.

Section 43A is the important one. This site has published that the DPDP Act has not repealed it, and that the direction to omit it in section 44(2) has not commenced. The Jan Vishwas Act adds a second, independent confirmation from a different direction: the one Act that did sweep through the Information Technology Act's sanctions in this period went past section 43A without naming it.

There is a symmetry worth noticing and not over reading. The Jan Vishwas Act No. 18 of 2023 and the Digital Personal Data Protection Act No. 22 of 2023 received the assent of the President on the same day, 11 August 2023. Both prints say so on their own faces. Neither Act mentions the other: the strings Digital Personal Data, Data Protection and 22 of 2023 appear 0 times in the 72 pages of the Jan Vishwas print, and the strings Jan Vishwas and 18 of 2023 appear 0 times in the Gazette print of the DPDP Act, both measured on 6 September 2026 and bounded to those 2 documents. That is all the 2 documents establish, and nothing about intention is claimed from it here.

Section 3, the clause that has not been reported at all

The strangest provision in the Act is 1 sentence long and applies to every enactment in the Schedule:

"The fines and penalties provided under various provisions in the enactments mentioned in the Schedule shall be increased by ten per cent. of the minimum amount of fine or penalty, as the case may be, prescribed therefor, after the expiry of every three years from the date of commencement of this Act."

On its face this is an escalator built into the statute: a periodic increase, repeating, with no further legislation needed.

It raises 3 questions this site does not answer, and says so rather than guessing.

Which commencement date? Section 3 counts from "the date of commencement of this Act", while section 1(2) permits different dates for amendments relating to different enactments. If the relevant date for the Information Technology Act group is the 30 November 2023 its consolidated print records, then the first expiry of 3 years falls on 30 November 2026, which is 85 days after 6 September 2026, the date this page was read against the prints. That date is computed here and is interpretation until officially confirmed. It also assumes a reckoning of when 3 years expire that this site has not tested, because how a period is computed under a Central Act is governed by the General Clauses Act, 1897, of which this site holds no copy and about whose content nothing is asserted here. The Act's own print supports neither the date nor the reading of section 3 that produces it.

Ten per cent of what? The clause operates on "the minimum amount of fine or penalty ... prescribed therefor". The provisions entry 32 amends do not prescribe minimums. Section 44 sets a penalty "not exceeding" a figure, and limbs (A), (F), (G), (J) and (K)(ii) all set a penalty "which may extend to" a figure. Those are ceilings. What a ten per cent increase of the minimum does to a provision that states only a maximum is not answered anywhere in the 72 pages.

Recorded where? Nothing in the Act names an authority to compute the increase or a place a revised figure would be published. No instrument recording any increase under section 3 is registered in this site's source registry. That negative is bounded: this site cannot search the eGazette portal from an automated session, because its search is a browser session form, so the absence is an absence from this registry and not a statement about the Gazette.

Until those are settled, the safe statement for a compliance document is the one the prints support: the figures in the limb by limb table near the top of this page are what the Information Technology Act prints today, and section 3 of the Jan Vishwas Act provides for a periodic increase whose operation on these provisions is unresolved.

A second Jan Vishwas Act exists, and it does not touch either statute

While checking the escalator, this site found something it had not read: the Jan Vishwas (Amendment of Provisions) Act, 2026, Act No. 8 of 2026, which received the assent of the President on 7 April 2026 and was published in the Gazette the next day.

The whole 186 page print was downloaded and searched on 6 September 2026. Across its 397,006 characters, the strings Information Technology, Data Protection, Digital Personal, 18 of 2023 and 21 of 2000 appear 0 times each.

So the 2026 Act does not amend the Information Technology Act, 2000, does not amend the DPDP Act 2023, and does not alter section 3 of the 2023 Act. Anything a reader is told about the 2026 Act changing India's data protection penalties is not in that document. The measurement is bounded to that print and to that date, and the Act is now on file so that the next person to ask does not have to take anybody's word for it.

What circulating summaries get wrong

What to do with this

If your risk register, your data processing agreements or your incident runbook quote the Information Technology Act, check the date they were written. Anything drafted before December 2023 is quoting figures that have moved and, in 5 places, describing a term of imprisonment the print no longer carries.

The 2 practical items are the pair at either end of the entry. Section 72A is the one to fix in contract language, because a clause that threatens a counterparty with imprisonment under it is now describing a provision that does not provide for imprisonment. Section 70B(7) is the one to fix in an incident runbook, because the cost of missing a CERT In direction is 100 times what most runbooks say it is.

Then note the date, 30 November 2023, and note that this page states it from the amendment footnotes of a consolidated print rather than from a commencement notification. If you need that notification for a filing, it is not among the documents this site holds.