Loading story…
India's Digital Personal Data Protection Act (DPDPA), 2023, introduces a transformative regulatory framework that significantly increases the financial and legal consequences for organizations experiencing data breaches. Previously, Indian organizations faced high operational costs from breaches, but regulatory penalties were minimal and rarely served as a strong deterrent. The DPDPA now imposes much stricter requirements and the potential for penalties up to ₹250 crore, fundamentally changing how companies must approach data protection and breach response.
In contrast, many jurisdictions, particularly in the United States, still rely on vague legal language such as requiring notification of breaches "in the most expedient time possible," with little enforcement or clear definition of what constitutes unreasonable delay. While there have been some high-profile cases resulting in monetary penalties for delayed notification, these remain rare, and most breaches do not result in significant regulatory action. The global landscape thus reflects a patchwork of enforcement and requirements, with India now setting a notably higher bar for breach accountability and timely notification.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
India's Digital Personal Data Protection (DPDP) Act introduces stringent new requirements for organizations handling personal data, including provable compliance, detailed data flow tracking, and comprehensive logging. The law imposes tighter notification deadlines and significantly increases penalties for non-compliance, elevating data protection to a central element of enterprise risk management. Experts highlight that these changes necessitate a shift from reactive to proactive compliance strategies, with a focus on operational readiness and risk reduction. Organizations are advised to adopt a phased, integrated budgeting approach that aligns privacy and security investments, as technical safeguards such as logging, encryption, and access controls are now legal obligations under the DPDP Act. Early and targeted investment in compliance infrastructure is recommended to mitigate regulatory exposure, reduce operational strain, and avoid the higher costs associated with last-minute or retrofitted solutions. Senior leadership is encouraged to prioritize foundational capabilities such as data inventories, governance structures, and system visibility to ensure sustainable compliance and minimize disruption.
Jun 29, 2026
India has enacted the Digital Personal Data Protection (DPDP) Rules, 2025, introducing stringent requirements for consent management, data retention, and algorithmic oversight. The new regulations require organizations to implement itemized user notices, verifiable parental consent for children's data, and fixed deletion timelines, impacting sectors such as e-commerce, gaming, and social media. Significant Data Fiduciaries—large platforms handling sensitive data—must now conduct annual data protection impact assessments and audits, and apply additional controls to algorithmic systems processing personal data. To comply, companies must redesign their data architectures, including the deployment of consent managers, encrypted storage zones, and real-time governance tools across both cloud and on-premises environments. The rules also establish a new category of Consent Managers, mandate the maintenance of one-year processing logs, and require the appointment of officers to handle user queries. Staggered compliance deadlines give enterprises 12 to 18 months to adapt, while certain health and allied services are granted exemptions for child data processing under specific conditions.
Jun 29, 2026
The Reserve Bank of India (RBI) has mandated that all banks and financial institutions migrate their websites to the exclusive ".bank.in" domain, aiming to combat rising digital fraud, phishing scams, and cyber-attacks targeting the Indian banking sector. This move is designed to prevent domain spoofing, enhance customer trust, and strengthen the overall cybersecurity posture of the financial ecosystem by ensuring only RBI-approved banks can register these domains, implementing DNSSEC, and enforcing strict encryption standards. The initiative aligns with global best practices and is expected to significantly reduce cyber fraud associated with fake banking websites. Simultaneously, the Digital Personal Data Protection (DPDP) Act, 2023, is reshaping data governance in India's Banking, Financial Services, and Insurance (BFSI) sector. The Act grants customers greater control over their personal data, including rights to access, correct, and request deletion, and mandates informed, granular consent for data collection and sharing. With the average cost of a data breach in India reaching US$2.18 million in 2023 and customer skepticism on the rise, these regulatory measures are positioned as critical steps to restore trust, ensure transparency, and provide a competitive advantage for institutions that proactively comply.
Jun 29, 2026