Unauthorized access to the central identities repository is a criminal offence carrying imprisonment and a mandatory fine. Section 38 criminalises unauthorised acts regarding the Central Identities Data Repository: unauthorised access; downloading, copying or extracting data; introduction of computer viruses or contaminants; damage, deletion, alteration or destruction of data or source code; disruption or denial of authorised access; improper revelation, sharing or use of information; and assisting such acts. The provision applies to removable storage media and invokes IT Act definitions for computer virus, contaminant, damage and computer source code.