SBI data breach explained: What are your rights if personal data is leaked?

SBI's reported data leak has raised questions about customer privacy. Here's what Indian laws require banks to do, whether affected customers can seek compensation and how they can protect themselves

The State Bank of India (SBI) has admitted that it found 3,897 records containing personally identifiable information of customers on the dark web. The information reportedly included names, mobile numbers, dates of birth, email and residential addresses, customer identifiers and metadata linked to loan records.

 

This raises some larger questions: whether the bank complied with its existing security obligations, what reporting requirements apply and what customers can do if the exposure causes them harm.

 

What does the IT Act say about a data breach?

 

The Information Technology (IT) Act, 2000, is an important part of India's existing legal framework for data protection and cybersecurity.

 

Section 43A provides for compensation when a company handling sensitive personal information fails to maintain reasonable security practices, and this failure causes wrongful loss or gain.

 

However, the fact that customer information has appeared online does not automatically prove that the bank was negligent. The legal requirements must be met before compensation can be awarded.

 

The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, also set out requirements for handling sensitive information and maintaining adequate security measures.

 

Two other provisions may apply, depending on how the data was obtained or disclosed. Section 66 covers certain computer-related offences, including unauthorised access, when the acts specified under Section 43 are committed dishonestly or fraudulently. Section 72A deals with the unlawful disclosure of personal information obtained under a lawful contract, where the intention or knowledge required by law is established.

 

In simple terms, investigators must first determine how the information was accessed, whether anyone disclosed it unlawfully and whether the conditions for a legal violation have been met.

 

DPDP Act explained: What does India's new data protection law say?

 

The Digital Personal Data Protection (DPDP) Act, 2023, creates a framework for regulating how organisations collect, use and protect digital personal data.

 

However, the Act is being implemented in stages. Under the commencement notification issued on November 13, 2025, its core provisions on data processing, security safeguards and breach notifications are scheduled to take effect on May 13, 2027. The DPDP Rules, 2025, also have a phased implementation schedule. These core work should therefore not be treated as fully enforceable against SBI for an incident identified in October 2026.

 

Once Section 8(5) takes effect, organisations that determine how and why personal data is processed must take reasonable security measures to prevent breaches. Section 8(6) requires them to notify the Data Protection Board of India and affected individuals of a breach, as prescribed by the rules.

 

Section 33 provides for monetary penalties for specified violations. A failure to take reasonable security safeguards can attract a penalty of up to ₹250 crore, which is not static but is a variable amount.

 

The distinction is important to look at because these future obligations cannot simply be applied to the SBI incident before they come into force.

 

RBI's cybersecurity rules: What must a bank do?

 

Banks are responsible not only for keeping customers' money safe but also for protecting the personal and financial information they collect.

 

The Reserve Bank of India's (RBI) 2016 Cyber Security Framework in Banks and its 2023 Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices set standards for security, risk management, internal controls and incident response.

 

Under these requirements, banks must put systems in place to detect potential threats, investigate security incidents and take steps to prevent similar incidents in the future.

 

In other words, banks cannot wait for a cyberattack to happen before thinking about data security. Protecting customer information is an ongoing responsibility.

 

In the SBI data breach case, the question is whether the bank followed the required security measures and responded appropriately after learning about the suspected exposure. The exposure alone does not prove that the bank violated RBI rules; that conclusion requires evidence.

 

CERT-In's six-hour reporting rule: When must a breach be reported?

 

The Indian Computer Emergency Response Team (CERT-In), India's national cybersecurity agency, operates under Section 70B of the IT Act.

 

Under directions issued on April 28, 2022, organisations covered by the rules must report specified cybersecurity incidents, including data breaches and leaks, within six hours of noticing them or being informed about them. These organisations must also maintain system logs, which can help investigators understand what happened during a cyber incident.

 

SBI said it received alerts about the suspected exposure on October 16 and publicly disclosed it on October 21. These dates raise questions about the reporting timeline, but do not prove a violation. To assess compliance, it is necessary to establish when the incident was detected, when it became reportable and when the authorities were notified.

 

Can customers claim compensation if their data is leaked?

 

Customers may seek remedies under the IT Act and the Consumer Protection Act, 2019, depending on the circumstances.

 

Under Section 43A of the IT Act, compensation may be available if a company failed to maintain reasonable security measures for sensitive personal information and that failure caused wrongful loss or gain.

 

The Consumer Protection Act, 2019, may provide another option. If a bank's failure to protect customer information amounts to a deficiency in service, an affected customer may be able to file a consumer complaint, provided the legal requirements are met.

 

For example, a customer who loses money through fraud after personal information is exposed may have evidence of financial loss. Another customer whose information was leaked but who has suffered no identifiable harm may face a different legal situation.

 

Data breach versus financial fraud: What should customers do?

 

Exposed personal information does not necessarily mean that money has been stolen. However, fraudsters can use leaked details to make phone calls and messages appear genuine.

 

Customers should be cautious about unexpected calls, links and requests to update banking details. They should never share passwords, PINs or one-time passwords with callers claiming to represent their bank.

 

Anyone who suspects an unauthorised transaction should contact the bank immediately. Suspected cyber fraud can also be reported through the national helpline, 1930, or by going to the National Cyber Crime Reporting Portal.