It Act Applicability To Biotech Data Breaches

Introduction

The Information Technology Act, 2000 (IT Act) plays an important role in regulating cybersecurity violations, unauthorised access, electronic-data misuse and digital security breaches in India. Its applicability extends to biotechnology organisations that collect, store, process or transmit sensitive digital information.

Biotechnology companies, pharmaceutical laboratories, genetic research institutions, hospitals and agricultural biotechnology organisations maintain substantial quantities of digital information. Such information may include genetic sequences, patient medical records, clinical trial results, biological research data, intellectual property and confidential commercial information.

A biotech data breach occurs when such information is accessed, disclosed, altered, destroyed or transferred without proper authorisation. These incidents may create privacy risks, financial losses, research disruption and threats to public health.

The IT Act provides legal mechanisms for addressing several forms of cyber misconduct and establishing liability for failures involving data protection and information security.

Meaning And Nature Of Biotech Data Breaches

Biotech data breaches involve unauthorised access, disclosure, manipulation or destruction of digitally maintained biological and scientific information.

Major categories include:

1. Genetic Data Breaches

Genetic information may reveal sensitive details about an individual's biological characteristics and inherited conditions. Unauthorised disclosure may affect personal privacy and create discrimination risks.

2. Clinical Research Data Breaches

Pharmaceutical companies and research institutions maintain clinical trial records, participant information and experimental results. Unauthorised access may compromise confidentiality and research integrity.

3. Pharmaceutical Intellectual Property Theft

Cybercriminals may obtain confidential drug-development information, laboratory findings, research methodologies and proprietary biological technologies.

4. Agricultural Biotechnology Data Breaches

Biotechnology companies may store genetic information concerning modified crops, seed-development research and agricultural experiments. Unauthorised access may affect commercial interests and regulatory compliance.

5. Healthcare Data Breaches

Hospitals and diagnostic laboratories may experience unauthorised disclosure of patient records, medical histories and laboratory reports.

Applicability Of The Information Technology Act, 2000

The IT Act provides several provisions relevant to biotech data breaches.

1. Section 43 – Unauthorised Access And Damage

Section 43 deals with unauthorised access to computer systems and certain related activities.

It covers conduct such as:

Accessing computer systems without permission.

Downloading or copying information without authorisation.

Introducing computer contaminants or viruses.

Damaging computer systems or data.

Disrupting computer networks.

Denying authorised users access to information.

For example, if an individual unlawfully accesses a biotechnology company's research database and copies confidential genetic research information, Section 43 may become relevant.

2. Section 43A – Failure To Protect Sensitive Personal Data

Section 43A historically provided compensation where a body corporate handling sensitive personal data was negligent in implementing and maintaining reasonable security practices, resulting in wrongful loss or wrongful gain.

However, Section 43A has been omitted with effect from 13 November 2025 under the Digital Personal Data Protection Act, 2023 framework.

Therefore, it should not be presented as the current standalone compensation provision for new data breaches. Earlier incidents may require examination under the law applicable when they occurred.

3. Section 65 – Tampering With Computer Source Documents

Section 65 penalises intentional concealment, destruction or alteration of computer source code required to be maintained by law.

This provision may become relevant where someone deliberately manipulates legally required software source-code records in a biotechnology organisation.

4. Section 66 – Computer-Related Offences

Section 66 criminalises acts referred to in Section 43 when committed dishonestly or fraudulently.

For example, deliberately hacking into a pharmaceutical research database to steal confidential information may attract this provision, depending on the facts.

5. Section 66C – Identity Theft

Section 66C addresses fraudulent or dishonest use of another person's electronic signature, password or unique identification feature.

It may apply where attackers misuse login credentials belonging to biotechnology researchers, laboratory personnel or patients.

6. Section 66D – Cheating By Personation Using Computer Resources

This provision addresses cheating through personation by using communication devices or computer resources.

It may apply to fraudulent digital communications used to obtain confidential research information or access biotechnology databases.

7. Section 72 – Breach Of Confidentiality And Privacy

Section 72 penalises certain unauthorised disclosures of information obtained through powers conferred under the IT Act.

Its application is limited to the circumstances specified in the provision. It does not create a general offence covering every private-sector data breach.

Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 is particularly important for biotechnology organisations handling identifiable digital information.

Its provisions apply to digital personal data processed within India and certain processing activities outside India where the statutory conditions are satisfied.

Important requirements include:

Section 4: Grounds for processing personal data.

Section 5: Notice requirements.

Section 6: Consent.

Section 8: General obligations of Data Fiduciaries.

Section 8(5): Reasonable security safeguards.

Section 8(6): Intimation of personal-data breaches.

Section 10: Additional obligations of Significant Data Fiduciaries.

Where identifiable genetic or health information qualifies as personal data, biotechnology organisations must comply with applicable obligations under the Act.

The DPDP framework operates alongside the IT Act, and the applicable provisions depend on the nature of the breach and the commencement of the relevant statutory requirements.

IT Rules And Cybersecurity Obligations

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 primarily regulate intermediaries and are not a universal cybersecurity code for all biotechnology companies.

The CERT-In Directions issued under Section 70B of the IT Act in 2022 establish important cybersecurity reporting and record-maintenance requirements for covered entities.

Relevant requirements include:

Reporting specified cyber incidents to CERT-In within six hours of noticing them or being brought to notice of them.

Maintaining ICT-system logs securely for a rolling period of 180 days within Indian jurisdiction.

Providing specified information when lawfully required.

Biotechnology organisations covered by these directions must consider them while developing incident-response procedures.

Important Case Laws

1. Shreya Singhal v. Union of India (2015)

The Supreme Court examined the constitutional validity of Section 66A of the IT Act and struck it down for violating freedom of speech under Article 19(1)(a).

Although the case did not directly concern biotechnology data breaches, it established important principles concerning constitutional limitations on cyber legislation.

2. Justice K.S. Puttaswamy v. Union of India (2017)

The Supreme Court recognised privacy as a fundamental right under Article 21 and other constitutional freedoms.

The judgment is particularly significant for biotechnology organisations because genetic information, medical records and identifiable biological data may reveal highly personal information.

It provides the constitutional foundation for protecting informational privacy.

3. Sharat Babu Digumarti v. Government of NCT of Delhi (2017)

The Supreme Court examined the relationship between the IT Act and general criminal-law provisions in the context of electronic material.

The Court emphasised the importance of applying the specific statutory framework governing electronic offences.

The judgment is relevant when determining the appropriate legal provisions for cyber-related misconduct.

4. State of Tamil Nadu v. Suhas Katti (2004)

This is an important early Indian cybercrime prosecution under the IT Act.

The accused was convicted in connection with online harassment and the publication of obscene material through electronic communications.

The case demonstrates the practical use of the IT Act in prosecuting cyber offences.

5. Anvar P.V. v. P.K. Basheer (2014)

The Supreme Court examined the admissibility of electronic records under the former Indian Evidence Act.

The judgment emphasised compliance with statutory requirements for proving electronic evidence.

For biotech data-breach investigations, reliable digital evidence and proper preservation of electronic records are essential.

6. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020)

The Supreme Court clarified the requirements for admissibility of electronic records under the former Section 65B of the Indian Evidence Act.

The decision is important when presenting server logs, electronic communications, database records and digital forensic reports in court.

Responsibilities Of Biotechnology Organisations

Biotechnology organisations should establish comprehensive data-security and breach-response systems.

Their responsibilities include:

Maintaining secure research databases and laboratory information systems.

Restricting access to genetic and clinical information.

Using appropriate encryption and authentication safeguards.

Maintaining accurate digital access records.

Conducting periodic cybersecurity assessments.

Reporting applicable cybersecurity incidents within prescribed timelines.

Informing affected individuals and authorities where required by applicable law.

Preserving electronic evidence for investigation and legal proceedings.

Challenges In Applying The IT Act To Biotechnology

Several difficulties arise when applying cyber laws to biotechnology data breaches:

Genetic information may reveal highly sensitive personal characteristics.

Research databases may contain both personal and commercially confidential information.

Cyberattacks may originate outside India.

Scientific databases often involve multiple institutions and international collaborators.

Determining responsibility among technology providers and research organisations can be difficult.

Digital evidence may be altered, deleted or encrypted during an attack.

Different legal frameworks may apply simultaneously to one incident.

Conclusion

The Information Technology Act, 2000 provides an important legal framework for addressing unauthorised access, computer-related offences, identity theft and certain confidentiality violations involving biotechnology data.

Sections 43, 66, 66C, 66D and 72 are particularly relevant, depending on the nature of the incident. Section 43A should be treated as a historical provision because it was omitted with effect from 13 November 2025. The Digital Personal Data Protection Act, 2023 now provides an additional framework for protecting identifiable digital personal information.

Judgments such as K.S. Puttaswamy v. Union of India, Shreya Singhal v. Union of India and Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal establish important principles concerning privacy, cyber regulation and electronic evidence.

Ultimately, biotechnology organisations must maintain strong cybersecurity safeguards, protect genetic and clinical information, preserve digital evidence and comply with applicable breach-reporting requirements. These measures are essential for protecting scientific research, individual privacy and public confidence in biotechnology institutions.