In 2023, CoWIN — the government’s COVID vaccination platform — saw records of hundreds of millions of Indians reportedly exposed in a breach. Aadhaar data has appeared in leak forums repeatedly. AIIMS Delhi suffered a ransomware attack that locked patient records for weeks. In each case, the individuals whose data was compromised had essentially no practical route to compensation. That’s starting to change. But it requires understanding the gap between what the law promises and what’s available today.
This article is for educational purposes only and does not constitute legal advice. Consult a qualified solicitor or attorney for advice on your specific situation.
The short answer: India’s DPDPA fines companies but does not give you a direct right to compensation. Those fines go to the government, not to you, and the Data Protection Board is not yet fully operational as of mid-2026. Three routes work today. Section 43A of the IT Act gives compensation via an Adjudicating Officer, typically ₹1–10 lakh for documented loss. The consumer forum handles “deficiency of service.” Criminal complaints under Sections 66C/66D cover identity theft. Document your breach now so your claim is stronger when enforcement matures.
The law is there. The enforcement body isn’t yet.
India’s Digital Personal Data Protection Act (DPDPA) became law in August 2023. It passed Parliament with broad support and established one of the strongest frameworks for data principal rights in any major jurisdiction — on paper.
The body that would enforce those rights and award compensation is the Data Protection Board of India (DPBI). The DPDP Rules were finally notified in November 2025, and the Board was legally established. But as of mid-2026, the DPBI is still not fully operational. Member appointments have moved slowly, with the Chairperson and Members not yet appointed. The Act’s substantive obligations are also phasing in over 2026 and 2027 rather than taking effect at once.
This is the honest situation. Your rights under the DPDPA are real, and the rules now exist. But the enforcement body isn’t yet functioning.
What will DPDPA give you?
When the DPBI is functioning, it will have the power to impose penalties on data fiduciaries. Privacy advocates have flagged a critical gap here. The DPDPA creates a regulatory penalty regime: the Data Protection Board can fine companies up to ₹250 crore under the Schedule to the DPDPA. But these penalties go to India’s Consolidated Fund, not to affected individuals. The DPDPA does not create a direct individual right to compensation for data breach victims. This is a significant gap that distinguishes it from GDPR.
Note: Section 31 of the DPDPA is the provision that bars civil courts from hearing data protection cases — it is not a compensation provision. The penalty schedule is set out in Chapter 8 and the Schedule to the DPDPA. It sets fines of up to ₹250 crore for data breaches from inadequate security, and up to ₹200 crore for inadequate data protection obligations. These numbers are higher than many GDPR fines in absolute terms — but the money goes to the government, not to you.
What constitutes “harm” under the DPDPA is defined more broadly than under GDPR. The definition includes financial loss, injury to reputation, loss of livelihood, violation of bodily integrity, and loss of access to essential services. That last category is notable. It covers scenarios like a telecom breach that disrupts your mobile service or a fintech breach that locks you out of a payments account. GDPR doesn’t have an equivalent provision.
The DPBI will also have the power to investigate companies on its own initiative, not just in response to individual complaints. That’s a meaningful tool when the harm from a breach is diffuse — affecting millions of people in small ways rather than a single person catastrophically.
IT Act Section 43A: what you can use today
The DPDPA doesn’t operate in a legal vacuum. The Information Technology Act 2000 has had a compensation mechanism for data breaches since the 2008 amendment — and it’s significantly underused.
Section 43A of the IT Act 2000 was the primary individual compensation mechanism before the DPDPA. The DPDPA will eventually replace Section 43A, via Section 44(2), likely around 2027. But for now, Section 43A remains the primary avenue for individual compensation, through the IT Act’s Adjudicating Officer mechanism.
Section 43A makes any company handling sensitive personal data liable to pay compensation if two things are true. First, it failed to implement “reasonable security practices and procedures.” Second, that failure caused “wrongful loss or wrongful gain.” The standard of reasonable security practices is defined by reference to ISO/IEC 27001 and, more recently, CERT-In’s directives.
Compensation under Section 43A is adjudicated by Adjudicating Officers appointed by the Ministry of Electronics and Information Technology (MeitY). To file a complaint, write to the Adjudicating Officer in your state or the relevant jurisdiction. Describe the breach, the company’s failure to maintain adequate security, and the harm you suffered. Include documentation: breach notification letters, screenshots of fraudulent transactions, and any CERT-In advisories about the company’s breach.
Practical awards under Section 43A have been in the ₹1 lakh to ₹10 lakh range for documented financial losses. The mechanism exists. Most people don’t use it because it’s not widely publicised.
Can you use the consumer forum after a breach?
Did you have a service relationship with the company that breached your data, such as a bank, telecom operator, or e-commerce platform? Then you have an additional route: the consumer forum.
You can file a complaint on grounds of “deficiency of service.” The forums are the District Consumer Disputes Redressal Commission (DCDRC), the State Commission (SCDRC), and the National Commission (NCDRC). This is a genuinely viable option after a data breach. Your grounds: the company collected your data, charged you for (or promised you) a service, and failed to protect it. That is a deficiency in service delivery.
Consumer forum complaints must be filed within two years of the cause of action (when you knew or should have known about the breach). The process is relatively accessible: you file in writing, appear for hearings (which are increasingly available via video conference), and present your documentation. Awards in consumer forum cases for data breach-related complaints have ranged from ₹5,000 to ₹50,000 in documented orders. These awards aren’t large — but they’re real, and the forum is free to use for claims under ₹50 lakh.
Criminal provisions: Section 66C and 66D
If your breach led to someone using your data to commit crimes, the IT Act provides criminal routes that the civil compensation frameworks don’t cover.
Section 66C makes identity theft using computer resources a criminal offence, carrying imprisonment of up to three years plus a fine of up to ₹1 lakh. Section 66D covers cheating by impersonation using computer resources — same penalties. If fraudulent transactions, SIM swaps, or loan applications have appeared in your name following a breach, file an FIR with the cybercrime cell of your local police. You can also file online at cybercrime.gov.in.
Criminal proceedings run separately from civil compensation claims. You can pursue both.
What’s the realistic timeline for DPDPA enforcement?
GDPR became law in May 2018. The first major fine — Ireland’s DPC fining Meta €1.2 billion — came in May 2023. Five years. During that period, companies hedged, compliance budgets were minimal, and individuals had few practical remedies through the new system.
India’s DPDPA enforcement is likely to follow a similar trajectory. The most realistic window for active DPBI enforcement — with meaningful regulatory fines on companies — is 2026 to 2028. Enforcement activity is likely to accelerate after the first major fine lands. Individual compensation for data breach victims is expected to remain through the IT Act’s Adjudicating Officer mechanism for the foreseeable future.
That doesn’t mean you wait. Document now. Keep every breach notification you receive. Screenshot news coverage of breaches involving companies you deal with. If you’ve suffered financial loss or documented distress, preserve that evidence. When the DPBI is operational, your complaint will be stronger for it. And the Adjudicating Officer and consumer forum routes under existing law are available to you today.
Frequently asked questions
Can I claim compensation for a data breach in India today? Yes, but not through the DPDPA yet. Use Section 43A of the IT Act (via an Adjudicating Officer) or the consumer forum for “deficiency of service.” Awards run roughly ₹1–10 lakh under Section 43A for documented loss.
Does the DPDPA give me a right to compensation? No. It lets the Data Protection Board fine companies up to ₹250 crore, but those fines go to the government, not to you. That’s a gap critics have flagged compared with GDPR.
Is the Data Protection Board working yet? Not fully. The DPDP Rules were notified in November 2025 and the Board was legally established, but as of mid-2026 it isn’t fully operational and obligations phase in through 2026–2027.
What if someone used my data for fraud? File an FIR under IT Act Sections 66C and 66D (identity theft and impersonation) with your local cybercrime cell or at cybercrime.gov.in. You can pursue this alongside a civil compensation claim. For a picture of India’s breach landscape, see our Indian data breach index, and check where your data appears on people-search sites.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. That kind of documentation is directly relevant to establishing harm in a compensation claim. Once KnytX Shield launches it will find and remove these listings automatically. Join the waitlist to get in early.