Chapter VII OFFENCES AND PENALTIES

Whoever impersonates or attempts to impersonate another person, whether dead or alive, real or imaginary, by providing any false demographic information or biometric information, shall be punishable with imprisonment for a term which may extend to three years or with a fine which may extend to ten thousand rupees or with both.

Whoever, with the intention of causing harm or mischief to an Aadhaar number holder, or with the intention of appropriating the identity of an Aadhaar number holder changes or attempts to change any demographic information or biometric information of an Aadhaar number holder by impersonating or attempting to impersonate another person, dead or alive, real or imaginary, shall be punishable with imprisonment for a term which may extend to three years and shall also be liable to a fine which may extend to ten thousand rupees.

Whoever, not being authorised to collect identity information under the provisions of this Act, by words, conduct or demeanour pretends that he is authorised to do so, shall be punishable with imprisonment for a term which may extend to three years or with a fine which may extend to ten thousand rupees or, in the case of a company, with a fine which may extend to one lakh rupees or with both.

Whoever, intentionally discloses, transmits, copies or otherwise disseminates any identity information collected in the course of enrolment or authentication to any person not authorised under this Act or regulations made thereunder or in contravention of any agreement or arrangement entered into pursuant to the provisions of this Act, shall be punishable with imprisonment for a term which may extend to three years or with a fine which may extend to ten thousand rupees or, in the case of a company, with a fine which may extend to one lakh rupees or with both.

Whoever, not being authorised by the Authority, intentionally,---

1. (a) accesses or secures access to the Central Identities Data Repository;
2. (b) downloads, copies or extracts any data from the Central Identities Data Repository or stored in any removable storage medium;
3. (c) introduces or causes to be introduced any virus or other computer contaminant in the Central Identities Data Repository;
4. (d) damages or causes to be damaged the data in the Central Identities Data Repository;
5. (e) disrupts or causes disruption of the access to the Central Identities Data Repository;
6. (f) denies or causes a denial of access to any person who is authorised to access the Central Identities Data Repository;
7. (g) reveals any information in contravention of sub-section (5) of section 28, or shares, uses or displays information in contravention of section 29 or assists any person in any of the aforementioned acts;
8. (h) destroys, deletes or alters any information stored in any removable storage media or in the Central Identities Data Repository or diminishes its value or utility or affects it injuriously by any means; or
   • (i) steals, conceals, destroys or alters or causes any person to steal, conceal, destroy or alter any computer source code used by the Authority with an intention to cause damage, shall be punishable with imprisonment for a term which may extend to 1[ten years] and shall also be liable to a fine which shall not be less than ten lakh rupees. Explanation.--- For the purposes of this section, the expressions "computer contaminant", "computer virus" and damage shall have the meanings respectively assigned to them in the Explanation to section 43 of the Information Technology Act, 2000 (21 of 2000), and the expression "computer source code" shall have the meaning assigned to it in the Explanation to section 65 of the said Act.

Whoever, not being authorised by the Authority, uses or tampers with the data in the Central Identities Data Repository or in any removable storage medium with the intent of modifying information relating to Aadhaar number holder or discovering any information thereof, shall be punishable with imprisonment for a term which may extend to 1[ten years] and shall also be liable to a fine which may extend to ten thousand rupees.

1[40. Penalty for unauthorised use by requesting entity or offline verification-seeking entity.--- Whoever,--- (a) being a requesting entity, uses the identity information of an individual in contravention of sub-section (2) of section 8; or

1. (b) being an offline verification-seeking entity, uses the identity information of an individual in contravention of sub-section (2) of section 8A, shall be punishable with imprisonment which may extend to three years or with a fine which may extend to ten thousand rupees or, in the case of a company, with a fine which may extend to one lakh rupees or with both.]

Whoever, being an enrolling agency or a requesting entity, fails to comply with the requirements of sub-section (2) of section 3 or subsection (3) of section 8, shall be 1[liable to penalty which may extend to one lakh rupees, or in the case of a company, with penalty which may extend to ten lakh rupees].

Whoever commits an offence under this Act or any rules or regulations made thereunder for which no specific penalty is provided elsewhere than this section, shall be punishable with imprisonment for a term which may extend to 1[three year] or with a fine which may extend to twentyfive thousand rupees or, in the case of a company, with a fine which may extend to one lakh rupees, or with both.

1. (1) Where an offence under this Act has been committed by a company, every person who at the time the offence was committed was in charge of, and was responsible to, the company for the conduct of the business of the company, as well as the company, shall be deemed to be guilty of the offence and shall be liable to be proceeded against and punished accordingly: Provided that nothing contained in this sub-section shall render any such person liable to any punishment provided in this Act if he proves that the offence was committed without his knowledge or that he had exercised all due diligence to prevent the commission of such offence.
2. (2) Notwithstanding anything contained in sub-section (1), where any offence under this Act has been committed by a company and it is proved that the offence has been committed with the consent or connivance of, or is attributable to, any neglect on the part of any director, manager, secretary or other officer of the company, such director, manager, secretary or other officer shall also be deemed to be guilty of the offence and shall be liable to be proceeded against and punished accordingly. Explanation.—For the purposes of this section—
   • (a) "company" means any body corporate and includes a firm or other association of individuals; and
   • (b) "director", in relation to a firm, means a partner in the firm.

1. (1) Subject to the provisions of sub-section (2), the provisions of this Act shall apply also to any offence or contravention committed outside India by any person, irrespective of his nationality.
2. (2) For the purposes of sub-section (1), the provisions of this Act shall apply to any offence or contravention committed outside India by any person, if the act or conduct constituting the offence or contravention involves any data in the Central Identities Data Repository.

Notwithstanding anything contained in the Code of Criminal Procedure, 1973 (2 of 1974), a police officer not below the rank of Inspector of Police shall investigate any offence under this Act.

No penalty imposed under this Act shall prevent the imposition of any other penalty or punishment under any other law for the time being in force.

1. (1) No court shall take cognizance of any offence punishable under this Act, save on a complaint made by the Authority or any officer or person authorised by it. 1[Provided that the court may, on a complaint made by an Aadhaar number holder or individual take cognizance of any offence punishable under section 34 or 35 or 36 or 37 or 40 or section 41.]
2. (2) No court inferior to that of a Chief Metropolitan Magistrate or a Chief Judicial Magistrate shall try any offence punishable under this Act.