A company leaked my personal data in a breach, can I claim compensation?

An app or company I used had a data breach and my personal information including phone number and address is now circulating online. I would rather settle this without going to court if the law allows it, but I need to know my rights before I sign anything. Please tell me what to do first and what document to keep.

Under Indian law, Digital Personal Data Protection Act, 2023 – Section 8 is the starting point for this cyber law question. What follows is the position in substance, together with the steps that usually make the difference in practice.

Section 43A of the IT Act makes a body corporate liable to pay compensation if it fails to implement reasonable security practices while handling sensitive personal data and this causes wrongful loss to you.

Under the DPDP Act, 2023, data fiduciaries must implement 'reasonable security safeguards' (Section 8(5)) and report personal data breaches to the Data Protection Board and affected individuals without delay (Section 8(6)).

The Data Protection Board of India, once fully operational, can impose penalties up to Rs 250 crore on the company under Section 33 for failure to prevent a data breach, though this penalty goes to the government, not to you directly.

You retain the separate civil right to sue for compensation under Section 43A of the IT Act before the adjudicating officer (usually the state IT Secretary) if you can show quantifiable loss, without needing to file a full civil suit.

Also file a complaint at cybercrime.gov.in so that any onward misuse of your leaked data (like fraud calls) is tracked and linked to the original breach.

What this means for you: 1) Ask the company in writing for details of the breach and what data was exposed; 2) File a complaint with the Data Protection Board once your grievance to the company is unresolved; 3) Approach the adjudicating officer under Section 43A IT Act for compensation; 4) Monitor your accounts and report any resulting fraud separately at cybercrime.gov.in.

Where the facts are disputed, what usually decides a data breach compensation matter is the paper trail — dated complaints, acknowledgments and written replies under Digital Personal Data Protection Act, 2023 – Section 8. You can post the details on the MyVakeel forum for a practising advocate to review, or book a paid consultation with a Bar Council verified lawyer in cyber law.

Disclaimer: This information is for general awareness and does not constitute legal advice. Statutes and their interpretation change, and outcomes depend on the facts of your case. Please consult a qualified advocate before acting on it.