A company in Bhavnagar leaked my personal data including Aadhaar and phone number in a breach. What is my remedy?

Detailed Legal Analysis

If a company in Bhavnagar has leaked your personal data, including Aadhaar and phone number, you have several remedies available under Indian law.

Firstly, under the Information Technology Act, 2000, and its associated rules, particularly the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, you can take the following steps:

• File a Complaint with the Company: Initiate a formal complaint with the company responsible for the data breach. They may have a grievance redressal system in place to address such issues.
• Report to the Data Protection Authority: If the company fails to address your complaint satisfactorily, you can report the incident to the Data Protection Authority of India (DPAI), which is established under the Personal Data Protection Bill (PDPB) 2019, which is set to regulate the processing of personal data.
• File a Police Complaint: You can file an FIR under Section 66E of the IT Act, which penalizes violations of privacy, or under Section 270 of the Indian Penal Code (IPC), which deals with the spreading of infection or disease. Consider including Sections 72 and 72A of the IT Act, which penalize breach of confidentiality and privacy.
• Seek Civil Remedies: You may also initiate civil proceedings against the company for damages under Section 43 of the IT Act, which provides for compensation for damage caused by failure to protect sensitive personal data.
• Contact Cyber Cell or Consumer Forum: You can approach the local Cyber Cell or the Consumer Forum to seek remedies for the violation of your rights. The Consumer Protection Act, 2019, allows you to file a complaint against unfair trade practices.

Additionally, it is advisable to:

• Monitor Your Accounts: Keep a close watch on your financial and social media accounts for any unauthorized activity.
• Consider Legal Counsel: Consult with a lawyer specializing in cyber law for personalized assistance and to understand your legal options better.

In summary, you have multiple avenues for recourse, which include internal complaints, legal actions, and consulting with authorities, all designed to protect your personal data and hold the negligent party accountable.