What Happens to the SPDI Rules and Section 43A on 13 May 2027

What changed

Since 2011, India's working data protection law has been one section of the Information Technology Act, 2000 (the IT Act) and one set of rules. Both end in May 2027. Section 44(2) of the Digital Personal Data Protection Act, 2023 (the DPDP Act) commences with the Act's main provisions on 13 May 2027 under notification G.S.R. 843(E). A January 2026 proposal to shorten the timetable has not been notified.

1. 1.Section 43A is omitted. It makes a body corporate that handles sensitive personal data and is "negligent in implementing and maintaining reasonable security practices and procedures", causing wrongful loss or gain, compensate the person affected.
2. 2.The section 81 proviso is extended. Section 81 gives the IT Act overriding effect; its proviso protects rights under the Copyright Act, 1957 and the Patents Act, 1970. The words "or the Digital Personal Data Protection Act, 2023" are added after the Patents Act.
3. 3.Section 87(2)(ob) is omitted. It is the power to prescribe "the reasonable security practices and procedures and sensitive personal data or information under section 43A".

Do the SPDI Rules lapse?

The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the SPDI Rules) were made under "clause (ob) of subsection (2) of section 87 read with section 43A". They list sensitive data, including passwords, financial details, health, sexual orientation and biometrics (r.3); require a privacy policy (r.4), written consent for sensitive data (r.5(1)) and a grievance officer who replies within a month (r.5(9)); and accept a documented security programme, naming ISO/IEC 27001 (r.8(2)), audited at least yearly (r.8(4)).

Trayambic's sector studies have said that, in our view, the Rules lapse on 13 May 2027. Rules live on their parent power, and both the power and the provision the Rules serve disappear that day. Section 24 of the General Clauses Act, 1897 keeps rules alive only where the parent Act is "repealed and re-enacted", and only "so far as it is not inconsistent with the provisions re-enacted". Section 43A is not re-enacted: the DPDP Act's security duty (s.8(5)) binds every data fiduciary (any business deciding how personal data is processed), carries penalties rather than compensation, and has its own rules (Rule 6). So s.24 does not save them.

Pending and accrued claims

Section 6 of the General Clauses Act says that, unless a different intention appears, a repeal does not affect any liability "acquired, accrued or incurred", and proceedings for it "may be instituted, continued or enforced" as if the repeal had not happened. In Fibre Boards (P) Ltd v CIT, (2015) 10 SCC 333, the Supreme Court held that "repeal" in ss.6 and 24 includes express omission (para 29). Earlier decisions, Rayala Corporation (1969) and Kolhapur Canesugar Works (2000), saw it differently for rules omitted by notification, and Fibre Boards noted that s.6 does not itself reach subordinate legislation (para 27).

In our view, because a Central Act omits a provision of a Central Act and the DPDP Act shows no contrary intention, a claim for loss from negligence before 13 May 2027 survives. It may be filed or continued before the adjudicating officer under s.46 (claims up to ₹5 crore; larger claims go to the competent court), with appeal to the Telecom Disputes Settlement and Appellate Tribunal (ss.48(1), 57). The SPDI Rules as they then stood would set the standard. Expect defendants to contest this.

What survives

Section 72A survives: a service provider under a lawful contract who discloses personal information without consent or in breach of contract remains liable. Secondary sources say the Jan Vishwas (Amendment of Provisions) Act, 2023 replaced its prison term with a penalty of up to ₹25 lakh from 30 November 2023. Section 43, compensation from anyone who accesses or damages a computer without permission, also stays. What goes is compensation from a negligent custodian: DPDP penalties are credited to the Consolidated Fund of India (s.34).

In our view the s.81 change stops the IT Act and its rules being used to cut down DPDP rights. Where IT rules require retention, such as the intermediary rules' 180-day hold on closed accounts, the DPDP Act's own exception for legally required retention (s.12(3)) reconciles the two. The proviso reinforces s.38(2), under which the DPDP Act prevails in a conflict.

Who is affected

• Every body corporate handling sensitive data, which under s.43A includes firms and sole proprietorships in business or a profession. SPDI duties continue until 13 May 2027.
• Parties to s.43A claims arising from incidents before that date.
• Anyone whose contracts borrow the s.43A standard. Reasonable security practices may be those "specified in an agreement between the parties", so many service agreements, data processing addenda and outsourcing contracts define security by reference to s.43A, the SPDI Rules or ISO/IEC 27001. Those clauses still bind as contract terms but lose their statutory reference point.
• Privacy policies and consent forms drafted to rules 4 and 5.
• Intermediaries. Rule 3(1)(i) of the intermediary rules points to the SPDI Rules for security; in our view, as Trayambic's social media study explains, DPDP Rule 6 becomes the working standard.
• People harmed by later breaches, who lose the IT Act compensation route.

What to do now

1. 1.Keep complying until the last day. Written consent for sensitive data, one-month grievance replies and the annual audit remain mandatory, and liability for earlier negligence can outlast 13 May 2027.
2. 2.Find every reference. Search contracts, policies, consent text and vendor questionnaires for "43A", "SPDI", "sensitive personal data or information" and "reasonable security practices".
3. 3.Make security clauses stand alone. Name the controls (encryption, access control, logging, backups, incident response), notice windows that fit CERT-In's six hours and the DPDP Rules' 72-hour report, audit rights and deletion. The SPDI Rules' nod to ISO/IEC 27001 (r.8(2)) lapses with them, so contract for the controls and keep certification as one form of assurance.
4. 4.Add a change-in-law clause reading SPDI references as references to the DPDP Act and Rules, and revisit indemnities and caps written around s.43A compensation.
5. 5.Replace the rule 4 privacy policy with notices meeting Rule 3 of the DPDP Rules. Keep your sensitive-data discipline: the DPDP Act has no special category, but the security duty bites hardest there.
6. 6.Preserve evidence for older incidents. Open a litigation hold where a pre-May 2027 incident could lead to a claim; Trayambic's whitepaper on retention, deletion and logs explains how to scope one.
7. 7.Brief procurement and sales, who will meet SPDI references in old templates.

The SPDI regime ends with no transition clause. Rewrite now, before an incident tests it.

Key takeaways

• On 13 May 2027 the DPDP Act omits IT Act s.43A and s.87(2)(ob) and adds the DPDP Act to the s.81 proviso.
• In our view the SPDI Rules lapse then: their parent power goes and s.24 of the General Clauses Act does not save them, because s.43A is omitted, not re-enacted.
• In our view s.6 of the General Clauses Act and Fibre Boards preserve s.43A claims for negligence before that date, but expect the point to be argued.
• Section 72A and s.43 survive; compensation against a negligent custodian does not, and DPDP penalties go to the Consolidated Fund.
• Rewrite security clauses, privacy policies and indemnities that cite s.43A, the SPDI Rules or ISO 27001 deemed compliance before May 2027.