1. What is Data Security & Breach Notification?

Data Security: Obligation of a body corporate / Data Fiduciary to implement Reasonable Security Practices and Procedures to protect Personal Data / Sensitive Personal Data or Information (SPDI) from unauthorized access, disclosure, alteration or destruction.

Personal Data Breach: Any unauthorized processing, accidental loss, destruction, or unlawful access to personal data.

Breach Notification: Legal duty to inform regulators and affected individuals within a prescribed time, with impact assessment and mitigation steps.

2. Legal Framework in India

A. Under IT Act, 2000 (Currently Applicable Regime)

1. Section 43A - Compensation for failure to protect data: If a body corporate possessing, dealing or handling SPDI is negligent in implementing reasonable security practices and thereby causes wrongful loss or wrongful gain, it is liable to pay compensation to the affected person. There is no statutory cap in the Act itself, compensation up to Rs. 5 crore was practiced under IT Rules, and courts have interpreted it liberally.

2. Section 72 & 72A - Criminal liability: Disclosure of information in breach of lawful contract - imprisonment up to 2 years / 3 years and fine up to Rs. 1 lakh / 5 lakh.

3. IT (Reasonable Security Practices and Procedures and SPDI) Rules, 2011: Mandates Privacy Policy, Grievance Officer, consent for SPDI, and IS/ISO/IEC 27001 or other prescribed standard as reasonable security practice.

4. CERT-In Directions, 28 April 2022: All cyber security incidents including data breaches must be reported to CERT-In within 6 hours of noticing. Logs to be kept for 180 days within India.

B. Under DPDP Act, 2023 & DPDP Rules, 2025 (Future Regime)

India is in transition. The DPDP Act, 2023 has been enacted but staggered commencement is being followed.

• Section 8(5): Data Fiduciary must protect personal data by taking reasonable security safeguards.
• Section 8(6) + Rule 7 of DPDP Rules, 2025: Mandates intimation of personal data breach to Data Protection Board of India and to each affected Data Principal.

New timelines emerging:

One breach, many clocks - A single breach can trigger multiple notifications:

Penalty under DPDP: Up to Rs. 250 crore per breach, to be credited to Consolidated Fund of India. Important change - compensation to user under Section 43A will be removed once DPDP is fully notified.

3. What Must a Breach Notification Contain?

As per CERT-In and DPDP Rules template:

1. Nature and date of breach, how discovered
2. Type and volume of data affected (SPDI, financial, biometric)
3. Number of Data Principals affected
4. Likely consequences and risk severity
5. Measures taken / proposed to mitigate
6. Contact of Data Protection Officer
7. Logs, forensic evidence

Failure to notify is itself a separate violation and an aggravating factor in penalty.

4. Case Laws

A. Indian Case Laws

1. Justice K.S. Puttaswamy (Retd.) vs Union of India (2017) 10 SCC 1:
Supreme Court declared Right to Privacy as fundamental right under Article 21. Foundation for all data protection litigation. Held that informational privacy is part of privacy, state and private entities must have legitimate aim, proportionality and safeguards.

2. SMC Pneumatics (India) Pvt. Ltd. vs Jogesh Kwatra (Delhi High Court, 2014) - First Indian case on data breach liability:
Employee sent defamatory emails after being terminated. Court held company liable under Section 43A for failing to protect access controls. Established employer's duty to revoke credentials.

3. Adjudicating Officer, Maharashtra - Complaint of Professor vs Bank & Mobile Service Provider (Pune, 2013):
Victim lost Rs. 46 lakhs due to SIM swap fraud. Adjudicating Officer held both Bank and Mobile Service Provider liable under Section 43A and ordered compensation of Rs. 6 lakhs and Rs. 12 lakhs respectively. Landmark because it fixed joint liability for failure to implement reasonable security practices.

4. CBI vs Arif Azim (Sony Sambandh Case, 2013):
First conviction under IT Act for hacking and data theft from Sony India website. Upheld validity of Section 43 and 66.

5. Avnish Bajaj vs State (Bazee.com Case, 2005):
CEO arrested for sale of obscene MMS clip. Established intermediary liability principle - intermediaries must exercise due diligence. Now codified as safe harbour under Section 79.

6. Recent Breach Incidents triggering Section 43A Notices (not yet Supreme Court precedents but regulatory actions):

• Air India (2021): 4.5 million passengers data leaked via SITA server
• Domino's India (2021): 180 million order records
• MobiKwik (2021): 3.5 million KYC records
• AIIMS Ransomware (2022): 40 million patient records encrypted, reported to CERT-In
• SBI Dark Web Exposure (2023-24): SBI admitted exposure, Foundation filed complaint citing Section 8(6) DPDP

In all these, legal action pursued under Section 43A - civil remedy of compensation for wrongful loss.

B. International / GDPR Case Laws

These are persuasive and cited by Indian Data Protection Board for quantum of penalty.

1. British Airways - ICO Fine £20 million (2020):
400,000 customers' data exposed due to poor security, failure to detect breach for 2 months. Original notice £183m, reduced to £20m due to COVID and mitigation. Principle: Basic security measures, log management and payment-page integrity are enforceable security duties.

2. Marriott International - ICO Fine £18.4 million (2020):
339 million guests data exposed, breach undetected for 4 years. Due diligence failure during Starwood acquisition. Initial notice £99m, reduced to £18.4m.

3. Meta Ireland - EDPB Fine €1.2 Billion (2023):
Record-breaking fine for unlawful transfer of EU user data to US, lack of adequate safeguards. Shows transfer + security breach is highest risk category.

4. Equifax Inc. (USA, 2017) - $700m Settlement:
147 million consumers. Failure to patch Apache Struts vulnerability. FTC held failure to implement reasonable security = unfair trade practice.

5. Target Corp (USA, 2013) & Yahoo (2013-14):
Target $18.5m multi-state settlement, Yahoo $117.5m class action - established duty to notify within 72 hours, as later codified in GDPR Art. 33 & 34.

GDPR Rule: Notify supervisory authority within 72 hours, and data subjects without undue delay if high risk. Indian DPDP mirrors this.

5. Compliance Checklist for Companies in India Today

1. Classify data: Personal vs Sensitive Personal Data
2. ISO 27001 + CERT-In hardening: Implement encryption, access control, logging
3. Incident Response Plan: With 6-hour CERT-In template and 72-hour DPBI template ready
4. Appoint: Grievance Officer (under 2011 Rules), DPO (under DPDP)
5. Vendor contracts: Processor must notify fiduciary immediately
6. User notification: Plain language, in English + regional language, with toll-free helpline
7. Preserve evidence: Logs for 180 days (CERT-In) and 1 year (DPDP Rules)