If my personal data is breached, what recourse do I have under the Personal Data Protection Bill, 2019, and what is the timeframe for filing a complaint?

Detailed Legal Analysis

If your personal data is breached in India, you have several recourses under the Personal Data Protection Bill, 2019 (PDP Bill), which aims to protect individuals' personal data and provides mechanisms for redressal in case of data breaches.

Under the PDP Bill, you can take the following steps:

• Report the Breach: You should immediately report the data breach to the data fiduciary (the entity that determines the purpose and means of processing personal data) responsible for your data. Timely reporting is crucial for mitigating damage.
• File a Complaint: If the response from the data fiduciary is unsatisfactory or if they fail to take appropriate action, you can file a complaint with the Data Protection Authority (DPA) established under the PDP Bill. The DPA is responsible for ensuring compliance with the provisions of the Bill.
• Compensation Claims: Under Section 64 of the PDP Bill, you may be entitled to seek compensation for damages caused by the breach. The amount of compensation will be determined based on the severity and impact of the breach on your rights.
• Seek Injunctions: If necessary, you can also approach the courts for an injunction against the data fiduciary to prevent further processing of your data or to halt the breach.

Regarding the timeframe for filing a complaint:

• According to the PDP Bill, you must file a complaint with the DPA within three years from the date you become aware of the breach or the date on which you should reasonably have become aware of it.
• The DPA is required to respond to your complaint and initiate an inquiry into the matter within a specified timeframe, generally within 30 days of receiving the complaint.

It is also important to note that the PDP Bill emphasizes the need for data fiduciaries to notify individuals of any significant data breaches. This notification should include details about the nature of the breach, the data involved, and the measures you can take to protect yourself.

In summary, the PDP Bill provides a structured approach to address data breaches, enabling individuals to report incidents, seek compensation, and ensure accountability from data fiduciaries.