Is it mandatory to inform the victims of a data breach as per the guidelines issued under the Personal Data Protection Bill, 2021, and what are the consequences of non-compliance?

Detailed Legal Analysis

Yes, it is mandatory to inform the victims of a data breach as per the guidelines issued under the Personal Data Protection Bill, 2021 (PDP Bill).

The Personal Data Protection Bill, 2021 outlines specific responsibilities for data fiduciaries and establishes the framework for handling data breaches. Below are the key points regarding the obligation to notify victims of a data breach:

• Definition of Data Breach: A data breach is defined as an incident where unauthorized access to personal data occurs, leading to the loss, destruction, or alteration of such data.
• Notification Requirement: According to Section 18 of the PDP Bill, a data fiduciary must inform affected individuals about a data breach without undue delay. This obligation is crucial to ensure that victims can take necessary steps to protect themselves.
• Content of Notification: The notification must include:
  • Details of the nature of the breach.
  • Types of personal data affected.
  • Potential consequences of the breach.
  • Measures taken to address the breach.
  • Advice on how the affected individuals can protect themselves.
• Authority Notification: Additionally, the data fiduciary must also notify the Data Protection Authority (DPA) as per Section 25 of the PDP Bill, outlining the details of the breach.

Consequences of non-compliance with the notification requirement can be severe:

• Penalties: Under Section 29 of the PDP Bill, non-compliance with the provisions regarding data breaches may attract penalties of up to ₹5 crore or 2% of the total worldwide turnover of the preceding financial year, whichever is higher.
• Civil Liabilities: Affected individuals may seek compensation for damages caused by the data breach, as stipulated in Section 28.
• Reputational Damage: Non-compliance can lead to a loss of trust among consumers, affecting the data fiduciary's reputation and market standing.

In conclusion, the Personal Data Protection Bill, 2021 clearly mandates informing victims of data breaches, and failure to comply with these regulations can result in significant legal and financial repercussions for data fiduciaries.