Locked by Default: What the SBI Breach Teaches Us About Protecting People Data
Oct 26, 2026 · @Lalitha
Personal data should be locked by default and opened only when there is a clear purpose. Too often it is the other way round: data is easy to reach, and protection comes later.
This month, personal details of nearly 4,000 State Bank of India customers turned up on the dark web. The breach is a reminder that strong data protection depends on design, discipline and the law. India's law on breaches doesn't fully apply yet. For anyone who handles people data, the lesson is the same: employee and candidate data needs the same care as a bank account.
What happened at SBI, and why the law couldn't help
On 21 October 2026, SBI told the stock exchanges that details of 3,897 customers had been found on the dark web. The exposed data included names, phone numbers, dates of birth, email and home addresses, and customer IDs. SBI first got alerts on 16 October and contacted customers on 23 October. The attacker claims a much larger leak: 375,000 rows of data and 2,722 PDF documents. (The Probe)
India's Digital Personal Data Protection (DPDP) Act, 2023 is law, but it is being switched on in phases. The duties to notify affected people and the Data Protection Board of a breach start only on 13 May 2027. So are the large penalties for failing to protect data. Until then:
No duty to tell customers: organisations don't have to inform the people whose data leaked.
Regulator reporting only: CERT-In's six-hour rule and RBI's cyber-security norms require reporting to regulators, not to the people affected.
Slow remedies: people can claim compensation under the IT Act or the Consumer Protection Act, but they have to prove negligence.
The same gap covers employee data. If an employer's payroll or HR records leaked today, staff would have no DPDP remedy either.
How India compares
India's law is newer and simpler than most of its peers, and it relies heavily on consent. It also has no separate category for sensitive data. Japan, Brazil, Indonesia and the EU all give health, biometric and similar data extra protection. All four also have their breach-notification duties in force today.
Factor | India (DPDP) | Japan (APPI) | Brazil (LGPD) | Indonesia (PDP Law) | EU (GDPR) |
Fully in force | May 2027 (phased) | Yes, since 2005; updated 2022 | Yes, since 2020 | Yes, since Oct 2024 | Yes, since 2018 |
Legal grounds for processing | Mainly consent, plus limited "legitimate uses" | Purpose-based; consent for some uses | 10 legal bases | Several legal bases | 6 legal bases |
Sensitive-data category | None | Yes | Yes | Yes | Yes |
Breach notification | From 2027 | Mandatory since 2022 | Yes | Within 3 days | Within 72 hours |
Maximum penalty | ₹250 crore per breach | ¥100M for companies, plus criminal liability | 2% of Brazil revenue, capped at R$50M per violation | Up to 2% of annual revenue | 4% of global turnover |
Overseas transfers | Allowed unless blacklisted | Safeguards or approved countries | Approved countries or contract clauses | Approved countries or safeguards | Approved countries or safeguards |
For HR, the sensitive-data gap matters most. Under the DPDP Act, health records, biometric attendance data and diversity data get no more protection than an email address.
Reducing the risk now: don't wait for 2027
Organisations don't need the law in force to act like it is. Seven practical steps, ordered by impact on people data:
Map the data. List every system that holds employee and candidate data: HRMS, payroll, ATS, LMS, analytics tools and spreadsheets. You can't protect what you haven't found.
Collect less. Drop fields you don't need, such as full date of birth or home address in analytics datasets. Set retention periods for old data and actually delete or move to anothe location.
Least-privilege access. Give role-based access only. Review access every quarter, and remove it the day someone leaves or changes role.
Encrypt and mask. Encrypt data at rest and in transit. Use pseudonymised IDs in people-analytics work, so analysts never see names or phone numbers.
Tighten vendor contracts. Payroll, background-check and HR tech vendors should commit to security standards and audit rights. They should notify you of a breach within hours, not weeks.
Rehearse the response. Write a breach playbook covering who decides, who tells regulators, and who tells staff. Have notification templates ready. Run a tabletop exercise once a year.
Train people. Most leaks start with a phishing email, a shared password or a spreadsheet sent to the wrong person. Make HR and managers the first line of defence.
Once a breach happens, tell the affected people even though the law doesn't yet require it. That builds trust faster than anything else.
How the law could be strengthened
The DPDP Act is a good foundation. Five changes would close the gaps the SBI case exposed:
Bring breach notification forward. A proposal to shorten the transition for large data handlers from 18 to 12 months hasn't been formally adopted (The Probe). Notification to affected people could start now, even if penalties come later.
Add a sensitive-data category. Health, biometric, financial and caste data could carry stricter consent, security and retention rules, as in Japan, Brazil and the EU.
Give people compensation rights. Today, affected people can only complain. The law could let them claim damages directly, without proving negligence under older laws.
Set rules for AI and automated decisions. The law could give people a right to know about, and challenge, automated decisions in hiring, lending and performance. MeitY's AI regulation consultation paper, expected around now, is the natural place to start (MediaNama).
Where AI helps, and where it adds risk
AI can make data protection faster and cheaper. Used carelessly, it can also become the next leak.
Use | How AI helps | Example for HR data |
Finding data | Scans systems and files to find and tag personal data | Finds Aadhaar or PAN numbers sitting in shared drives |
Spotting unusual access | Flags behaviour that doesn't fit a user's normal pattern | Alerts when someone downloads thousands of payroll records at 2 a.m. |
Catching phishing | Filters suspicious emails and messages | Blocks fake "salary revision" emails sent to staff |
Safer analytics | Creates synthetic or anonymised datasets | Lets attrition models train without real employee names |
Faster response | Drafts breach assessments and notices | Produces staff notification drafts within hours |
Monitoring dark-web leaks | Watches leak sites for company data | Gives early warning, as SBI's 16 October alerts did |
The other side: every AI tool that touches employee data is another place data can leak. Before rolling one out, check:
where prompts and data are stored, and whether they're used to train the vendor's models
whether the tool keeps data in India, or under which transfer safeguards it moves abroad
who can see the outputs
whether a person reviews decisions about hiring, pay or exits
What leaders should do this quarter
The 2027 deadline is a minimum, not a target. In the next 90 days, people leaders can:
Map where employee and candidate data lives
Remove access that isn't needed, starting with payroll and analytics
Pseudonymise people-analytics datasets
Add breach-notification terms to HR vendor contracts
Write and rehearse a breach playbook that includes telling staff
Review every AI tool that touches people data
The organisations that keep data locked by default will earn the trust of employees, regulators and clients, and they won't have to rush when the law takes full effect.
Comments