What are the consequences of a data breach under the Personal Data Protection Bill, and how does it relate to the IT Act, 2000?

The consequences of a data breach under the Personal Data Protection Bill (PDP Bill), which has been introduced to regulate the processing of personal data in India, are significant. Although the bill is still in legislative process, it emphasizes the need for organizations to implement stringent data protection measures. Under Section 2(1)(21) of the PDP Bill, a data breach is defined as any unauthorized access to, or acquisition of, personal data. If a breach occurs, the Data Protection Authority (DPA), as described in Chapter VI of the Bill, has the authority to impose penalties. For serious breaches, the penalties can be as high as ₹15 crores or 4% of the annual global revenue of the entity, whichever is higher, as specified in Section 57 of the PDP Bill.

In conjunction with the PDP Bill, the Information Technology Act, 2000 (IT Act) also plays a critical role in addressing data breaches. Specifically, Section 43(b) of the IT Act stipulates that if a person accesses a computer resource without permission, they may be liable to pay damages. Additionally, the IT Act mandates the implementation of reasonable security practices and procedures under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Failure to adhere to these provisions can also lead to penalties, including compensation for affected individuals.

Practically, organizations facing a data breach must take immediate action to mitigate the impact. According to the PDP Bill, they are required to report the breach to the DPA within a stipulated time frame, which is likely to be defined in the final version of the bill. This emphasizes the importance of having a robust incident response plan in place. Organizations should conduct regular audits, maintain clear records of data processing activities, and train employees on data protection measures to reduce the likelihood of breaches.

In summary, the consequences of a data breach under the PDP Bill can result in significant financial penalties and legal liabilities, while the IT Act provides additional layers of protection and consequences for unauthorized access. Organizations must prioritize compliance with both laws by implementing effective data security measures, preparing for incident response, and ensuring they are ready to report breaches as required. This proactive approach not only mitigates penalties but also helps in maintaining consumer trust and safeguarding personal data.