THE GAZETTE OF INDIA EXTRAORDINARY 6 Insertion of new section 40A. Duties of subsoriber of Electronic [Parr II— 19. After section 40 of the principal Act, the following section shall be inserted, namely:— the subscriber shall perform “40A. In respect of Electronic Signature Certificate such duties as may be prescribed.”. Signature Certificate. 20. In Chapter IX of the principal Act, in the heading, for the words “PENALTIES AND Amendment of ADJUDICATION ”, the words “PENALTIES, COMPENSATION AND ADJUDICATION” shall be substituted. Cait < Amendment of = 21. In section 43 of the principal Act.— (@) in the marginal heading, for the word “Penalty”, the words “Penalty and Compensation” shall be substituted; (6) in clause (a), after the words “computer network”, the words “or computer resource” shall be inserted; (c) after clause (/), the following clauses shall be inserted, namely:— “(i) destroys, deletes or alters any information residing in a computer by any means; resource or diminishes its value or utility or affects it injuriously steal, conceal, to person (J) steal, conceals, destroys or alters or causes any destroyor alter any computer source code used for a computer resource with an intention to cause damage;”; (d) for the portion begining with the words “he shall be liable to pay damages” and ending with the words “persons so affected” the following shall be substituted, namely:— “he shall be liable to pay damages by way of compensation to the person so affected”; (é) in the Explanation, after clause (iv), the following clause shall be inserted, Insertion of new section 434, Compensation Fe aaa. namely:-— ‘(v) “computer source code” means the listing of programmes, computer commands, design and layout and programme analysis of computer resource in any form.”. 22. After section 43 of the principal Act, the following section shall be inserted, namely:— e ‘43. Where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate shall be liable to pay damages by way of compensation to the person so affected. Explanation.—For the purposes of this section— () “body corporate” means any company and includes a firm, sole proprietorship of other association of individuals engaged in commercial or professional activities; (ii) “reasonable security practices and procedures” means security to protect such information from unauthorised practices and procedures designed access, damage, use, modification, disclosure or impairment, as may be specified in an agreement between the parties or as may be specified in any law for the time being in force and in the absence of such agreement or any law, such reasonable security practices and procedures, as may be prescribed by the Central” Government in consultation with such professional bodies or associations as it may deem fit;