Cyber Crimes
An overview of cyber crimes targeting personal data — ransomware, phishing, espionage — and the role of data protection in preventing them.
🎯 Learning Objectives
- ▸ Identify common cyber crimes targeting data
- ▸ Understand the relationship between data protection and cyber security
- ▸ Analyze notable cyber crimes involving personal data
- ▸ Understand how the DPDPA and cyber security law interact
Common Cyber Crimes Targeting Data
Cyber criminals use various methods to steal, exploit, or destroy personal data. Common cyber crimes include:
- • Ransomware: Encrypting data and demanding payment for decryption
- • Phishing: Tricking users into revealing credentials or personal information
- • Data theft: Stealing personal data for sale or exploitation
- • Espionage: Stealing data for competitive or political advantage
- • DDoS attacks: Overwhelming systems to disrupt services
- • Identity theft: Using stolen data to impersonate individuals
- • Financial fraud: Using stolen data for unauthorized transactions
- • Cyber stalking: Using data to harass or intimidate individuals
Cyber crimes are increasingly sophisticated and targeted. No organisation is immune, and prevention requires constant vigilance.
Notable Cyber Crimes in India
India has experienced several notable cyber crimes affecting personal data:
Aadhaar-Related Cyber Crimes
Aadhaar has been the target of cyber crimes. Fake Aadhaar apps, unauthorized access to Aadhaar data, and phishing attacks targeting Aadhaar numbers have been reported. These crimes exploit the centrality of Aadhaar in Indian digital life.
Banking Fraud
Banking fraud is a major cyber crime in India. Phishing attacks, SIM swap fraud, and card skimming have resulted in significant financial losses. Data protection is essential to prevent these crimes.
Healthcare Data Attacks
Healthcare data is increasingly targeted by cyber criminals. Ransomware attacks on hospitals have disrupted services and exposed patient data. The sensitivity of health data makes these crimes particularly damaging.
💡 Example
In 2020, a major Indian healthcare provider experienced a ransomware attack that disrupted services for days. Patient data was exposed, and the organisation faced significant reputational and financial damage.
The Relationship Between Data Protection and Cyber Security
Data protection and cyber security are related but distinct. Cyber security focuses on protecting systems and networks from attacks. Data protection focuses on protecting personal data from misuse, unauthorized access, and other harms.
The two are complementary. Strong cyber security is essential for data protection — without it, data can be stolen or destroyed. But cyber security alone is not sufficient — data can be secure but still be misused (e.g., sold without consent).
Data protection requires both cyber security (protecting data from attacks) and privacy practices (controlling how data is used). Both are essential.
Legal Frameworks
In India, the DPDPA and the Information Technology Act, 2000 (IT Act) work together to address cyber crimes. The IT Act criminalizes various cyber crimes (hacking, identity theft, etc.), while the DPDPA establishes data protection obligations and penalties.
The two laws complement each other. A data breach could violate both the DPDPA (failure to protect data) and the IT Act (unauthorized access to computer systems). Organisations must comply with both.
Preventing Cyber Crimes Through Data Protection
Data protection practices help prevent cyber crimes:
- • Encryption: Protects data even if systems are compromised
- • Access controls: Limit who can access sensitive data
- • Data minimization: Reduces the amount of data that can be stolen
- • Regular audits: Detect vulnerabilities before they are exploited
- • Employee training: Reduces human error and phishing risk
- • Incident response: Enables rapid response to cyber crimes
- • Breach notification: Allows individuals to take protective action
The DPDPA requires many of these measures. Compliance with the DPDPA thus helps prevent cyber crimes. Conversely, organisations that fail to comply are more vulnerable to cyber crimes and face higher penalties.
The fight against cyber crime requires both legal compliance and technical measures. The DPDPA provides the legal framework; organisations must implement the technical measures.
📖 Glossary
- Ransomware
- Malicious software that encrypts data and demands payment for decryption.
- Phishing
- A social engineering attack in which attackers impersonate legitimate entities to steal credentials or data.
- DDoS
- Distributed Denial of Service — overwhelming a system with traffic to disrupt services.
- IT Act
- The Information Technology Act, 2000 — India's primary cyber law, which criminalizes various cyber crimes.
🔑 Key Takeaways
- Cyber crimes are a major threat to personal data
- Data protection is a key defense against cyber crimes
- The DPDPA and IT Act work together to combat cyber crimes
- Organisations must implement both legal and technical safeguards
📚 Further Reading
- Cyber Crime in India — National Crime Records Bureau (2023)
- Information Technology Act, 2000 — Government of India (2000)
- Digital Personal Data Protection Act 2023 — Government of India (2023)
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...