What can I do if my personal data is found leaked on the dark web?

Question

I discovered that my Aadhaar number, phone number, and bank details are being sold on a dark web forum. What legal remedy do I have? What I am unsure about is the procedure — where the application goes, what it costs, and how long dark web data leak matters usually take. A plain explanation of the steps, in order, would help more than a general answer.

MyVakeel Legal Desk · Accepted Answer

The law that applies to dark web data leak here is Digital Personal Data Protection Act 2023, Section 8, Information Technology Act 2000, Section 43A, Information Technology Act 2000, Section 72A and CERT-In Directions 2022, Direction 3. The detail below matters, because Digital Personal Data Protection Act 2023, Section 8 draws the line differently depending on what your documents show.

The entity that originally collected your data, called the data fiduciary, is obliged under Section 8 of the Digital Personal Data Protection Act 2023 to implement reasonable security safeguards and prevent such leaks.

A body corporate that is negligent in maintaining reasonable security practices and thereby causes wrongful loss is liable to pay compensation under Section 43A of the Information Technology Act 2000.

A person who discloses personal information obtained under a lawful contract without consent, with intent to cause wrongful loss, is punishable under Section 72A of the Information Technology Act 2000.

Under Direction 3 of the CERT-In Directions 2022, the affected organisation must report the data breach to CERT-In within six hours of noticing it, and you can seek confirmation of this from them.

You should also be alert to identity theft using the leaked data, which is separately punishable under Section 66C of the Information Technology Act 2000.

Practical steps: 1) Change passwords and enable two-factor authentication on all linked accounts immediately; 2) Report the leak to cybercrime.gov.in and file a complaint against the entity that lost your data; 3) Send a written notice to the data fiduciary demanding details of the breach and remedial steps taken; 4) Monitor your credit report and bank statements for unauthorised activity.

If the other side has already issued a notice, filed a case or set a deadline, treat the matter as time-sensitive — remedies under Digital Personal Data Protection Act 2023, Section 8 carry limitation periods, and unexplained delay weakens an otherwise strong case. You can post the details on the MyVakeel forum for a practising advocate to review, or book a paid consultation with a Bar Council verified lawyer in cyber law.