dpdpr.in
Am I covered?

DPDP enforcement tracker

No Board penalty yet. The Data Protection Board of India has not issued any penalty or order. Its inquiry and penalty powers start on 13 May 2027, and as of the latest official sources its Chairperson and Members had not been appointed. About the Board.

This tracker lists reported actions, complaints, court and regulator actions and notable Indian data incidents discussed in the DPDP context. We use neutral wording. An entry here is not a finding that anyone broke the law. See the editorial policy.

Tracker (11 entries)

  1. Reported

    AU Small Finance Bank

    AU Small Finance Bank said it was investigating a potential data leak involving a Salesforce-hosted platform holding limited data on its vehicle loan customers, after a hacker group claimed to hold KYC, PAN, Aadhaar and loan records. The bank said its own systems were unaffected, and Inc42 could not independently verify the group's claims.

    DPDP provision
    None stated The source does not cite DPDP provisions. Breach intimation under section 8(6) and rule 7 comes into force on 13 May 2027.
  2. Reported

    Data Protection Board of India

    BusinessLine reported, citing a senior MeitY official, that the process to appoint the Board's Chairperson and Members was moving forward and the Board would be in place soon, but that no exact timeline could be committed. The report followed the Kerala High Court's expectation that the Board be made functional within eight weeks.

    DPDP provision
    Section 18, Rule 17
  3. Complaint filed

    Central Board of Film Certification (eCinePramaan portal)

    A report alleged unauthorised access to film certification documents on the CBFC eCinePramaan portal. CBFC said it found no trace of the documents claimed to have been accessed, filed a complaint with cybercrime authorities as a matter of caution, and notified CERT-In.

    DPDP provision
    None stated The complaint was filed with cybercrime authorities, not under the DPDP Act.
  4. Reported

    Data Protection Board of India

    The Economic Times reported that an RTI response showed the Board had spent nothing on salaries, office expenses, rent or ICT equipment as of 30 September 2026, with Consent Manager registration due to start on 13 November 2026.

  5. Court order

    Digital News Publishers Association (DNPA v. Union of India)

    The Supreme Court issued notice to the Centre on a petition by the Digital News Publishers Association challenging provisions of the DPDP Act and Rules for lacking an exemption for journalism. The bench declined an interim stay without hearing the government and listed the matter for 17 November 2026.

    DPDP provision
    Section 7, Section 17(2), Section 18, Section 19, Section 27, Section 29, Section 36, Section 37, Section 44(3), Rule 16, Rule 17, Rule 23 Provisions challenged in the petition. The Court has made no finding on their validity.
  6. Court order

    Google India (student's writ petition, Punjab and Haryana High Court)

    The Punjab and Haryana High Court issued notice to Google India and the Centre on a writ petition by a student locked out of his Google accounts since his phone was stolen, who alleges Google did not act on a Grievance Appellate Committee order to help him recover his data. The petition argues under the DPDP Act that loss of access is a personal data breach and that Google's two-year inactive account deletion policy conflicts with the Act and Rules; the matter is listed for 20 November 2026.

    DPDP provision
    Section 2(u), Section 8(5), Section 8(7), Section 8(8), Section 27, Rule 6, Rule 8 Provisions relied on in the petition. The Court has made no finding on them.
  7. Reported

    State Bank of India

    SBI disclosed to the stock exchanges that personal details of 3,897 customers were identified among records found on the dark web, after alerts from the Defence Cyber Agency and CERT-In. SBI said it engaged a CERT-In empanelled agency to investigate the alleged compromise.

    DPDP provision
    Section 8(5), Section 8(6), Rule 7 Discussed by the source in relation to section 8(6) and rule 7, which come into force on 13 May 2027.
  8. Court order

    Union of India and Digi Yatra Foundation (C.R. Neelakandan v. Union of India)

    In a PIL raising privacy concerns about Digi Yatra, the Kerala High Court recorded the Centre's submission that the Board had been constituted but was not functional, and said it expected the Board to be made functional within eight weeks. The PIL was disposed of.

    DPDP provision
    Section 18
  9. Reported

    Reliance group (server hosted by a third-party provider)

    Reliance reportedly confirmed a partial breach of data on a server hosted by a third-party provider, according to Reuters as cited by MediaNama. MediaNama reported the leaked files included material related to the Kudankulam Nuclear Power Plant. CERT-In was reportedly looking into it.

    DPDP provision
    None stated The source notes that rule 7 breach reporting is not yet in force.
  10. Reported

    Ultrahuman

    Wearable maker Ultrahuman said attackers gained read-only access to some users' contact details, transaction history and fitness-related data in an incident on 27 March 2026, and informed affected users on 2 June 2026. It said no passwords or payment data were affected.

    DPDP provision
    Section 8(6), Rule 7 Discussed by the source in relation to rule 7, which comes into force on 13 May 2027.
  11. Sectoral regulator action

    Star Health and Allied Insurance

    IRDAI imposed a penalty of 3.39 crore rupees and issued a warning for violations of the IRDAI Information and Cyber Security Guidelines, 2023, according to the company's stock exchange intimation. The insurer had faced a cyber attack and customer data leak in 2024. This is a sectoral regulator action, not a DPDP Act penalty.

    DPDP provision
    None stated Imposed under IRDAI guidelines, not under the DPDP Act.

What the labels mean

  • Reported Reported in the media or disclosed by the entity. No official finding.
  • Complaint filed A complaint has been filed with an authority (for example police, CERT-In or a court). No finding.
  • Court order A court has passed an order or direction in a related matter. Not a Board order.
  • Sectoral regulator action A sectoral regulator other than the Board has acted under its own law.
  • Board order An order or direction of the Data Protection Board of India.
  • Board penalty A monetary penalty imposed by the Data Protection Board of India under section 33.

Recent coverage

DPDP and Indian data breach stories picked up automatically from bharat.digital on each rebuild. Headlines link to the original publishers.

Data: /data/enforcement.json. New entries by RSS: what changed. Tracker updated 2026-11-01.

On this page
  1. Tracker
  2. Labels
  3. Recent coverage