Data Breach is not a punishable crime in India

Everytime, a major data breach occurs in India, we hear about the number of records exposed over dark web and telegram groups. A follow up statement would be released that the matter will be investigated but there is a bigger question that requires more attentions.

The organization acknowledges the incident, authorities are informed, an investigation is promised, and the public is assured that appropriate action will be taken.

Then the news cycle moves on!

What happens to the company responsible for keep it safe at first place?

Are organizations held accountable when their customer data, medical records, financial information, personal documents get exposed to threat actors? Are they informed about this? Are investigations done into their security practices? Are executives and power players questioned? Are penalties imposed? Does anyone every get compensated for their losses?

Well, India has laws addressing data protection, negligence and unauthorised disclosures, but the record of meaningful consequences for organizations involved in these breaches appears remarkably limited.

I see this as not simply a cybersecurity problem, It is more of an accountability problem (Something not new in India)

Subscribe now

The Historical Beginning: How far does the trail go?

My searches went to 2002-2009 era. That’s when headlines about data breaches appeared for the first time.

2002 - IITK: Theft and sale of source code
2005 - Citibank: Employees extracted American customers’ bank information, fraud involving approximately 1.9CR INR
2005 - Infinity e-Systems: 1000 bank customers account numbers and passwords stolen.
2009 - Symantec Call Centre: BBC investigation exposing sale of customer credit and debit information.

These incidents are important because they show that the problem predates the modern data protection debates. The question here: Did India learn anything from this? or did accountability problems continue as organizations accumulated larger databases?

Nature of information being collected changed.
The scale of databases changed.
The consequences became more serious.
But people who had to face consequences, disappeared!

The Laws of the Land

It would definitely be a crime to say India has no legal provisions addressing data protection. Information Technology Act, 2000 addresses data thefts, negligence and disclosures.

Section 43A of IT Act is particularly relevant as it provides compensation when a body handling sensitive information is negligent in implementing reasonable security practices.

The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, further established security obligations for organisations handling sensitive personal data.

**So the question becomes more interesting:
**If legal provisions addressing corporate negligence existed, why does the record of enforcement against organisations involved in major data breaches appear so limited?

The Breaches: What Happened After?

Fast-forward to the 2020s. India had become increasingly dependent on digital platforms. Banking, healthcare, insurance, e-commerce, telecommunications and government services were collecting enormous quantities of personal information.

The potential consequences of a data breach had grown considerably and then came a series of incidents:

BigBasket (2020)

In November 2020, reports emerged that personal information belonging to approximately 20 million BigBasket customers was being offered for sale on the dark web.

The reported information included names, email addresses, phone numbers, addresses, dates of birth and password hashes.

BigBasket acknowledged the incident, initiated an investigation and filed a complaint with the Bengaluru Cyber Crime Cell.

But what happened after that? Was the organisation held accountable for any established failure to protect customer information? Was compensation awarded to affected customers? Was there any publicly documented regulatory action against the company?

MobiKwik (2021)

In March 2021, cybersecurity researchers alleged that the personal information of approximately 110 million MobiKwik users had been exposed.

The alleged dataset included KYC documents, phone numbers, email addresses and other customer information.

MobiKwik initially denied the allegations, stating that it had not identified any security lapse. Following further reports, the company said it would commission an independent forensic audit and cooperate with the relevant authorities.

This incident raises another question. When an organisation disputes a breach, who independently establishes what happened, what information was exposed and whether the organisation complied with its security obligations?

Air India (2021)

In May 2021, Air India disclosed a cybersecurity incident involving its passenger service system provider, SITA.

Approximately 4.5 million passengers were affected. The information reportedly included names, dates of birth, contact details, passport information, ticket information and frequent-flyer details.

Air India stated that it had taken steps to secure the compromised systems and notified relevant authorities.

This case also raises questions about responsibility across technology supply chains. When an organisation outsources the storage and processing of customer information, does its responsibility towards those customers disappear when a third-party system is compromised?

ICMR (2023)

In October 2023, reports emerged that a dataset allegedly containing information relating to approximately 81.5 crore people was being offered for sale on the dark web.

The reported information included names, Aadhaar details, passport information and other personal identifiers.

The figure was an allegation concerning the size of the dataset, not a verified count of unique individuals affected.

Delhi Police subsequently arrested four individuals in connection with the investigation.

There was criminal investigation and action against alleged perpetrators. But what about the institutions responsible for the underlying information? Was institutional negligence established? Were the custodians of that information held accountable?

These are two separate questions, and answering one does not answer the other.

Star Health (2024)

The Star Health incident deserves particular attention because of the sensitivity of the information involved.

In 2024, customer medical records, diagnoses, test results, insurance documents and other personal information were exposed through Telegram bots and websites.

The threat actor claimed to possess information relating to millions of customers. Star Health acknowledged unauthorised access, reported the incident to authorities and initiated investigations.

The incident eventually received attention in Parliament. In a written response in July 2025, the government confirmed that CERT-In had received a report from the company in August 2024, provided remedial measures and shared its technical analysis with Tamil Nadu Police for further investigation.

But this case had another development.

In July 2025, Star Health disclosed that IRDAI had imposed a penalty of ₹3.39 crore under its Information and Cyber Security Guidelines, 2023. The company’s stock exchange filing described the penalty as relating to certain aspects of data protection and cybersecurity safeguards. This was a sectoral regulatory action, not a penalty under the DPDP Act.

This is an important example of an organisation facing regulatory consequences. But it also raises a question: how many other major incidents have resulted in comparable action?

Ultrahuman (2026)

In June 2026, Bengaluru-based wearable technology company Ultrahuman disclosed that attackers had gained unauthorised read-only access to an internal analytics system containing customer information.

The incident had occurred on 27 March 2026. The company said the attackers used credentials stolen from an employee’s malware-infected laptop.

The information potentially accessed included customer contact details, account information, transaction history and fitness-related data. Ultrahuman said passwords and payment information were not affected.

The company also acknowledged that it delayed notifying affected customers while it assessed the extent of the incident.

This is an interesting case because the information involved was not conventional banking or identity data. It included personal wellness information generated through a wearable device.

As more companies enter the business of collecting health and behavioural data, the responsibility to protect that information becomes increasingly important.

Reliance Group and the Kudankulam connection (2026)

In July 2026, reports emerged of data exposed from a server hosted by a third-party provider associated with the Reliance Group.

MediaNama reported that the leaked files included material related to the Kudankulam Nuclear Power Plant. Reliance reportedly confirmed a partial data breach, while CERT-In was said to be examining the incident.

This incident is slightly different from the others because it raises questions beyond consumer privacy, including the security of sensitive industrial and infrastructure-related information.

It also brings us back to the issue of third-party service providers. When sensitive information is stored outside an organisation’s own infrastructure, who takes responsibility when that infrastructure is compromised?

State Bank of India (2026)

In October 2026, SBI disclosed an incident involving the exposure of 3,897 customer records on the dark web.

The bank said a preliminary examination identified names, mobile numbers, dates of birth, email addresses, residential addresses, customer identifiers and loan-related information.

SBI stated that it had received alerts from CERT-In, the Defence Cyber Agency and its threat intelligence provider. It subsequently engaged an independent cybersecurity agency to investigate the incident.

The bank also clarified that customer balances and core banking operations were not affected.

But the distinction between financial theft and personal data exposure is important. A customer’s money being safe does not mean their personal information is safe.

What happened to the exposed records? How were they accessed? Were the affected customers notified? What did the investigation establish about the bank’s security practices?

These questions deserve answers beyond an assurance that banking operations remain unaffected.

Bank of Baroda (2026)

In July 2026, Bank of Baroda confirmed a security incident involving unauthorised access to an employee’s email account.

The bank acknowledged that certain data had been accessed by threat actors and said that it had initiated containment measures and a forensic investigation.

The incident followed claims by a threat actor that nearly 1 TB of information had been stolen. The claimed volume and scope of the data were not independently verified.

Bank of Baroda maintained that its core banking systems had not been compromised.

Again, the public was informed that an investigation was underway. But what will that investigation establish about the security controls, access management and internal safeguards that were in place?

AU Small Finance Bank (2026)

Towards the end of October 2026, reports emerged that a threat actor was claiming to possess customer KYC documents, PAN and Aadhaar details and loan-related information belonging to AU Small Finance Bank customers.

On 2 November, the bank informed stock exchanges that it was investigating a potential data leakage incident involving a third-party software platform used to onboard vehicle-loan customers.

The bank said preliminary findings suggested that some customer information might have leaked. It also stated that its other systems remained unaffected and that the matter had been reported to the RBI and CERT-In.

The bank did not confirm the wider claims made by the threat actor.

This is another example of the risks associated with third-party platforms handling sensitive customer information.

Rajasthan Police and the Central Board of Film Certification (2026)

The concerns are not restricted to private companies.

In October 2026, a cybercrime group claimed to have accessed Rajasthan Police systems and offered identity records, mobile numbers and documents linked to FIRs and other government records for sale. Rajasthan Police initiated an investigation, but the authenticity and scale of the claimed exposure remained unverified.

Around the same period, reports alleged unauthorised access to documents on the Central Board of Film Certification’s eCinePramaan portal, including material associated with more than 500 films.

The CBFC disputed the claim, stating that it had found no trace of the documents allegedly accessed. It nevertheless filed a complaint with cybercrime authorities as a precaution and notified CERT-In.

These incidents demonstrate that the issue extends beyond private-sector data custodians. Government departments and public institutions also collect and retain sensitive information, often on a massive scale.

Unocoin (November 2026)

As recently as 12 November 2026, Indian cryptocurrency exchange Unocoin announced that it had detected unauthorised activity on its systems on 6 and 9 November.

The exchange suspended its services and began rebuilding its server infrastructure after establishing that its systems had been compromised.

At the time of its announcement, the company said it was still investigating which systems had been accessed and what information might have been exposed. It was also examining transactions involving one of its cryptocurrency wallets.

This is a developing incident, and the extent of any personal data exposure has not yet been established.

But it adds another organisation to the growing list of Indian businesses dealing with serious cybersecurity incidents.

A pattern worth examining

Looking across these incidents, a few things become apparent.

The organisations involved operate in completely different sectors. Some hold medical records, others financial information, identity documents, passenger records or government data.

The methods of compromise differ too. Some incidents involve third-party service providers, others involve stolen employee credentials, ransomware, compromised accounts or vulnerabilities in digital infrastructure.

But the aftermath often follows a familiar pattern.

An incident is reported. The organisation issues a statement. Authorities are informed. A forensic investigation is initiated.

And then, for the public, the trail becomes difficult to follow.

This does not mean that no action is taken behind the scenes. Some investigations are confidential, some remain ongoing, and some incidents may not establish negligence by the organisation at all.

But shouldn’t there be a transparent record of the outcome?

How many investigations concluded that an organisation failed to maintain reasonable security safeguards? How many resulted in penalties? How many affected individuals received compensation?

In March 2026, a question specifically asking the Union Government about data breaches, government databases, cybersecurity audits and the number of penalties or enforcement actions for failure to report or prevent breaches was raised in the Lok Sabha.

The government’s response provided information about CERT-In’s role, security audits and the DPDP Act’s penalty framework. It did not provide a numerical breakdown of penalties or enforcement actions in response to that part of the question.

That omission is worth examining.

If the government is tracking incidents, conducting audits and maintaining cybersecurity institutions, the public should also be able to understand what enforcement follows when organisations fail in their responsibilities.

The question is no longer whether India experiences data breaches. It clearly does.

The question is what happens after them.

The People Who Actually Face the Consequences

Now comes the part that I find particularly interesting.

When we examine the aftermath of these incidents, a recurring pattern emerges. Investigations frequently focus on identifying the individuals responsible for accessing, stealing, selling or distributing the information.

That is necessary. Cybercriminals must be investigated and prosecuted.

But it is only one side of the issue.

What about the organisation entrusted with safeguarding that information?

There is an important difference between prosecuting someone who steals data and establishing whether an organisation was negligent in protecting it.

One does not replace the other.

To be fair, there have been instances where organisations faced regulatory or financial consequences.

RailYatri (2022–2023)

In December 2022, CERT-In informed IRCTC about a data leak involving information acquired and maintained by the RailYatri application.

According to a written parliamentary response in March 2023, IRCTC suspended the ticket-booking facility on the application, imposed a penalty on the company responsible for operating it and restored the service after necessary security measures were implemented.

This is an important example because it demonstrates that organisational accountability is possible. However, the government response did not disclose the amount of the penalty or provide a detailed account of the findings against the company.

Star Health (2025)

Another important development came in July 2025.

Following the 2024 data breach, the Insurance Regulatory and Development Authority of India (IRDAI) imposed a penalty of ₹3.39 crore on Star Health under its Information and Cyber Security Guidelines, 2023.

In its stock exchange disclosure dated 26 July 2025, the company confirmed that the penalty concerned certain aspects of data protection and cybersecurity safeguards. It also stated that it was evaluating its options, including a possible appeal before the Securities Appellate Tribunal.

This is a significant example of a sectoral regulator imposing a financial penalty on an organisation following a major data breach.

However, it also raises another question: why do we have so little publicly accessible information about comparable regulatory outcomes across other major data breaches?

A case under Section 43A: IndusInd Bank and Amos Corporation

There is also an interesting case concerning the actual application of Section 43A of the IT Act.

In February 2025, the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) delivered its judgment in IndusInd Bank Ltd. v. Amos Corporation & Others.

The dispute originated from a 2014 incident involving unauthorised banking transactions worth ₹14.26 lakh. A fraudulent duplicate SIM card had been issued using forged documents, allowing criminals to facilitate the transactions.

The Gujarat adjudicating officer had directed IndusInd Bank to reimburse ₹1.5 lakh and pay an additional ₹50,000 as a penalty for failures in following its security procedures. Idea Cellular was also directed to pay ₹50,000 for deficiencies in its KYC verification.

The matter eventually reached TDSAT, which dismissed the appeals and upheld the relevant directions.

This case is particularly relevant because it demonstrates that compensation and financial consequences under the existing legal framework are not merely theoretical.

However, it was an individual commercial banking fraud involving security and KYC failures, not a mass exposure of millions of customers’ personal information.

It is important not to confuse the two.

These examples establish that organisations can face consequences. But they also leave us with a much larger question.

Where is the comparable accountability across the numerous large-scale data breaches that have exposed millions of Indians’ personal information?

The New Law: Will the DPDP Act Change Anything?

In August 2023, India enacted the Digital Personal Data Protection Act. It was a significant development in the country’s data protection framework.

The Act recognises the rights of individuals over their personal data and establishes obligations for organisations that determine the purpose and means of processing that information.

It also provides for substantial financial penalties.

Under its penalty schedule, failure to take reasonable security safeguards to prevent a personal data breach can attract a penalty of up to ₹250 crore.

The Digital Personal Data Protection Rules, 2025, were notified in November 2025. However, their implementation follows a staggered timeline.

As of 14 November 2026, the framework is still in transition.

The provisions concerning Consent Managers have commenced, but the principal obligations on Data Fiduciaries, including security safeguards, breach notifications and the associated penalty provisions, are scheduled to come into force on 13 May 2027.

There is another development worth mentioning.

Although the Data Protection Board of India was formally established in November 2025, its appointment process has been considerably delayed.

In an August 2026 parliamentary response, the Ministry of Electronics and Information Technology confirmed that applications for the Chairperson and four Members had been advertised in June 2026.

The situation subsequently reached the Kerala High Court in October 2026. In a petition concerning passenger data and digital services, the government informed the court that the Board had been constituted but was yet to become functional. The court expressed the expectation that it would be made functional within eight weeks.

As of 14 November 2026, I could not establish from publicly available appointment notifications that the Board had become operational.

This matters because the Board is central to the enforcement architecture of the new Act. Its inquiry and penalty powers are scheduled to commence alongside the principal obligations in May 2027.

So, while India has legislated a framework with penalties of up to ₹250 crore, the principal enforcement machinery is still being put in place.

And that brings us back to the original question.

Will the new framework actually change how organisations are held accountable, or will it become another set of provisions that look reassuring on paper but struggle to translate into effective enforcement?

A penalty of ₹250 crore sounds significant. But a penalty provision means very little if investigations are not completed, violations are not established and penalties are not imposed.

The effectiveness of the DPDP Act will ultimately be judged not by the size of the penalties it prescribes, but by whether those penalties are actually enforced.

The Accountability Gap

There is something fundamentally wrong with how we discuss data breaches.

When an individual’s information is stolen, the conversation immediately shifts towards the hacker. We discuss their methods, their tools, the vulnerabilities exploited and the possibility of arrest.

But the organisation that collected the information in the first place often becomes a secondary part of the conversation.

Consider what we are asking citizens to do.

We ask them to submit Aadhaar details to access services, share medical histories with hospitals and insurance companies, provide financial information to banks, and surrender personal information to practically every digital platform they use.

In return, these organisations are expected to protect that information.

It is not an unreasonable expectation. It is a fundamental responsibility.

And when that responsibility is compromised, citizens deserve more than an apology and an assurance that security measures will be strengthened.

They deserve answers.

Was the organisation following reasonable security practices?
Were known vulnerabilities ignored?
Was the breach caused by negligence, inadequate security or an insider?
Did the organisation notify affected individuals?
Were independent audits conducted?
Was the organisation investigated under applicable legal provisions?
Were penalties imposed where violations were established?
Were affected individuals compensated for demonstrable losses?

These questions should not disappear once the immediate threat has been contained.

There should be a publicly accessible record of what happened after major incidents: the investigations, their findings, the regulatory decisions and the consequences.

Without that transparency, it becomes difficult for citizens to distinguish between an investigation that leads to accountability and one that simply concludes with an organisation announcing that it has improved its security.

Conclusion: Your Data Is Valuable. Is Your Privacy?

India’s digital transformation has been remarkable. We have built extensive digital public infrastructure, expanded online banking, digitised healthcare services and made personal data an integral part of everyday transactions.

But the growth of digital infrastructure also comes with an enormous responsibility.

Every organisation collecting personal information is effectively asking people to trust it with something that cannot simply be replaced once exposed.

A leaked password can be changed. A compromised credit card can be blocked. But what happens when someone’s medical history, identity documents, address, financial records and other deeply personal information are circulating across the internet?

You cannot simply change your identity because an organisation failed to protect it.

And yet, the consequences of these incidents often seem to end with the investigation of the alleged perpetrators, a statement from the company and another news story.

I am not arguing that every company experiencing a data breach should automatically be punished. A breach alone does not establish negligence. Even organisations with strong security practices can become victims of sophisticated attacks.

But every major incident deserves an independent examination of the organisation’s security practices, its compliance with the law and the decisions that contributed to the exposure.

If negligence is established, there must be consequences.
If citizens suffer demonstrable losses, there must be accessible remedies.
And if an organisation fails in its responsibility to protect personal information, it should not be able to simply wait for the news cycle to move on.

We cannot build a digital economy on the assumption that citizens will keep trusting institutions regardless of how those institutions handle their data.

India does not merely need laws that promise to protect personal information. It needs an enforcement system that demonstrates that those laws apply to the organisations holding that information, too.

Because when millions of people’s data is exposed, the question should never end with who stole it.

We must also ask who failed to protect it, why they failed, and what consequences followed.

Thanks for reading ryndeer! Subscribe for free to receive new posts and support my work.