Data breach what it is and how it works in India

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 3 Nov 2026 · Cyber law

A data breach is the unauthorised access, disclosure, loss or alteration of personal data held by an organisation. In India the consequences run on two tracks. The organisation that held the data faces duties under the IT Act 2000 and the Digital Personal Data Protection Act 2023, while the person whose data leaked may face identity theft, fraud and financial loss dealt with under the IT Act and the Bharatiya Nyaya Sanhita 2023. Knowing which track applies to you decides what you do next.

Most people hear the word breach only after their information is already circulating, often when a scam call arrives quoting a policy number or an old address. By then the immediate question is not how the breach happened but what the leak lets a fraudster do, and what rights the affected person has. Indian law now places real obligations on the entity that lost the data, and those obligations are separate from the criminal conduct of the attacker.

What a data breach actually is

A breach is not only a dramatic hack. It is any incident in which personal data is accessed, copied, altered or lost without authorisation. Regulators and courts look at the effect on the individual, not at how sophisticated the attacker was, so a careless spreadsheet can be as damaging as a targeted intrusion.

• Accidental exposure, such as a database or cloud folder left publicly reachable.
• Insider misuse, where a person with legitimate access copies or leaks records.
• Ransomware or malware that steals data before encrypting it.
• Compromised credentials, where an attacker logs in with a valid password.
• A lost or stolen laptop, phone or storage device holding unencrypted data.
• A breach at a vendor or contractor that held data on your behalf.

What these have in common is that a stranger, or an insider acting wrongly, came into possession of personal data that belonged to someone else and was not theirs to take or keep.

It helps to separate personal data from sensitive personal data. Financial details, health records, passwords and identification numbers carry more risk than a name alone, and the law treats the more sensitive categories with more care. The distinction matters because the duty to protect, and the consequence of failing, can differ depending on what was lost. For the individual, though, the practical worry is the same: data that identifies them is now in the wrong hands.

Breaches recur for a simple reason. Data is valuable and controls are inconvenient, so a single weak link, an unpatched system, a reused administrator password or a rushed vendor, is often enough. Many organisations also hold data they never truly needed to keep, which enlarges the harm beyond the incident itself.

How long you have to act, and why timing matters

Two clocks run after a breach, and they are not the same clock. The organisation's clock concerns its own duties, including notifying the Data Protection Board and the affected individuals under the DPDP Act, and reporting a cyber incident through the channels applicable to it. Your clock concerns the consequences you face personally, and it usually runs faster.

Where the breach leads to an unauthorised electronic transaction, RBI directions tie how much of the loss you bear to how quickly you reported. A customer who raises the alarm within a short window is treated far more favourably than one who notices months later. That is why the first call should go to the bank, and not to a friend who might explain what to do. Delay does not merely weaken a complaint; under the RBI framework it can directly reduce what you get back.

How a breach turns into fraud

The leak is usually only the first step. Months can pass before the data is used, which is why the fraud often feels unrelated to the original incident.

1. An organisation collects and stores personal data such as names, phone numbers, identification numbers and addresses.
2. An attacker obtains a copy of part or all of that data.
3. The data is sorted and sold, or used directly, often combining it with details from other leaks.
4. Fraudsters call, message or email victims quoting the real details, which makes the approach convincing.
5. The victim's identity is used to open accounts, take loans, or divert a one-time password.
6. Money moves, and the victim usually learns of it only when a statement or a recovery agent arrives.

Because the fraud is built on genuine data, the usual scam-detection advice feels useless to the victim. Real policy numbers, real names and real addresses are exactly what make the approach believable.

The law: IT Act 2000

The Information Technology Act predates the data-protection statute and still governs liability where an organisation fails to protect data it holds.

• IT Act section 43: unauthorised access, downloading, copying or extracting data, which also supports a claim for compensation.
• IT Act section 43A: a body corporate that possesses, deals with or handles sensitive personal data and fails to implement reasonable security practices is liable to compensate affected persons.
• IT Act section 66: computer-related offences committed dishonestly or fraudulently.
• IT Act section 72: breach of confidentiality and privacy by a person who accessed data under a power or contract.
• IT Act sections 66C and 66D: identity theft and cheating by personation, where your leaked data is used to impersonate you.

The civil limb in section 43 and the compensation duty in section 43A are what most affected individuals overlook, because they assume only the police can act. They cannot substitute for a police complaint, but they are a distinct route.

The law: Digital Personal Data Protection Act 2023

The Digital Personal Data Protection Act 2023 creates a framework of rights for the data principal, the individual to whom the data relates, and duties for the data fiduciary, the organisation that decides how the data is processed. Among the clearest duties is an obligation to notify a personal data breach to the Data Protection Board and to the affected data principals. The regime is overseen by the Data Protection Board of India, and the Act provides for penalties where duties are breached.

The Act is being brought into force in stages, and some obligations depend on further rules and on how the Board applies them. Where the law is unsettled, it is safer to say so plainly than to promise a particular outcome. What is clear is that notification after a breach is now a statutory expectation, not a courtesy, and that a victim can point to the Act when an organisation stays silent.

RBI directions and the banking sector

Where the leaked data concerns bank accounts or payment instruments, RBI directions matter as much as the data-protection law. Banks and regulated payment entities operate under RBI rules on cyber security and on limiting the liability of customers for unauthorised electronic transactions. Those directions require reporting of incidents and allocate loss depending on whether the customer was negligent and how quickly the unauthorised transaction was reported. A customer who does not report promptly can be held partly liable, even if the root cause was the bank's own failure.

In practice this means two separate duties can arise from one incident. The bank's own regulator may require it to report and to make customers whole according to the RBI framework, while the data-protection law imposes notification duties on the entity that held the personal data. A customer does not have to choose between them. Reporting to the bank protects the money; the data-protection angle protects the record and the right to be told what happened.

Who can be held liable

Several parties can be liable at the same time, and the remedy differs for each.

What to do if your data was breached

1. Confirm, in writing, what data was affected and when, from the organisation that held it.
2. Change the passwords of any account that used the leaked email or phone, and enable two-factor authentication.
3. Watch your bank and credit records for accounts or loans you did not open.
4. Report any unauthorised transaction to the bank and to the police; where money has moved, call 1930.
5. Preserve the breach notification, emails and any scam messages, with dates.
6. If the organisation refuses to explain or to notify, record that refusal in writing.

What decides the outcome

• Whether the organisation implemented the security practices it should have, which is the core of a section 43A claim.
• Whether you reported a resulting unauthorised transaction promptly, which affects bank liability.
• Whether the leaked data can be linked to the specific fraud you suffered.
• Whether the organisation notified the Board and the affected individuals.
• Whether records exist that let an investigator trace the data back to the disclosure.

Common mistakes

• Assuming a breach is only the platform's problem and that nothing can be claimed.
• Discarding the breach notification email, which is the first evidence of the leak.
• Ignoring small unauthorised transactions, which may be tests before a larger one.
• Reusing the password that appeared in the leak.
• Waiting until money has clearly disappeared before reporting anything.

When to involve a lawyer

Where a breach leads to a small, reversed transaction, the bank's process may be enough. Legal help becomes valuable when the organisation refuses to disclose what leaked, when identity theft has caused loans or accounts to appear in your name, when a claim for compensation is being considered against a body corporate, or when a bank is shifting blame onto you. A cyber crime lawyer in Kolkata can set out the section 43A position, draft the demand to the organisation, and run the criminal complaint alongside any civil claim.

For readers outside the metro, the practical questions are usually about where to file and which forum hears the compensation claim, and the West Bengal cyber crime practice covers those logistics. Where the breach is the latest in a pattern, older write-ups on similar incidents are collected under our blog, which can help you frame the demand to the organisation before any formal step.

A breach rarely ends with one event. It typically produces an exposure, a possible fraud, and a dispute about who should have protected the data. Treating those as separate problems, each with its own evidence and its own forum, is what makes recovery realistic rather than rhetorical.

Finally, it is worth keeping a calm written record from the first day. Note what you were told, by whom, and when, and keep copies of every notification. That file, assembled early, does more for a breach victim than any single dramatic step taken later, because it turns a confusing episode into a sequence a bank, a regulator or a court can actually follow.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Matrimonial fraud: what it is and how it actually runs
• Trading app scam: what it is and how the fraud runs
• Stock market scam: how the fraud actually runs in India
• Sextortion: What It Is and How the Fraud Actually Runs
• Mutual fund scam: what it is and how the fraud runs
• Loan app harassment what it is and how it works

Cyber crime lawyer in your city · Bank account freeze help · Contact