Section 40: Penalty for unauthorised use by requesting entity or offline verification-seeking entity.

Whoever,—(a) being a requesting entity, uses the identity information of an individual in contravention of sub-section (2) of section 8; or

(b) being an offline verification-seeking entity, uses the identity information of an individual in contravention of sub-section (2) of section 8A, shall be punishable with imprisonment which may extend to three years or with a fine which may extend to ten thousand rupees or, in the case of a company, with a fine which may extend to one lakh rupees or with both.]