Examine the roles of CERT-In, sectoral regulators and the Data Protection Board in responding to personal data breaches. Is the current framework adequately coordinated?

In the recent SBI breach, a preliminary check of about 3,75,000 dark-web records found 3,897 customer records containing personal data. CERT-In, the Defence Cyber Agency and a private threat-intelligence firm all flagged the leak [1]. The case shows that India responds to a breach through several bodies at once. Each has a clear mandate, but the bodies are only loosely joined up.

Roles in breach response

• CERT-In (technical responder): It is the nodal agency under Section 70B of the IT Act, 2000. Its 2022 Directions require entities to report cyber incidents, including data breaches, within 6 hours [2]. It alerts, analyses and guides containment, as it did for SBI [1].
• Sectoral regulators (protecting their own constituency):
• RBI protects customers. Its 2017 circular gives zero liability if a customer reports a third-party breach within 3 working days, and the bank must credit back the disputed amount within 10 working days [3].

• SEBI protects investors. Listed companies must disclose material events, and SBI informed the stock exchanges five days after the alerts [1].

• Data Protection Board (rights enforcer): The Board is set up under the DPDP Act, 2023. The DPDP Rules, 2025 require a data fiduciary to tell affected people about a breach without delay, in plain language. Failing to do so can attract a penalty of up to ₹200 crore [4].

Is coordination adequate? Only partly

• What works: The multi-agency alert system detected the SBI leak [1]. RBI also places the burden of proving customer negligence on the bank [3].
• Separate deadlines: Entities face a 6-hour report to CERT-In [2], SEBI's investor disclosure [1] and "without delay" notice to individuals [4]. Each needs a separate report in a separate format.
• Investors told before customers: SBI's only confirmed disclosure was to the stock exchanges. The source does not report any personal notice to the affected customers [1].
• Law not fully in force: The DPDP Rules come into effect in phases over 18 months [4], so the Board's breach regime is not yet complete.
• Liability gap: Fraudsters use leaked data to trick customers into sharing OTPs. Under RBI rules, a customer who shares an OTP can bear the loss [3], even though the leak happened at the bank.

India has the right institutions: technical (CERT-In), sectoral (RBI, SEBI) and rights-based (the Board). However, they act side by side rather than together. Three steps would close the gap: a single breach report shared by CERT-In, RBI, SEBI and the Board; notice to customers at the same time as investors; and RBI guidance treating leak-enabled fraud as a third-party breach. Together they would turn the right to privacy upheld in Puttaswamy (2017) into practical protection.