{
 "schema_version": 1,
 "updated": "2026-11-01",
 "note": "No penalty or order has been issued by the Data Protection Board of India. The Board's inquiry and penalty powers under sections 27, 28 and 33 come into force on 13 May 2027, and as of the latest official sources the Chairperson and Members had not been appointed. Entries below are reported incidents, complaints or court actions discussed in the DPDP context. Unless an entry has status board_order or penalty with an official source, nothing here is a finding that anyone violated the law.",
 "status_values": {
  "reported": "Reported in the media or disclosed by the entity. No official finding.",
  "complaint_filed": "A complaint has been filed with an authority (for example police, CERT-In or a court). No finding.",
  "court_order": "A court has passed an order or direction in a related matter. Not a Board order.",
  "regulator_action": "A sectoral regulator other than the Board has acted under its own law.",
  "board_order": "An order or direction of the Data Protection Board of India.",
  "penalty": "A monetary penalty imposed by the Data Protection Board of India under section 33."
 },
 "entries": [
  {
   "id": "2026-10-au-sfb-potential-leak",
   "date": "2026-10-31",
   "entity": "AU Small Finance Bank",
   "summary": "AU Small Finance Bank said it was investigating a potential data leak involving a Salesforce-hosted platform holding limited data on its vehicle loan customers, after a hacker group claimed to hold KYC, PAN, Aadhaar and loan records. The bank said its own systems were unaffected, and Inc42 could not independently verify the group's claims.",
   "status": "reported",
   "provisions": [],
   "provisions_note": "The source does not cite DPDP provisions. Breach intimation under section 8(6) and rule 7 comes into force on 13 May 2027.",
   "sources": [
    {
     "title": "AU SFB Probes Potential Data Leak, Vijay Sales' Admin Access Allegedly Listed For $25K",
     "publisher": "Inc42",
     "url": "https://inc42.com/buzz/au-sfb-probes-potential-data-leak-vijay-sales-admin-access-allegedly-listed-for-25k/",
     "date": "2026-10-31"
    }
   ],
   "added": "2026-11-01"
  },
  {
   "id": "2026-10-dpbi-appointments-pending",
   "date": "2026-10-30",
   "entity": "Data Protection Board of India",
   "summary": "BusinessLine reported, citing a senior MeitY official, that the process to appoint the Board's Chairperson and Members was moving forward and the Board would be in place soon, but that no exact timeline could be committed. The report followed the Kerala High Court's expectation that the Board be made functional within eight weeks.",
   "status": "reported",
   "provisions": [
    "s.18",
    "r.17"
   ],
   "sources": [
    {
     "title": "Data Protection Board to be in place 'pretty soon': Government Sources",
     "publisher": "The Hindu BusinessLine",
     "url": "https://www.thehindubusinessline.com/info-tech/data-protection-board-to-be-in-place-pretty-soon-government-sources/article71645304.ece",
     "date": "2026-10-30"
    }
   ],
   "added": "2026-10-31"
  },
  {
   "id": "2026-10-cbfc-ecinepramaan",
   "date": "2026-10-27",
   "entity": "Central Board of Film Certification (eCinePramaan portal)",
   "summary": "A report alleged unauthorised access to film certification documents on the CBFC eCinePramaan portal. CBFC said it found no trace of the documents claimed to have been accessed, filed a complaint with cybercrime authorities as a matter of caution, and notified CERT-In.",
   "status": "complaint_filed",
   "provisions": [],
   "provisions_note": "The complaint was filed with cybercrime authorities, not under the DPDP Act.",
   "sources": [
    {
     "title": "CBFC data breach exposed movie scripts, censor cuts summaries and distribution deals of 500+ films: Report",
     "publisher": "MediaNama",
     "url": "https://www.medianama.com/2026/10/223-cbfc-data-breach-censor-cuts-distribution/",
     "date": "2026-10-27"
    }
   ],
   "added": "2026-10-29"
  },
  {
   "id": "2026-10-dpbi-rti-not-functional",
   "date": "2026-10-27",
   "entity": "Data Protection Board of India",
   "summary": "The Economic Times reported that an RTI response showed the Board had spent nothing on salaries, office expenses, rent or ICT equipment as of 30 September 2026, with Consent Manager registration due to start on 13 November 2026.",
   "status": "reported",
   "provisions": [
    "s.18",
    "s.6(9)",
    "r.4"
   ],
   "sources": [
    {
     "title": "Clock's ticking for data protection, but the boardroom remains empty",
     "publisher": "The Economic Times",
     "url": "https://economictimes.indiatimes.com/tech/technology/data-protection-board-of-india-struggles-to-function-before-november-13-deadline/articleshow/135214799.cms",
     "date": "2026-10-27"
    }
   ],
   "added": "2026-10-29"
  },
  {
   "id": "2026-10-sc-dnpa-dpdp-challenge",
   "date": "2026-10-27",
   "entity": "Digital News Publishers Association (DNPA v. Union of India)",
   "summary": "The Supreme Court issued notice to the Centre on a petition by the Digital News Publishers Association challenging provisions of the DPDP Act and Rules for lacking an exemption for journalism. The bench declined an interim stay without hearing the government and listed the matter for 17 November 2026.",
   "status": "court_order",
   "provisions": [
    "s.7",
    "s.17(2)",
    "s.18",
    "s.19",
    "s.27",
    "s.29",
    "s.36",
    "s.37",
    "s.44(3)",
    "r.16",
    "r.17",
    "r.23"
   ],
   "provisions_note": "Provisions challenged in the petition. The Court has made no finding on their validity.",
   "sources": [
    {
     "title": "'Newsrooms Will Shutdown' : Digital Wings Of Legacy Media Move Supreme Court Challenging Personal Data Protection Law",
     "publisher": "LiveLaw",
     "url": "https://www.livelaw.in/top-stories/newsrooms-will-shutdown-digital-wings-of-legacy-media-move-supreme-court-challenging-personal-data-protection-law-556103",
     "date": "2026-10-27"
    },
    {
     "title": "Ambani, Adani-linked media groups among petitioners challenging data protection law in Supreme Court",
     "publisher": "Bar and Bench",
     "url": "https://www.barandbench.com/news/litigation/ambani-adani-linked-media-groups-among-petitioners-challenging-data-protection-law-in-supreme-court",
     "date": "2026-10-27"
    }
   ],
   "added": "2026-10-31"
  },
  {
   "id": "2026-10-ph-hc-google-gmail-access",
   "date": "2026-10-26",
   "entity": "Google India (student's writ petition, Punjab and Haryana High Court)",
   "summary": "The Punjab and Haryana High Court issued notice to Google India and the Centre on a writ petition by a student locked out of his Google accounts since his phone was stolen, who alleges Google did not act on a Grievance Appellate Committee order to help him recover his data. The petition argues under the DPDP Act that loss of access is a personal data breach and that Google's two-year inactive account deletion policy conflicts with the Act and Rules; the matter is listed for 20 November 2026.",
   "status": "court_order",
   "provisions": [
    "s.2(u)",
    "s.8(5)",
    "s.8(7)",
    "s.8(8)",
    "s.27",
    "r.6",
    "r.8"
   ],
   "provisions_note": "Provisions relied on in the petition. The Court has made no finding on them.",
   "sources": [
    {
     "title": "Punjab & Haryana High Court Issues Notice To Google, Centre On Student's Plea For Recovery Of Locked Gmail Accounts",
     "publisher": "LiveLaw",
     "url": "https://www.livelaw.in/high-court/punjab-and-haryana-high-court/punjab-haryana-high-court-issues-notice-to-google-centre-on-plea-to-enforce-grievance-appellate-committee-order-555958",
     "date": "2026-10-26"
    },
    {
     "title": "HC notice to Google India over student's inaccessible Gmail accounts",
     "publisher": "The Tribune",
     "url": "https://www.tribuneindia.com/news/news-legal/hc-notice-to-google-india-over-students-inaccessible-gmail-accounts/",
     "date": "2026-10-26"
    }
   ],
   "added": "2026-11-01"
  },
  {
   "id": "2026-10-sbi-dark-web-records",
   "date": "2026-10-21",
   "entity": "State Bank of India",
   "summary": "SBI disclosed to the stock exchanges that personal details of 3,897 customers were identified among records found on the dark web, after alerts from the Defence Cyber Agency and CERT-In. SBI said it engaged a CERT-In empanelled agency to investigate the alleged compromise.",
   "status": "reported",
   "provisions": [
    "s.8(5)",
    "s.8(6)",
    "r.7"
   ],
   "provisions_note": "Discussed by the source in relation to section 8(6) and rule 7, which come into force on 13 May 2027.",
   "sources": [
    {
     "title": "SBI confirms data of 3,897 customers exposed on dark web",
     "publisher": "MediaNama",
     "url": "https://www.medianama.com/2026/10/223-sbi-data-breach-3897-customers-dark-web/",
     "date": "2026-10-21"
    }
   ],
   "added": "2026-10-29"
  },
  {
   "id": "2026-10-kerala-hc-digi-yatra",
   "date": "2026-10-10",
   "entity": "Union of India and Digi Yatra Foundation (C.R. Neelakandan v. Union of India)",
   "summary": "In a PIL raising privacy concerns about Digi Yatra, the Kerala High Court recorded the Centre's submission that the Board had been constituted but was not functional, and said it expected the Board to be made functional within eight weeks. The PIL was disposed of.",
   "status": "court_order",
   "provisions": [
    "s.18"
   ],
   "sources": [
    {
     "title": "'Make Data Protection Board Functional In 8 Weeks': Kerala High Court In PIL Raising Privacy Concerns In 'Digi Yatra'",
     "publisher": "LiveLaw",
     "url": "https://www.livelaw.in/high-court/kerala-high-court/kerala-high-court-digi-yatra-data-protection-board-553994",
     "date": "2026-10-10"
    }
   ],
   "added": "2026-10-29"
  },
  {
   "id": "2026-07-reliance-yotta-partial-breach",
   "date": "2026-07-16",
   "entity": "Reliance group (server hosted by a third-party provider)",
   "summary": "Reliance reportedly confirmed a partial breach of data on a server hosted by a third-party provider, according to Reuters as cited by MediaNama. MediaNama reported the leaked files included material related to the Kudankulam Nuclear Power Plant. CERT-In was reportedly looking into it.",
   "status": "reported",
   "provisions": [],
   "provisions_note": "The source notes that rule 7 breach reporting is not yet in force.",
   "sources": [
    {
     "title": "Kudankulam Nuclear Data Leaked On Dark Web: What We Found",
     "publisher": "MediaNama",
     "url": "https://www.medianama.com/2026/07/223-reliance-data-breach-kudankulam-files-dark-web/",
     "date": "2026-07-16"
    }
   ],
   "added": "2026-10-29"
  },
  {
   "id": "2026-06-ultrahuman-wellness-data",
   "date": "2026-06-04",
   "entity": "Ultrahuman",
   "summary": "Wearable maker Ultrahuman said attackers gained read-only access to some users' contact details, transaction history and fitness-related data in an incident on 27 March 2026, and informed affected users on 2 June 2026. It said no passwords or payment data were affected.",
   "status": "reported",
   "provisions": [
    "s.8(6)",
    "r.7"
   ],
   "provisions_note": "Discussed by the source in relation to rule 7, which comes into force on 13 May 2027.",
   "sources": [
    {
     "title": "Ultrahuman Data Breach Exposes Users' Wellness Data",
     "publisher": "MediaNama",
     "url": "https://www.medianama.com/2026/06/223-ultrahuman-suffers-security-breach-exposing-users-wellness-data/",
     "date": "2026-06-04"
    }
   ],
   "added": "2026-10-29"
  },
  {
   "id": "2025-07-star-health-irdai-penalty",
   "date": "2025-07-25",
   "entity": "Star Health and Allied Insurance",
   "summary": "IRDAI imposed a penalty of 3.39 crore rupees and issued a warning for violations of the IRDAI Information and Cyber Security Guidelines, 2023, according to the company's stock exchange intimation. The insurer had faced a cyber attack and customer data leak in 2024. This is a sectoral regulator action, not a DPDP Act penalty.",
   "status": "regulator_action",
   "provisions": [],
   "provisions_note": "Imposed under IRDAI guidelines, not under the DPDP Act.",
   "sources": [
    {
     "title": "IRDAI imposes ₹3.39 cr penalty on Star Health Insurance",
     "publisher": "The Hindu",
     "url": "https://www.thehindu.com/business/irdai-imposes-339-cr-penalty-on-star-health-insurance/article69858449.ece",
     "date": "2025-07-26"
    }
   ],
   "added": "2026-10-29"
  }
 ]
}