Here are the answers based on the chronology you provided:

1. On Day 31, can someone sue the company for negligence under Section 43A of the IT Act, 2000?

   • No, Section 43A would no longer be applicable after the new law (DPDP 2023) has been approved by the President, even though the rules have not yet been notified. Once the DPDP 2023 comes into force, Section 43A is removed from the IT Act. Therefore, after the approval of DPDP, Section 43A ceases to have legal effect. The company can no longer be sued under Section 43A after the new law has been passed, even if the rules are still pending.

2. On Day 41, can someone retroactively sue the company for negligence on Day 30 under the DPDP 2023?

   • It depends on the specific provisions of the DPDP 2023 and its rules once they are finalized and enforced. If the rules and enforcement provisions are published on Day 40, the law could be applied retroactively depending on the provisions within DPDP 2023. However, generally, laws don't apply retroactively unless explicitly stated. The company could potentially be sued for negligence under the DPDP 2023 only after it has been notified and the enforcement mechanisms are in place. The rules published on Day 40 would define the scope of application, penalties, and enforcement.

Thanks and Regards,
Advocate Aman Verma
Legal Corridor

The DPDP Act was passed in early August 2023. The act will be enforced when the central government issues a notification for the same.

companycannot be sued retrospectively for negligence as the section stands removed

The individuals who are harmed by a data breach may be able to sue the company for damages under the India Digital Personal Data Protection Act (DPDP Act): 

A company can be held liable if it is negligent in implementing reasonable security practices and procedures (RSPP). This includes non-compliance with the data processing principles, such as notice, consent, purpose limitation, data accuracy, and grievance redressal.

Data principals must first seek redressal through the Data Fiduciary's grievance mechanism. They can only approach the DPB if they are unable to get their grievance redressed through this mechanism. 
Penalties are assessed based on several factors, including the nature, duration, and recurrence of violations.

No they can’t sue retrospectively unless there is provision for the same in law

Dear Client,

On Day 31, the company can still be sued for negligence under Section 43A of the IT Act, 2000, in case the DPDP Act, 2023 has not been notified. Unless the new law is in force, the IT Act is still applicable, and the data protection obligations shall be governed by Section 43A. However, as the penalty under Section 43A is restricted, the compensation could be meager.

On Day 41

Once the DPDP Act, 2023 is notified and is fully in operation, it can only be prospectively applied unless the Act specifically provides otherwise. Thus, for instance, a violation on Day 30 would not be covered under the DPDP Act, as the breach took place before the enforcement of the Act. You will have to pursue the same under the law that was effective on the date of the breach, i.e., under Section 43A of the IT Act, 2000. Pursuing a claim

Do let me know if I can help you further.

1. Data breached on day 30. Dpdp came into force on day 40.

Breach is governed by Section 43A as dpdp came into  force repelling Section 43A on day 40. (Section 43A removed after gap of 10 days)

1. Penal law operates prospectively, breach on day 40 not covered by new Act.

# Applicable Laws

1. *IT Act 2000 (Section 43A)*: This section imposed liability on corporate bodies for data protection. Although it had a low penalty for violations, it was the applicable law until the DPDP Act 2023 was notified.

2. *DPDP Act 2023*: This law was approved by the President on Day 20 but wasn't notified until Day 40, when the rules were published. The DPDP Act 2023 removes Section 43A from the IT Act 2000 and introduces stricter penalties for cybersecurity violations.

# Answers to Your Questions

*1. Can someone sue the company for negligence under Section 43A on Day 31?*

Although Section 43A was removed from the IT Act 2000 when the DPDP Act 2023 was approved (Day 20), the DPDP Act 2023 wasn't notified until Day 40. Since the DPDP Act 2023 wasn't in force on Day 31, Section 43A was technically still applicable. However, it's essential to note that the court might consider the legislative intent and the fact that the DPDP Act 2023 was approved, albeit not notified.

*2. Can someone retroactively sue the company for negligence on Day 30 under the DPDP Act 2023 on Day 41?*

Generally, laws are not applied retroactively, especially when they impose stricter penalties. The DPDP Act 2023 came into force on Day 40, when it was notified. Applying the DPDP Act 2023 retroactively to an incident that occurred on Day 30 might be challenging.

However, Indian courts have, in some cases, applied laws retroactively if:

- The new law is beneficial to the parties involved.

- The legislative intent is clear.

- The parties had sufficient notice of the impending change.

In this scenario, since the DPDP Act 2023 imposes stricter penalties, it's unlikely that the court would apply it retroactively. Nevertheless, the court's decision would depend on the specific circumstances and the arguments presented.

Keep in mind that these answers provide a general understanding of the applicable laws and are not exhaustive. For a more detailed analysis, consult with a legal expert specializing in Indian data protection laws.

- Adv.LavishTegta (High court of himachal pradesh)

If they are service provider and you are consumer then only it will come under CP Act 2019

Since section 43A has no specific penalty, the compensation that can be awarded is of 25k only

You can file a complaint before the consumer forum if you so desire

Data principals must first seek redressal through the Data Fiduciary's grievance mechanism. They can only approach the DPB if they are unable to get their grievance redressed through this mechanism. 
Penalties are assessed based on several factors, including the nature, duration, and recurrence of violations.

The quantum of damages for a data breach without tangible financial loss is challenging to quantify but may include nominal compensation under Section 43A of the IT Act (default ₹25,000) or punitive damages if negligence is severe. Courts may consider privacy violations, emotional distress, and the potential risks of phishing/scamming. While the Consumer Protection Act, 2019, requires a consumer relationship, free services linked to paid offerings or violations of terms of service (ToS) and privacy policies may suffice. A consumer court claim could be strengthened by statutory violations, such as the non-disclosure of a grievance officer, failure to respond to breach notifications, or gross negligence. Alternatives include filing with a cyber adjudicating officer or pursuing tort-based claims in civil court. Establishing a breach of privacy and negligence will be crucial to seek appropriate compensation.