Hacked in 2024? India's privacy rules require you to take action

Draft digital personal data protection rules demand that data breaches be reported retrospectively

- SAJAI SINGH is partner, JSA Advocates & Solicitors

Last year, did any of your employees use a co-worker's computer and read files without authorization? Maybe the access was unintentional and no information was shared. But because it was viewed by an unauthorized person, the data is considered breached.

What if someone with legitimate authorization purposely accesses and/or shares data with the intent of causing you harm? This malicious insider also caused a data breach. Did any employee lose an office device last year? It could be an unencrypted and unlocked laptop or external hard drive—anything that contained sensitive information. Again, a data breach has occurred. Finally, were you hacked?

All these constitute data breaches. It occurs when the personal data for which an organization is responsible suffers any unauthorized processing or accidental disclosure, acquisition, use, sharing, alteration, destruction or loss of access that compromises the confidentiality, integrity or availability of such data.

If you suffered a data breach last year, would you have needed to report it to an authority? ‘No’ may be your guess, since India did not have a data protection authority in place. But will you need to report such occurrences, retrospectively, once the envisaged Data Protection Board of India (DPBI) is set up?