Which amendment to the Information Technology Act (IT Act) introduced…

Concept

A country's cyber law typically has a principal Act that lays down the original legal framework, and separate amendment Acts passed later to add or update specific provisions — for example, to cover new categories of offence or new protections — as technology, business practices, and threats evolve.

Application

India's Information Technology Act, 2000 established the original legal framework for electronic transactions and cyber offences, but it did not contain dedicated provisions for protecting sensitive personal data or for identity theft. To close this gap, Parliament enacted the Information Technology (Amendment) Act, 2008, which inserted, among other changes, a section imposing civil liability/compensation on a body corporate that fails to protect sensitive personal data, and a section criminalising identity theft. This is precisely the pair of provisions the question describes, so the amending Act is the one passed in this year.

Contrast with the other years

• 2000 is the year the original Act itself was enacted — before any amendment, and therefore before these specific provisions existed.

• 2005 saw no amendment Act passed to the Information Technology Act.

• 2018 also saw no enacted amendment to the Information Technology Act; that year is better known for the Srikrishna Committee's report on data protection and an early draft data-protection bill, not a change to this Act's text.

Result

Only one offered year matches an actual, enacted amendment carrying these provisions, confirming that option as correct.