Data Breaches
Understanding data breaches — their causes, impact, and prevention — and why they are so dangerous in the digital age.
🎯 Learning Objectives
- ▸ Understand the impact of data breaches
- ▸ Identify common causes of data breaches
- ▸ Analyze notable data breaches in India and globally
- ▸ Understand DPDPA breach notification requirements
Understanding Data Breaches
A data breach is a security incident in which personal data is accessed, disclosed, altered, destroyed, or lost without authorization. Breaches can result from external attacks (hacking), internal errors (accidental disclosure), or system failures (hardware loss).
In the digital age, data breaches have become increasingly common and costly. Large-scale breaches expose millions of records, causing identity theft, fraud, and reputational damage. The average cost of a data breach globally exceeds $4 million.
Data breaches are not just technical incidents — they are human events that cause real harm to real people. Behind every breached record is a person whose privacy has been violated.
Common Causes of Data Breaches
Understanding the causes of data breaches is essential for prevention. Common causes include:
- • Phishing and social engineering attacks
- • Weak or stolen credentials
- • Unpatched software vulnerabilities
- • Misconfigured systems and databases
- • Insider threats (malicious or negligent employees)
- • Third-party vendor breaches
- • Lost or stolen devices
- • Physical security failures
- • Human error (sending data to wrong recipient)
The Role of Third Parties
Third-party vendors are increasingly a source of data breaches. When a company shares data with a vendor — for analytics, cloud storage, or other services — it creates a vulnerability. If the vendor is breached, the company's data is exposed.
The DPDPA requires companies to ensure that their Data Processors (vendors) implement adequate security. Companies remain liable for breaches caused by their processors.
Notable Data Breaches
Several notable data breaches illustrate the severity of the problem:
Aadhaar Breaches
Multiple reports have highlighted Aadhaar data breaches. In one case, an unauthorised app was found to provide access to Aadhaar data. In another, Aadhaar numbers were leaked through government websites. These breaches expose personal information of millions of Indians.
Healthcare Breaches
Healthcare data breaches are particularly dangerous because health information is sensitive and cannot be "reset." A leaked medical record can cause permanent harm through discrimination, stigma, and insurance denial.
Global Breaches
Globally, breaches like the Equifax breach (2017, 147 million records), the Yahoo breach (2016, 3 billion records), and the Marriott breach (2018, 500 million records) have demonstrated the scale of the problem.
These breaches show that no organisation is safe. Even well-resourced companies can be breached. The question is not whether you will be breached, but when — and how well you respond.
DPDPA Breach Requirements
The DPDPA establishes specific requirements for breach prevention and notification:
Breach Prevention
Section 8(5) requires Data Fiduciaries to implement reasonable security safeguards. This includes encryption, access controls, monitoring, and incident response capabilities. Failure to implement reasonable safeguards can result in penalties of up to ₹250 crore.
Breach Notification
Section 8(6) requires Data Fiduciaries to notify the Data Protection Board and affected Data Principals "without undue delay" in the event of a personal data breach. The notification must describe the nature of the breach, the impact, and the remedial actions taken.
Penalties
Failure to notify a breach can result in penalties of up to ₹200 crore. This is separate from the penalty for failing to prevent the breach (up to ₹250 crore). Combined, a single breach could result in penalties of up to ₹450 crore.
💡 Example
A company that experiences a breach exposing customer data and fails to notify the Board could face penalties of up to ₹450 crore — ₹250 crore for the breach and ₹200 crore for the failure to notify.
The DPDPA's breach requirements reflect the seriousness of data breaches. Prevention and notification are not optional — they are legal obligations backed by significant penalties.
📖 Glossary
- Data Breach
- A security incident in which personal data is accessed, disclosed, altered, destroyed, or lost without authorization.
- Phishing
- A social engineering attack in which attackers impersonate legitimate entities to steal credentials or data.
- Insider Threat
- A threat to data security from within an organisation — either malicious or negligent.
- Breach Notification
- The legal obligation to inform the Data Protection Board and affected individuals about a data breach.
🔑 Key Takeaways
- Data breaches can have devastating consequences
- Prevention is better than cure — breach prevention is essential
- Breach notification is a legal obligation under the DPDPA
- Breaches expose individuals to identity theft, fraud, and other harms
- Breaches damage organisational reputation and trust
📚 Further Reading
- Cost of a Data Breach Report — IBM Security (2023)
- Notable Data Breaches — Privacy Rights Clearinghouse (2024)
- Digital Personal Data Protection Act 2023 — Government of India (2023)
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...