Section 72 of the Information Technology Act 2000 (amended in 2008):
Any person who has secured access to any electronic record, book, register, correspondence, information, document or other material without the consent of the person concerned discloses such information or material to any other person shall be punished.
Imprisonment term up to 2 years and fine; this may extend to Rs. 100000, or both.
Section 72A: Punishment for Disclosure of information in breach of lawful contract:
Any person including an intermediary who, while providing services under the terms of lawful contract, has secured access to any material containing personal information about another person, with the intent to cause or knowing that he is likely to cause wrongful loss or wrongful gain discloses, without the consent of the person concerned, or in breach of a lawful contract, such material to any other person shall be punished.
Imprisonment for a term which may extend to 3 years, or with a fine which may extend to Rs. 500000, or with both.