UPSC Prelims Practice Questions — How does the SBI data breach affect customers?

Q1. With reference to the Reserve Bank of India's cyber-security framework for banks, consider the following statements: Which of the statements given above is/are correct?

  1. A bank must have a board-approved cyber-security policy that is distinct from its broader IT or information-security policy.
  2. A bank need not report attempted cyber attacks that did not succeed, because no customer data or funds were affected.
  3. Banks are required to set up a Security Operations Centre to monitor and manage cyber risks on a continuous basis.
  • A. 1, 2 and 3
  • B. 2 and 3 only
  • C. 1 and 3 only
  • D. 1 only

Q2. Consider the following statements: Which of the following is correct in respect of the above statements?

  1. Under the Digital Personal Data Protection Act, 2023, a bank whose customers' personal data are breached must inform the affected customers and not only the Data Protection Board of India.
  2. The Data Protection Board of India has the power to impose monetary penalties for non-compliance with the Act.
  • A. Both Statement-I and Statement-II are correct and Statement-II explains Statement-I
  • B. Both Statement-I and Statement-II are correct, but Statement-II does not explain Statement-I
  • C. Statement-I is correct, but Statement-II is incorrect
  • D. Statement-I is incorrect, but Statement-II is correct

Q3. A bank customer who never shared any OTP, PIN or password finds an unauthorised electronic debit in their account. The debit is traced to a data breach at an outside entity, so the fault lies neither with the bank nor with the customer, and the customer reports it to the bank promptly. Under the RBI's framework on limiting customer liability, what follows?

  • A. The customer is credited only after the bank's insurance claim on the transaction has been settled.
  • B. The customer's liability is capped at a fixed amount per transaction, as neither party was at fault.
  • C. The customer bears the loss unless they prove the bank was negligent, since the breach lay outside the bank.
  • D. The customer's liability is zero, and the bank bears the burden of proving any customer liability.

Q4. Stolen personal data of bank customers are being sold in bulk 'dumps' on dark-web marketplaces for small sums. In this context, consider the following statements: Which of the statements given above is/are correct?

  1. Once the bank publicly discloses the breach, the leaked data lose their value to fraudsters.
  2. Cheap bulk data lower the cost of running phishing and social-engineering frauds against many customers at once.
  3. Customers with low digital literacy face higher risk, since frauds built on leaked personal data rely on deceiving the victim rather than breaking into the bank's systems.
  • A. 1 and 2 only
  • B. 2 and 3 only
  • C. 1, 2 and 3
  • D. 1 only

Q5. Consider the following assertion: A leak of customers' personal data from a bank engages a legally protected interest of the customers themselves, and not merely the bank's commercial interest. Which of the following statements support the above assertion?

  1. The Supreme Court in Justice K.S. Puttaswamy (Retd) vs. Union of India recognised privacy as a fundamental right.
  2. Bulk dumps of stolen data are sold on dark-web marketplaces for small sums.
  3. The Digital Personal Data Protection Act, 2023 gives individuals whose data are processed enforceable rights against the entity that processes them.
  • A. 1 and 3 only
  • B. 2 and 3 only
  • C. 1 only
  • D. 1, 2 and 3

Q6. With reference to the overlapping legal obligations of a listed public-sector bank after a breach of its customers' personal data, consider the following statements: Which of the statements given above are correct?

  1. Under the Digital Personal Data Protection Act, 2023, the duty to report the breach to the Data Protection Board rests on the bank as Data Fiduciary, not on the customers whose data leaked.
  2. Once the Defence Cyber Agency has flagged the incident, it falls outside the RBI's supervisory remit.
  3. Because the breach was disclosed to the stock exchanges under SEBI norms, the Data Protection Board cannot act on it.
  4. The RBI's cyber-security requirements apply to the bank whether or not its shares are listed.
  • A. 1, 3 and 4 only
  • B. 1 and 4 only
  • C. 2 and 3 only
  • D. 1, 2 and 4 only