Data breach complaint process: documents and timeline

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 3 Nov 2026 · Court process

A data breach complaint in India usually runs on more than one track: the cyber-crime helpline, the police, your bank under RBI directions, and the Data Protection Board under the DPDP Act 2023. This guide sets out the order to follow, the documents that every forum asks for, and the timelines to expect at each stage.

Filing a data breach complaint in India is not one act but a short sequence. A single incident can trigger a report to the cyber-crime helpline, a police complaint, a notice to your bank and, where personal data is involved, a complaint to the Data Protection Board. Each forum wants the same core facts but frames them differently, so the documents you prepare at the start serve every stage that follows.

The process below is written for an individual who has just learned that their personal data was exposed and now needs to act. It assumes no special technical knowledge. The order matters, because an early acknowledgement number and a clean evidence file make every later step easier and faster, and a missing acknowledgement is one of the most common reasons a complaint stalls.

Is a data breach complaint criminal, civil or regulatory?

A breach can give rise to all three kinds of proceeding, and in practice it usually triggers at least two. Treating them as one undifferentiated complaint is the first mistake, because each has a different forum, a different standard and a different remedy.

Criminal: where an attacker accessed or stole data, complaints proceed under IT Act sections 43, 66, 66C and 66D, and where the data is used for cheating or forgery, under the Bharatiya Nyaya Sanhita 2023.
Civil: where an organisation failed to protect sensitive personal data, a claim for compensation can be made under IT Act sections 43 and 43A.
Regulatory: duties to notify a personal data breach sit under the Digital Personal Data Protection Act 2023, while banks and payment entities answer to RBI directions on incident handling and customer liability.

Knowing which of these you are pursuing shapes the documents you gather. A criminal complaint needs proof of intrusion and loss; a civil claim needs proof of the organisation's security failure; a regulatory complaint needs the breach notification and the organisation's response. The good news is that a single well-kept evidence folder can feed all three.

What the complaint must actually say

Officials act on specifics. A complaint that says the data was leaked and the writer is very disturbed will be read politely and set aside. A complaint that states four things in plain order gets routed to someone who can do something with it.

The date and time you learned of the breach, and how you learned of it.
What personal data was involved, described concretely: name, phone number, address, identification number, account details.
Who you believe held the data, and what they have told you so far.
What loss or risk you have suffered, with amounts and reference numbers wherever money moved.

Attach the chronology as a single page. If you do not know some of these facts, say so plainly rather than guessing. An honest gap is easier for an investigator to fill than a confident but wrong detail that has to be corrected later, and a corrected complaint loses credibility at exactly the point you need it most.

How to file the complaint, step by step

Work through these steps in order. Do not skip the first, because every later step depends on the record it creates.

Preserve everything before you change anything: the breach notification, any scam messages, screenshots with dates, and the original files wherever possible.
Call the national cyber-crime helpline on 1930 if money has moved or an account has been taken over, and note the acknowledgement number.
File the complaint on the National Cyber Crime Reporting Portal at cybercrime.gov.in, uploading the evidence as one organised set rather than scattered images.
Give a written complaint at the police station with jurisdiction, and keep a stamped copy of the receipt; an oral complaint leaves no trail.
If the police decline to register it, send the complaint to the Superintendent of Police, and thereafter to the Magistrate if nothing changes.
If an organisation leaked your data, send it a written notice asking what was affected, when, and what notification it has issued to the Board and to you.
Record every reference number, from the helpline and portal to the police station, in one place so you can quote them on demand.

Where a bank transaction is involved, add one more step and treat it as urgent: inform the bank or payment provider the same day and ask for the transaction to be flagged and for a written position on liability under the RBI directions. The bank's own clock starts when you tell it, not when it notices.

If the breach came from an organisation

Where a company, hospital, insurer or portal lost your data, the complaint has a different centre of gravity. You are not only reporting a crime; you are putting the organisation on notice that it owes you an explanation. Write to its grievance officer or data protection contact, keep the acknowledgement, and ask three specific questions: what categories of your data were affected, when the incident occurred and was detected, and what notification it has issued.

If the reply is evasive, that evasiveness becomes part of your record. Under the Digital Personal Data Protection Act 2023, a data fiduciary has duties that include notifying a personal data breach to the Data Protection Board and to affected individuals. An organisation that stays silent is not merely being unhelpful; it may be failing a statutory obligation. Keep the written exchange, because a regulator or a court will weigh what the organisation said against what it should have said.

Documents you must keep ready

Investigators and regulators rarely ask for anything exotic; they ask for the same few items, so prepare them once.

Document	Why it matters
Identity proof	Establishes you as the affected person and matches you to the leaked data
Breach notification, if any	Shows the organisation knew and what it admitted
Dated screenshots	Preserves the state of the account or message when you first saw it
Bank or wallet statements	Documents any unauthorised transaction and its reference number
Correspondence with the organisation	Proves what you were told and whether you were refused information
A plain chronology	Turns scattered events into a sequence any official can follow
Acknowledgement numbers	Links each later step back to the earlier complaint

The timeline you can expect

Timelines in India are driven by urgency rather than by a single fixed schedule, and different stages move at different speeds.

Stage	What happens	Pace to expect
Bank or wallet report	Transaction flagged, liability position recorded	Same day, as soon as you learn of it
Helpline 1930	Acknowledgement number issued	Immediately on the call
Portal complaint	Complaint registered and routed	Within days of filing
Police station	Written complaint received, FIR considered	Depends on the station and the offence
Escalation to SP or Magistrate	Direction to register or investigate	Weeks, not hours
Regulatory complaint to the Board	Organisation asked to respond	Governed by the Board's process

Which forum for which relief

The forum follows the relief you actually want, not the size of your frustration.

To get money reversed after an unauthorised transaction: your bank or payment provider, under the RBI directions.
To get an offender investigated: the police, following the 1930 and portal complaints.
To get compensation from an organisation that failed to protect data: a civil claim resting on IT Act sections 43 and 43A.
To get an organisation to explain and notify a breach: a complaint grounded in the Digital Personal Data Protection Act 2023.
To compel a reluctant police station to act: the Superintendent of Police and, if needed, the Magistrate.

If identity documents were exposed

Leaked identification numbers create a slow, quiet risk that outlasts the original incident. A copied document can be used months later to seek credit, open an account or verify a fraudulent transaction. The complaint should therefore include a request that the exposure be recorded, and you should keep a note of which documents leaked so that any later misuse can be connected to this event.

Where credit or an account appears in your name without your knowledge, that is a fresh harm with its own remedy. Report it to the lender, ask for the application records, and add it to the same chronology. A pattern of linked misuse is easier to prove, and harder to dismiss, than a single unexplained entry on a credit report.

What decides the outcome

Whether the evidence was preserved before the account or device was changed.
Whether you reported the money loss promptly, which directly affects the bank's liability.
Whether the leaked data can be linked to the specific harm you suffered.
Whether you kept acknowledgements that connect each stage of the complaint.
Whether any organisation involved has a record of the same failure, which strengthens the pattern.

Following up after you file

Filing is not the end of the process. Keep the acknowledgement numbers together in one place, and check back at reasonable intervals rather than daily. If a stage produces no movement, a short written reminder that quotes the earlier reference is more effective than a fresh complaint, because it forces the office to connect the two. Where a bank has not reversed a transaction or given a written liability position, a follow-up in writing creates the record you would need if the matter later goes further.

Finally, keep the evidence frozen. Do not clean up the phone, do not delete the scam messages, and do not overwrite the screenshots with edited copies. The value of everything you prepared at the start survives only if it is left intact while the complaint is pending.

Common mistakes

Filing only on the platform and assuming that is a legal complaint.
Describing the incident in long emotional terms instead of dates, amounts and references.
Uploading evidence as loose images with no dates or explanation.
Making an oral police complaint and leaving with no receipt.
Waiting to gather "perfect" evidence before reporting anything at all.

When to involve a lawyer

Many complaints move smoothly without legal help, especially where a bank reverses a small transaction after a prompt report. A lawyer adds value when the police are slow or refuse to register the FIR, when the amount is large enough that the bank disputes its liability, when an organisation refuses to disclose what leaked, or when you are considering a compensation claim under IT Act section 43A. In those situations a cyber crime lawyer in Kolkata can organise the file, draft the notice to the organisation and the representation to the police, and keep the criminal and civil tracks consistent.

Before any of that, though, the first and cheapest step is to contact the office and set out what happened. Use the contact page to describe the incident in a short, dated summary, and you will get a practical view of which of the routes above actually applies to your case rather than a generic checklist.

The value of preparing well is that it removes the excuses others use to delay. A complaint with dates, references and a clean chronology is hard to set aside, whether it sits before a bank, a police station, a regulator or a court.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

Where do I file a data breach complaint in India?

You file in more than one place, depending on the harm. Report money loss and account takeovers on the 1930 helpline and cybercrime.gov.in, give a written complaint at the police station, notify your bank to trigger the RBI liability process, and, where an organisation leaked personal data, complain under the DPDP Act 2023. Each forum needs the same core facts.

What documents should I keep for a data breach complaint?

Keep identity proof, the breach notification if you received one, dated screenshots, bank or wallet statements showing any transaction, your correspondence with the organisation, a plain chronology of events, and every acknowledgement number. These few items satisfy almost every forum. Preparing them once at the start avoids repeated running around later.

How long does a data breach complaint take in India?

There is no single fixed timeline. Bank reports are treated same day, the helpline issues an acknowledgement immediately, portal complaints register within days, and police action depends on the station and the offence. Escalation to the Superintendent of Police or the Magistrate can take weeks. Regulatory complaints move at the Board's own pace.

Can I complain about a breach without losing any money?

Yes. An unauthorised access or disclosure of your personal data can be reported even if nothing was taken from you, and an organisation's failure to protect sensitive personal data or to notify you can be raised under the DPDP Act 2023 and, where applicable, IT Act section 43A. Loss makes a claim stronger but is not always required to complain.

Is a police FIR necessary for every data breach?

No, not every breach needs an FIR. Where there is clear intrusion or fraud, an FIR is the natural route. Where the issue is an organisation's failure to protect or notify, the regulatory and civil routes matter more. A lawyer can help you decide which is proportionate before you spend effort on the wrong forum.

What if the police refuse to register my data breach complaint?

If a police station declines, you can send a written complaint to the Superintendent of Police of the district, and if that produces no result, approach the Magistrate. Keep the earlier written complaint and any receipt, because escalation depends on showing that a complaint was made and not acted upon. A lawyer can prepare the representation efficiently.

Should I tell my bank before the police about a breach?

Yes. Tell your bank or payment provider the same day, because under RBI directions your liability for an unauthorised transaction depends on how promptly you reported it. The police complaint protects the criminal side, but it does not reverse money. Reporting to the bank first safeguards the sum while the rest of the complaint proceeds in parallel.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact