Introduction 

On 21 October 2026, State Bank of India (SBI) disclosed an incident involving the loss of certain customer data after records containing personal information appeared on the dark web. SBI had received alerts on 16 October from its threat-intelligence provider, the Defence Cyber Agency and the Indian Computer Emergency Response Team (CERT-In). A preliminary examination of approximately 375,000 records identified 3,897 customer records containing personally identifiable information. 

The exposed information reportedly included names, registered mobile numbers, dates of birth, gender, email and residential addresses, branch and Customer Information File (CIF) identifiers, lead IDs and metadata associated with loan or lead records. SBI activated its incident-response protocols and appointed an independent CERT-In-empanelled cybersecurity agency to investigate the source and extent of the exposure. The bank stated that its core operations, financial performance and business continuity remained unaffected. On 23 October, SBI began individually notifying affected customers through email and WhatsApp.  

Through this blog, we aim to address a larger regulatory question, when personal information is compromised, do India's existing rules adequately ensure that affected individuals receive the information needed to protect themselves? 

India Already Requires Cyber-Incident Reporting 

Under the CERT-In Directions of 28 April 2022, specified cybersecurity incidents must generally be reported to CERT-In within six hours of the entity noticing the incident or being informed about it. CERT-In has clarified that this includes data breaches and data leaks. Where complete information is unavailable within six hours, an organisation may submit what it knows and provide further information later. 

Financial institutions also operate under sector-specific cybersecurity requirements. The RBI (Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026 require regulated entities to establish cyber-incident response and recovery procedures, analyse incidents for their severity, impact and root cause, and maintain communication plans for reporting to senior management, regulators and customers as required. Regulated entities must also proactively report relevant incidents to CERT-In and the appropriate financial regulator. These requirements create a relatively strong regulator-facing framework. They do not, however, establish the same universal standard for informing every individual whose personal data has been compromised. 

Reporting to a Regulator Is Different From Warning a Customer 

A regulator needs information about the technical incident: when it occurred, what systems were affected, how the attack happened and whether wider infrastructure is at risk. A customer needs something different. They need to know what information about them was exposed, what could happen because of that exposure and what they should do next.

A breach involving names, phone numbers, dates of birth, addresses and banking-related identifiers may create risks even where passwords or account balances have not been compromised. The information can potentially make phishing and impersonation attempts more convincing because fraudsters can refer to accurate details when posing as bank employees. 

SBI's subsequent individual communication to affected customers illustrates the value of direct notification. Customers who know their information has been exposed can scrutinise suspicious calls, messages, transactions and requests for KYC or banking credentials more carefully. The weakness in the current framework is that regulatory reporting and individual notification do not yet operate under one comprehensive personal-data breach regime. 

The DPDP Act Changes the Position 

Section 8(5) requires a Data Fiduciary to protect personal data in its possession or control by taking reasonable security safeguards to prevent a personal data breach. Section 8(6) then requires the Data Fiduciary, where a breach occurs, to intimate both the Data Protection Board of India and each affected Data Principal in the prescribed manner. 

The Digital Personal Data Protection Rules, 2025 provide the operational detail. Rule 7 requires each affected individual to be informed, without delay and in clear and plain language, about the nature and extent of the breach, its likely consequences, mitigation measures, steps the individual can take to protect their interests and contact information for further queries. 

The Data Protection Board must separately receive an initial description of the breach without delay. More detailed information, including its circumstances, mitigation measures and steps taken to prevent recurrence, must generally follow within 72 hours. This creates something the present regime lacks, which is, a direct statutory connection between a personal-data breach and the individual affected by it. 

The Implementation Gap  

The substantive obligations under Section 8, including the security and breach-intimation requirements, are among the DPDP provisions scheduled to commence eighteen months after the 13 November 2025 notification. The corresponding Rules 5 to 16, including Rules 6 and 7, follow the same commencement period. On that timetable, the breach-notification framework is due to become operational in May 2027. 

The SBI incident has occurred during this transition. 

CERT-In and RBI rules already impose cybersecurity and regulatory-reporting responsibilities, while listed companies may also have disclosure obligations under Regulation 30 of the SEBI Listing Obligations and Disclosure Requirements Regulations. SBI itself made its 21 October disclosure to the stock exchanges under Regulation 30. 

Yet these frameworks serve different audiences. CERT-In reporting supports national cybersecurity response. RBI requirements focus on financial-sector resilience and supervision. SEBI disclosure keeps investors informed about material developments. The DPDP framework adds the missing privacy perspective, of the person whose information has been compromised. 

Security Obligations Go Beyond Breach Notification 

The effectiveness of the DPDP framework will also depend on what organisations are required to do before a breach occurs. Rule 6 of the DPDP Rules specifies reasonable security safeguards that Data Fiduciaries are expected to implement. These include measures such as encryption, masking or virtual tokens where appropriate, access controls, monitoring and review of logs, backups, and contractual safeguards where processing is carried out through Data Processors. 

For banks, these requirements will operate alongside the RBI's existing cybersecurity framework. The RBI already expects regulated entities to conduct vulnerability assessments and penetration testing, identify and remediate vulnerabilities, establish incident-response procedures and conduct post-incident analysis. 

DPDP compliance should not reduce breach management to sending notices after information has escaped. Organisations will need to show that appropriate preventive safeguards existed and that weaknesses identified after an incident have been corrected. 

Should Every Breach Trigger Customer Notification? 

The DPDP framework takes a broad approach. Rule 7 does not establish a separate numerical threshold before an affected individual must be informed. Nor does it limit notification to incidents involving financial loss. Once a personal data breach within the Act occurs, the requirement is tied to the affected Data Principal. This approach has advantages. The organisation holding the data may not be able to predict every consequence of an exposure. Information that appears relatively harmless in isolation may become more dangerous when combined with information obtained elsewhere. 

At the same time, broad notification requirements may create operational challenges. Large organisations can experience numerous security events, and excessive breach notices may eventually produce the same kind of fatigue seen with other digital compliance communications. 

Clear regulatory guidance on what constitutes awareness of a breach, how affected persons should be identified and how evolving investigations should be communicated will matter once the provisions begin operating. 

What Should Financial Institutions Do Now? 

Banks should prepare for the DPDP framework before the formal commencement of its breach-reporting requirements. 

• Integrate privacy and cyber-incident response: Incident teams should assess the personal-data consequences of an event alongside its technical and operational impact. 

  
  

• Map affected individuals quickly: Systems should make it possible to determine which customer records were involved rather than focusing only on the compromised database or system. 

  
  

• Prepare customer-notification templates: Notices should identify the information affected, explain likely risks and provide practical measures customers can take. 

  
  

• Strengthen vendor oversight: Banks should ensure that processors, cloud providers and other service providers can rapidly report incidents and provide the information necessary for regulatory and customer notifications. 

  
  

• Maintain evidence of security controls: Logs, access records, forensic material and remediation measures will be important in demonstrating that reasonable security safeguards were implemented. 

  
  

• Coordinate overlapping notifications: CERT-In, RBI, SEBI and the Data Protection Board may require information about the same incident for different regulatory purposes. Internal processes should be designed to meet each obligation without delaying customer protection. 

Are India's Existing Mechanisms Adequate? 

India already has substantial cybersecurity-reporting infrastructure. CERT-In's six-hour reporting requirement is particularly demanding, and RBI-regulated institutions operate under detailed cyber-risk and incident-management expectations.  

The gap lies in individual notification. Existing mechanisms are strongest at ensuring that regulators and institutions know about significant cyber events. The DPDP Act shifts part of that attention towards the person whose data has actually been compromised by creating an express duty to notify affected Data Principals. 

The SBI incident shows why the distinction matters. A bank can continue operating normally while an affected customer faces heightened risks of impersonation, phishing or identity fraud. Business continuity and individual harm are separate measurements of the seriousness of a breach. 

Conclusion 

The SBI incident arrives at a transitional moment in India's data-protection regime. Existing CERT-In, RBI and SEBI frameworks provide important mechanisms for incident reporting, cybersecurity governance and market disclosure, but they do not yet create a unified statutory system centred on notification of affected individuals. 

The DPDP Act and Rules are designed to close that gap. Once operational, Data Fiduciaries will have explicit duties to maintain reasonable safeguards, inform the Data Protection Board and directly notify people affected by a personal data breach. 

For financial institutions, that change will require more than another regulatory filing. Effective breach response will have to connect cybersecurity investigation with customer protection, allowing individuals to understand what happened and act before exposed information is used against them. 

Want to Stay Ahead? 
Reach out to the experts at Tsaaro today.