--- title: "DPDP Enforcement Tracker: Complaints and Cases | dpdpr.in" description: "Tracker of reported DPDP-related complaints, court and regulator actions and data incidents in India. The Board's penalty powers start 13 May 2027." url: "https://dpdpr.in/enforcement/" canonical: "https://dpdpr.in/enforcement/" site: "dpdpr.in" updated: "2026-11-02" disclaimer: "Independent reference, not legal advice. Not affiliated with the Government of India or MeitY." --- # DPDP enforcement tracker **No Board penalty yet.** The Data Protection Board of India has not issued any penalty or order. Its inquiry and penalty powers start on 13 May 2027, and as of the latest official sources its Chairperson and Members had not been appointed. [About the Board](https://dpdpr.in/board/). This tracker lists reported actions, complaints, court and regulator actions and notable Indian data incidents discussed in the DPDP context. We use neutral wording. An entry here is not a finding that anyone broke the law. See the [editorial policy](https://dpdpr.in/editorial-policy/). ## Tracker (11 entries) 1. 31 Oct 2026 Reported ### AU Small Finance Bank AU Small Finance Bank said it was investigating a potential data leak involving a Salesforce-hosted platform holding limited data on its vehicle loan customers, after a hacker group claimed to hold KYC, PAN, Aadhaar and loan records. The bank said its own systems were unaffected, and Inc42 could not independently verify the group's claims. - **DPDP provision**: None stated The source does not cite DPDP provisions. Breach intimation under section 8(6) and rule 7 comes into force on 13 May 2027. - **Source**: [Inc42: AU SFB Probes Potential Data Leak, Vijay Sales' Admin Access Allegedly Listed For $25K](https://inc42.com/buzz/au-sfb-probes-potential-data-leak-vijay-sales-admin-access-allegedly-listed-for-25k/) 2. 30 Oct 2026 Reported ### Data Protection Board of India BusinessLine reported, citing a senior MeitY official, that the process to appoint the Board's Chairperson and Members was moving forward and the Board would be in place soon, but that no exact timeline could be committed. The report followed the Kerala High Court's expectation that the Board be made functional within eight weeks. - **DPDP provision**: [Section 18](https://dpdpr.in/act/section-18/), [Rule 17](https://dpdpr.in/rules/rule-17/) - **Source**: [The Hindu BusinessLine: Data Protection Board to be in place 'pretty soon': Government Sources](https://www.thehindubusinessline.com/info-tech/data-protection-board-to-be-in-place-pretty-soon-government-sources/article71645304.ece) 3. 27 Oct 2026 Complaint filed ### Central Board of Film Certification (eCinePramaan portal) A report alleged unauthorised access to film certification documents on the CBFC eCinePramaan portal. CBFC said it found no trace of the documents claimed to have been accessed, filed a complaint with cybercrime authorities as a matter of caution, and notified CERT-In. - **DPDP provision**: None stated The complaint was filed with cybercrime authorities, not under the DPDP Act. - **Source**: [MediaNama: CBFC data breach exposed movie scripts, censor cuts summaries and distribution deals of 500+ films: Report](https://www.medianama.com/2026/10/223-cbfc-data-breach-censor-cuts-distribution/) 4. 27 Oct 2026 Reported ### Data Protection Board of India The Economic Times reported that an RTI response showed the Board had spent nothing on salaries, office expenses, rent or ICT equipment as of 30 September 2026, with Consent Manager registration due to start on 13 November 2026. - **DPDP provision**: [Section 18](https://dpdpr.in/act/section-18/), [Section 6(9)](https://dpdpr.in/act/section-6/), [Rule 4](https://dpdpr.in/rules/rule-4/) - **Source**: [The Economic Times: Clock's ticking for data protection, but the boardroom remains empty](https://economictimes.indiatimes.com/tech/technology/data-protection-board-of-india-struggles-to-function-before-november-13-deadline/articleshow/135214799.cms) 5. 27 Oct 2026 Court order ### Digital News Publishers Association (DNPA v. Union of India) The Supreme Court issued notice to the Centre on a petition by the Digital News Publishers Association challenging provisions of the DPDP Act and Rules for lacking an exemption for journalism. The bench declined an interim stay without hearing the government and listed the matter for 17 November 2026. - **DPDP provision**: [Section 7](https://dpdpr.in/act/section-7/), [Section 17(2)](https://dpdpr.in/act/section-17/), [Section 18](https://dpdpr.in/act/section-18/), [Section 19](https://dpdpr.in/act/section-19/), [Section 27](https://dpdpr.in/act/section-27/), [Section 29](https://dpdpr.in/act/section-29/), [Section 36](https://dpdpr.in/act/section-36/), [Section 37](https://dpdpr.in/act/section-37/), [Section 44(3)](https://dpdpr.in/act/section-44/), [Rule 16](https://dpdpr.in/rules/rule-16/), [Rule 17](https://dpdpr.in/rules/rule-17/), [Rule 23](https://dpdpr.in/rules/rule-23/) Provisions challenged in the petition. The Court has made no finding on their validity. - **Source**: [LiveLaw: 'Newsrooms Will Shutdown' : Digital Wings Of Legacy Media Move Supreme Court Challenging Personal Data Protection Law](https://www.livelaw.in/top-stories/newsrooms-will-shutdown-digital-wings-of-legacy-media-move-supreme-court-challenging-personal-data-protection-law-556103); [Bar and Bench: Ambani, Adani-linked media groups among petitioners challenging data protection law in Supreme Court](https://www.barandbench.com/news/litigation/ambani-adani-linked-media-groups-among-petitioners-challenging-data-protection-law-in-supreme-court) 6. 26 Oct 2026 Court order ### Google India (student's writ petition, Punjab and Haryana High Court) The Punjab and Haryana High Court issued notice to Google India and the Centre on a writ petition by a student locked out of his Google accounts since his phone was stolen, who alleges Google did not act on a Grievance Appellate Committee order to help him recover his data. The petition argues under the DPDP Act that loss of access is a personal data breach and that Google's two-year inactive account deletion policy conflicts with the Act and Rules; the matter is listed for 20 November 2026. - **DPDP provision**: [Section 2(u)](https://dpdpr.in/act/section-2/), [Section 8(5)](https://dpdpr.in/act/section-8/), [Section 8(7)](https://dpdpr.in/act/section-8/), [Section 8(8)](https://dpdpr.in/act/section-8/), [Section 27](https://dpdpr.in/act/section-27/), [Rule 6](https://dpdpr.in/rules/rule-6/), [Rule 8](https://dpdpr.in/rules/rule-8/) Provisions relied on in the petition. The Court has made no finding on them. - **Source**: [LiveLaw: Punjab & Haryana High Court Issues Notice To Google, Centre On Student's Plea For Recovery Of Locked Gmail Accounts](https://www.livelaw.in/high-court/punjab-and-haryana-high-court/punjab-haryana-high-court-issues-notice-to-google-centre-on-plea-to-enforce-grievance-appellate-committee-order-555958); [The Tribune: HC notice to Google India over student's inaccessible Gmail accounts](https://www.tribuneindia.com/news/news-legal/hc-notice-to-google-india-over-students-inaccessible-gmail-accounts/) 7. 21 Oct 2026 Reported ### State Bank of India SBI disclosed to the stock exchanges that personal details of 3,897 customers were identified among records found on the dark web, after alerts from the Defence Cyber Agency and CERT-In. SBI said it engaged a CERT-In empanelled agency to investigate the alleged compromise. - **DPDP provision**: [Section 8(5)](https://dpdpr.in/act/section-8/), [Section 8(6)](https://dpdpr.in/act/section-8/), [Rule 7](https://dpdpr.in/rules/rule-7/) Discussed by the source in relation to section 8(6) and rule 7, which come into force on 13 May 2027. - **Source**: [MediaNama: SBI confirms data of 3,897 customers exposed on dark web](https://www.medianama.com/2026/10/223-sbi-data-breach-3897-customers-dark-web/) 8. 10 Oct 2026 Court order ### Union of India and Digi Yatra Foundation (C.R. Neelakandan v. Union of India) In a PIL raising privacy concerns about Digi Yatra, the Kerala High Court recorded the Centre's submission that the Board had been constituted but was not functional, and said it expected the Board to be made functional within eight weeks. The PIL was disposed of. - **DPDP provision**: [Section 18](https://dpdpr.in/act/section-18/) - **Source**: [LiveLaw: 'Make Data Protection Board Functional In 8 Weeks': Kerala High Court In PIL Raising Privacy Concerns In 'Digi Yatra'](https://www.livelaw.in/high-court/kerala-high-court/kerala-high-court-digi-yatra-data-protection-board-553994) 9. 16 Jul 2026 Reported ### Reliance group (server hosted by a third-party provider) Reliance reportedly confirmed a partial breach of data on a server hosted by a third-party provider, according to Reuters as cited by MediaNama. MediaNama reported the leaked files included material related to the Kudankulam Nuclear Power Plant. CERT-In was reportedly looking into it. - **DPDP provision**: None stated The source notes that rule 7 breach reporting is not yet in force. - **Source**: [MediaNama: Kudankulam Nuclear Data Leaked On Dark Web: What We Found](https://www.medianama.com/2026/07/223-reliance-data-breach-kudankulam-files-dark-web/) 10. 04 Jun 2026 Reported ### Ultrahuman Wearable maker Ultrahuman said attackers gained read-only access to some users' contact details, transaction history and fitness-related data in an incident on 27 March 2026, and informed affected users on 2 June 2026. It said no passwords or payment data were affected. - **DPDP provision**: [Section 8(6)](https://dpdpr.in/act/section-8/), [Rule 7](https://dpdpr.in/rules/rule-7/) Discussed by the source in relation to rule 7, which comes into force on 13 May 2027. - **Source**: [MediaNama: Ultrahuman Data Breach Exposes Users' Wellness Data](https://www.medianama.com/2026/06/223-ultrahuman-suffers-security-breach-exposing-users-wellness-data/) 11. 25 Jul 2025 Sectoral regulator action ### Star Health and Allied Insurance IRDAI imposed a penalty of 3.39 crore rupees and issued a warning for violations of the IRDAI Information and Cyber Security Guidelines, 2023, according to the company's stock exchange intimation. The insurer had faced a cyber attack and customer data leak in 2024. This is a sectoral regulator action, not a DPDP Act penalty. - **DPDP provision**: None stated Imposed under IRDAI guidelines, not under the DPDP Act. - **Source**: [The Hindu: IRDAI imposes ₹3.39 cr penalty on Star Health Insurance](https://www.thehindu.com/business/irdai-imposes-339-cr-penalty-on-star-health-insurance/article69858449.ece) ## What the labels mean - Reported Reported in the media or disclosed by the entity. No official finding. - Complaint filed A complaint has been filed with an authority (for example police, CERT-In or a court). No finding. - Court order A court has passed an order or direction in a related matter. Not a Board order. - Sectoral regulator action A sectoral regulator other than the Board has acted under its own law. - Board order An order or direction of the Data Protection Board of India. - Board penalty A monetary penalty imposed by the Data Protection Board of India under section 33. ## Recent coverage DPDP and Indian data breach stories picked up automatically from [bharat.digital](https://bharat.digital/) on each rebuild. Headlines link to the original publishers. - [MeitY launches DEPA handbook to enable secure data sharing for AI training](https://bharat.digital/s/cb6482d1a9ca) BusinessLine, 31 Oct 2026 · DPDP - [Special newsletter: Unanswered questions, October edition](https://bharat.digital/s/b8e2b8eac7af) Medianama, 31 Oct 2026 · DPDP - [Fake Video Falsely Shows India's Defence Minister Criticizing Army](https://bharat.digital/s/0bc9a38f9e97) X News, 31 Oct 2026 · Data breach - [CoinSwitch Fixes Temporary Outage After Traffic Spike](https://bharat.digital/s/dad2e20f17fd) X News, 31 Oct 2026 · Data breach - [MeitY Floats New Privacy-Led Framework To Unlock Data For Training AI Models](https://bharat.digital/s/97a6fb797c7b) Inc42, 31 Oct 2026 · DPDP - [Data Protection Board to be in place ‘pretty soon’: Government Sources](https://bharat.digital/s/bf8f46210cc7) BusinessLine, 30 Oct 2026 · DPDP - [AU Small Finance Bank data breach: Hackers threaten to leak Aadhaar, PAN and customer records](https://bharat.digital/s/90db8456d567) Mint, 30 Oct 2026 · Data breach - [Rs. 300 Cr lost in AI cyberattacks on NBFCs: Why did the public learn about it from the media, not regulators?](https://bharat.digital/s/2701c586df54) Medianama, 30 Oct 2026 · Cyber incident - [In favour of press freedom: 10 changes that could be made in the DPDP Act](https://bharat.digital/s/6c307e55e1d0) Medianama, 29 Oct 2026 · DPDP - [AI-powered cyberattacks siphon ₹300 crore from small NBFCs in two months](https://bharat.digital/s/35e2668711a3) The Economic Times, 29 Oct 2026 · Cyber incident Data: [/data/enforcement.json](https://dpdpr.in/data/enforcement.json). New entries by RSS: [what changed](https://dpdpr.in/changes.xml). Tracker updated 2026-11-01.