# Re-identification and processing of de-identified personal data

# Bare Act

# Section 82(1)

Any person who, knowingly or intentionally

  • (a) re-identifies personal data which has been de-identified by a data fiduciary or a data processor, as the case may be; or
  • (b) re-identifies and processes such personal data as mentioned in clause (a), without the consent of such data fiduciary or data processor, then, such person shall be punishable with imprisonment for a term not exceeding three years or with a fine which may extend to two lakh rupees or both.

# Section 82(2)

Nothing contained in sub-section (1) shall render any such person liable to any punishment under this section, if he proves that—

  • (a) the personal data belongs to the person charged with the offence under sub-section (1); or
  • (b) the data principal whose personal data is in question has explicitly consented to such re-identification or processing as per the provisions of this Act.
Last Updated: 13 Dec 2019