Breaches and complaints
What you must be told, where to complain, and what to expect
Read this chapter
The same material as the video, step by step. Each diagram animates as you reach it.
Key definition
A breach is wider than a hack. It covers unauthorised processing, and accidental disclosure, alteration, destruction or loss of access that compromises your data.
Section 2(u) defines a personal data breach as unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access, that compromises the confidentiality, integrity or availability of personal data. Organisations must take reasonable security safeguards to prevent breaches (s.8(5)); Rule 6 lists minimum measures such as encryption, access controls, logs and backups.
What you must be told after a breach
When an organisation becomes aware of a breach, it must tell each affected person without delay, in clear and plain words, through your account or registered contact.
Rule 7(1) says 'without delay' and gives no number of hours for telling you. The organisation tells you what it knows 'to the best of its knowledge'. It must also inform the Data Protection Board without delay, and give the Board a detailed report within seventy-two hours, including a report on the notices sent to affected people (Rule 7(2)). There is no minimum size: the duty covers any personal data breach. Failing to give notice can bring a penalty of up to ₹200 crore (Schedule, item 2).
If your data is in a breach
These steps are practical advice, not requirements of the law. The breach notice itself must also list safety measures suited to that breach.
The duty to tell you about safety measures is in Rule 7(1)(d). The Act and Rules do not require the organisation to pay for your losses or to provide services such as account monitoring. If you think the organisation failed in its duties, use the grievance route described next. This is general guidance and not legal advice.
Where a complaint goes
Complain to the organisation first. If that does not resolve it, you can complain to the Data Protection Board. A Board order can be appealed to the Appellate Tribunal.
You must exhaust the organisation's grievance process before approaching the Board (s.13(3)); it must publish a response period of not more than ninety days (Rule 14(3)). The Board works as a digital office, so proceedings need not require your physical presence (s.28(1), Rule 20). The Appellate Tribunal is the Telecom Disputes Settlement and Appellate Tribunal (s.2(a)); an appeal must be filed within sixty days with a fee, which its Chairperson may reduce or waive (s.29(2), Rule 22). Civil courts cannot hear matters the Board is empowered to decide (s.39).
What to expect from the Board
The Board can inquire, give binding directions and impose penalties. It can also close a case with insufficient grounds, and it does not award compensation.
Complaints are covered by s.27(1)(b), and directions by s.27(2). The Board first decides whether there are sufficient grounds to inquire, and may close the case with written reasons if not (s.28(3)–(4)). An inquiry is to be completed within six months, which the Board may extend by up to three months at a time (Rule 19(9)). A penalty requires a finding that the breach is 'significant' (s.33(1)). For a false or frivolous complaint, the Board may issue a warning or impose costs on the complainant (s.28(12)).
Maximum penalties on organisations
Penalties on organisations can reach ₹250 crore. The Board decides the amount, looking at matters such as how serious the breach was and how long it lasted.
These are maximums from the Schedule, not fixed amounts. In setting a penalty the Board must consider the nature, gravity and duration of the breach, the type of data affected, repetition, any gain made, steps taken to reduce the harm, and the likely impact of the penalty (s.33(2)). After penalties in two or more instances, the Board may advise the Central Government to block public access to the organisation's service (s.37).
Where the money goes
A penalty does not come to you. The Act does not provide for compensation, so be clear about what a complaint can and cannot achieve.
Section 34 credits all penalty sums to the Consolidated Fund of India. The Board's powers in s.27 are to inquire, issue directions and impose penalties. Whether you could claim damages under some other law is outside this Act and outside this guide; note that s.39 bars civil courts from matters the Board is empowered to decide.
Your duties, and good habits
You have duties too. Breaking them can bring a penalty of up to ₹10,000. A few simple habits will help you use this law well.
Section 15 also requires you to follow all applicable laws while using your rights. The duty about material facts applies when you give personal data for a document, unique identifier, proof of identity or proof of address issued by the State. The ₹10,000 maximum is item 5 of the Schedule. An organisation stays responsible for its own duties even if you fail in yours (s.8(1)). The good habits are practical advice, not legal requirements.
In one line
That completes the citizen track. This is a simplified guide, not legal advice.