Data breach: SBI admits exposure of its customer data on the Dark Web

The exposure of banking data on the dark web underscores the growing threat of cyber attacks and the vulnerability of Critical Information Infrastructure (CII). In India, the Computer Emergency Response Team (CERT-In), functioning under the Ministry of Electronics and Information Technology (MeitY), acts as the national nodal agency for responding to computer security incidents. The Reserve Bank of India (RBI) also mandates a stringent cyber security framework for banks to safeguard financial data. This incident highlights a reactive rather than proactive security posture, as the breach was detected by external threat intelligence rather than internal mechanisms. For UPSC, understanding the mandate of CERT-In, the definition of CII under the Information Technology Act, 2000, and the evolving nature of cyber threats (like ransomware and data exfiltration) is crucial.

The regulatory landscape surrounding data protection in India is currently in a transitional phase. The Digital Personal Data Protection Act, 2023 (DPDP Act) was enacted to govern the processing of digital personal data, recognizing both the right of individuals to protect their data and the need to process such data for lawful purposes. However, the article highlights a significant issue: a staggered commencement. Specifically, Section 8(6) of the DPDP Act, which mandates a Data Fiduciary (the entity determining the purpose and means of processing personal data, like the bank here) to intimate the Data Protection Board and affected Data Principals (the individuals to whom the data relates) about a breach, has not yet been notified into force. Consequently, current regulations, such as CERT-In directions and RBI guidelines, prioritize reporting to regulators over informing affected individuals. This delay raises questions about the practical realization of the right to privacy, recognized as a fundamental right under Article 21 in the landmark Puttaswamy judgment. UPSC candidates should critically analyze the delayed implementation of the DPDP Act and its implications for citizen rights.

The incident brings to light the tension between corporate compliance and consumer protection. While a listed entity like the bank complied with Securities and Exchange Board of India (SEBI) disclosure norms by informing stock exchanges to protect investors, it lacked a clear legal obligation to promptly inform the customers whose Personally Identifiable Information (PII) was compromised. This regulatory gap exposes customers to risks like phishing and identity theft. Civil society organizations, such as the Internet Freedom Foundation (IFF), are advocating for immediate notification mechanisms, emphasizing principles of transparency and accountability. From a governance perspective, this scenario illustrates the challenges regulators face in keeping pace with technological advancements and ensuring that regulatory frameworks prioritize citizen welfare alongside corporate compliance. Questions in the exam may focus on evaluating the efficacy of current grievance redressal mechanisms and the role of civil society in shaping digital rights.