Data Breach at an Institution: Legal Duties Today and Under the DPDP Act from 2027

When an institution’s data leaks, even through one wrong sharing setting, it has legal duties today and wider ones from 13 May 2027. Today: report the leak to CERT-In within 6 hours; a body corporate negligent in reasonable security practices for sensitive personal data is liable to pay compensation under s.43A of the IT Act; and anyone who discloses personal information obtained under a contract, without consent, with intent to cause wrongful loss or gain faces up to 3 years under s.72A. From 13 May 2027, the DPDP Act requires intimation to the Data Protection Board and every affected person, with penalties up to ₹250 crore.

The scenario: one link, one leak

A university in Dehradun keeps a spreadsheet of hostel residents: phone numbers, parents’ numbers, home addresses and medical notes for students with allergies. A staff member sets it to “anyone with the link can view” and posts it in a large WhatsApp group. Nobody hacked anything.

Is the university responsible? It can be. Liability does not depend on a hacker.

The law that applies today

Section 43A and the 2011 SPDI Rules

Section 43A makes a body corporate that handles sensitive personal data in a computer resource it owns, controls or operates, and is negligent in reasonable security practices, causing wrongful loss or gain, liable to pay compensation. “Body corporate” covers companies, firms and other associations of individuals engaged in commercial or professional activities, so its reach to a government body or university depends on the facts.

The 2011 SPDI Rules list sensitive personal data, including passwords, financial information, health conditions, medical records and biometric information. The medical notes in the hostel sheet fall here. Rule 8 treats a documented security programme as reasonable security practices; IS/ISO/IEC 27001, audited at least yearly by an approved auditor, is deemed compliance.

Claims up to ₹5 crore go to the Adjudicating Officer under s.46 (the State IT Secretary); larger claims to the civil court.

Section 72A

Any person who, while providing services under a lawful contract, secured access to personal information and discloses it without consent or in breach of contract, intending or knowing it is likely to cause wrongful loss or gain, faces up to 3 years, or fine up to ₹5 lakh, or both. This catches vendors: the ERP company, the admissions agency, the data-entry contractor.

CERT-In reporting

Data breaches and data leaks are among the incidents listed in the CERT-In Directions of 28 April 2022, which apply to government organisations and body corporates: report within 6 hours. Non-compliance is punishable under s.70B(7) with up to 1 year, or fine up to ₹1 lakh, or both.

Privacy as a fundamental right

In Puttaswamy (2017), a nine-judge bench of the Supreme Court held that privacy is a fundamental right under Article 21. For public institutions, careless handling of personal data touches a constitutional right of the student, patient or employee.

From 13 May 2027: duties under the DPDP Act

The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 bring the main obligations into force on 13 May 2027. On that date s.43A of the IT Act is omitted (DPDP Act s.44(2)). The institution, as a Data Fiduciary, must:

• Keep reasonable security safeguards (Rule 6: encryption or masking, access control, logs, backups, processor contract terms).
• On a breach, inform each affected person without delay, in plain language: what happened, likely consequences, what is being done and what they can do (Rule 7).
• Inform the Data Protection Board without delay, and send a detailed report within 72 hours on facts, causes, mitigation and notices sent. The Board may allow more time on written request.

Penalties go up to ₹250 crore for failing to take reasonable security safeguards and ₹200 crore for failing to intimate a breach. Government bodies are covered unless exempted.

Immediate steps and documentation

1. Stop the spread. Restrict the link, ask group admins to delete the post, seek takedown of reposts.
2. Note the time the leak was noticed and by whom. Open an incident log.
3. Report to CERT-In within 6 hours through the point of contact.
4. Preserve evidence: screenshots with URLs and times, sharing history, access logs. Restrict the original; do not delete it.
5. Assess what leaked: which fields, how many people, any sensitive data, any minors.
6. Inform affected people where there is real risk, such as fraud calls to parents. From 13 May 2027 this is mandatory under Rule 7.
7. Police complaint if data is misused or deliberately disclosed (s.72A).
8. Record what failed and what changed.

That file protects persons in charge. Under s.85 of the IT Act, where the contravention is by a company (any body corporate, firm or association of individuals), persons in charge are deemed guilty unless they prove lack of knowledge or all due diligence. Whether s.85 reaches a government department depends on the facts.

Frequently asked questions

Is an accidental leak a “data breach”?

Yes. The DPDP Act defines personal data breach to include unauthorised or accidental disclosure. Data leaks are also listed CERT-In incidents.

Can students sue the institution today?

Where s.43A applies, a person who suffers wrongful loss can claim compensation before the Adjudicating Officer or a civil court.

Who is liable if the vendor leaked the data?

The vendor can face s.72A. The institution must still show what it required of the vendor, and from 13 May 2027 answers for its processor.

Must we tell students before May 2027?

Not yet under the Rules, but wise where risk is real.

Quick quiz

To prepare your data, accounts and IT teams: Cyber Crime Law for Offices and Institutions, ₹599. It is a certificate of completion, not a professional qualification.

Sources

• Information Technology Act, 2000: ss.43A, 46, 70B(7), 72A, 85
• Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011: Rules 3 and 8
• CERT-In Directions under s.70B(6), dated 28 April 2022
• Digital Personal Data Protection Act, 2023: ss.2(u), 8, 44(2) and Schedule; DPDP Rules, 2025: Rules 6 and 7
• Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1

This page is for education and general information, not legal advice for a specific case. Law as on 29 October 2026.