If my personal data is breached, what remedies do I have under the IT Act and the proposed PDPB 2019 against the entity responsible for the breach?

Detailed Legal Analysis

If your personal data is breached in India, you have several remedies under the Information Technology Act, 2000 (IT Act) and the proposed Personal Data Protection Bill (PDPB) 2019. Under the IT Act, Section 43A is particularly relevant. It states that if an organization is found to have failed to implement reasonable security practices and procedures, resulting in a breach of sensitive personal data, the affected person can claim compensation for damages. It is essential to establish that the breach was a direct consequence of the organization's negligence in maintaining adequate security measures.

To pursue a remedy under the IT Act, you should first document the details of the breach, including the nature of the data compromised, how you discovered the breach, and any communication you had with the entity responsible. You can then file a complaint with the Adjudicating Officer under Section 46 of the IT Act. The procedure involves submitting your complaint in writing, stating the facts and the evidence of the breach, along with a request for compensation. The Adjudicating Officer will review your case and may order the entity to pay damages if negligence is established.

On the other hand, the proposed PDPB 2019 introduces more robust provisions for data protection. If enacted, it will provide enhanced rights and remedies for individuals whose data has been compromised. Under Section 77 of the PDPB, individuals can seek compensation for harm resulting from a violation of their data protection rights. This includes not just financial losses but also any reputational damage or emotional distress caused by the breach. Importantly, the Bill outlines the obligation of data fiduciaries to implement security measures and to notify individuals about any data breach promptly.

As practical advice, you should keep copies of all communications regarding the breach and any evidence of damages incurred. If the entity responsible for the breach does not resolve the issue satisfactorily, you can escalate it to the Data Protection Authority (DPA) under the proposed PDPB. The DPA can investigate the breach and impose penalties on the entity if it is found to be non-compliant with the law. Additionally, you may consider consulting with a cybersecurity expert or a legal professional to ensure that your rights are fully protected and that you receive appropriate remedies for the breach.