Industry Odisha Bureau, Oct 30: India’s data protection regime is nearing its real test. The Digital Personal Data Protection Act, 2023, now has rules notified in November 2025. The full framework is expected to take effect in May 2027. It promises citizens more control and gives organisations clearer duties. Two October incidents show why a law on paper is not enough.
SBI found 3,897 customer records with personal details in a dark-web dataset. Its preliminary review covered about 375,000 records, according to media reports. The data reportedly included names, phone numbers, addresses and loan-linked details. The source, authenticity and full scale of the exposure remain under investigation. SBI said core banking was not materially affected. It activated incident-response protocols and hired a CERT-In-empanelled agency to investigate. The case shows breaches often begin outside the main database. Copies travel through vendors, old systems, email inboxes and even personal phones.
eMudhra’s case exposed a different weakness: the trust layer of the internet. On October 17, a researcher flagged weak keys in eight of its intermediate certificate authorities. Such authorities vouch that a website is genuine. The company blamed insufficient randomness in key generation and revoked them a day later. It said no certificates were issued from them and no customer data was compromised. CERT-In warned the keys could theoretically enable fake certificates and intercepted traffic. That was a potential risk, not demonstrated misuse. India’s regulated eSign and digital-signature services were unaffected, per eMudhra and CERT-In.
The DPDPA attaches steep penalties to such lapses. Failing to maintain reasonable security safeguards can cost up to ₹250 crore. Failing to notify the Data Protection Board and affected users can cost ₹200 crore. Those maximums apply only after the provisions take effect and the Board rules.
The Mumbai-based DPDPA Forum, a non-profit, focuses on that operational gap. Its director, Army veteran S V Ramsunder, says readiness comes from drills, not plans. The Forum has released draft standards on consent, security baselines and breach notification. Others cover significant data fiduciaries and internal governance. These drafts are voluntary guidance open for comment, not binding law. Ritesh Jain, a former bank digital head, says firms must first map their data.
For citizens, risk is often mundane. Hotels photocopy ID cards, and shops demand phone numbers for bills. Lengthy notices push many users to click “Accept All” without reading. Advocate Ashok Yende says consent must be active, informed and purpose-specific. Data governance expert Parveen Goribindur stresses inclusion and dignity for every citizen. AI raises the stakes by profiling people and inferring sensitive traits. IAS officer M Nagarajan says regulators often play catch-up with fast-moving technology. Jurist Rashmi M Oza wants privacy balanced with innovation through proportionality and minimal intrusion.
The DPDPA cannot guarantee that breaches will stop. Nor is every vulnerability proof of regulatory failure. Its value will rest on daily habits inside institutions. Collecting less, retaining less, testing responses and policing vendors will decide its success.
