Can I get compensation if a company's data breach exposed my personal information?

My personal data including phone number and address was leaked in a company data breach and I am now getting scam calls. I would rather settle this without going to court if the law allows it, but I need to know my rights before I sign anything. Please tell me what to do first and what document to keep.

Under Indian law, Digital Personal Data Protection Act, 2023 – Section 8 is the starting point for this cyber law question. What follows is the position in substance, together with the steps that usually make the difference in practice.

Section 8 of the DPDP Act obliges every data fiduciary to implement reasonable security safeguards and to notify the Data Protection Board and affected individuals in the event of a personal data breach.

Section 33 allows the Data Protection Board to levy penalties up to Rs 250 crore for failure to take reasonable security measures leading to a breach.

Under Section 43A of the IT Act, a body corporate handling sensitive personal data negligently, causing wrongful loss, is liable to pay damages by way of compensation to the affected person.

The DPDP Act itself does not create a direct individual compensation mechanism, so victims often combine a Section 43A civil claim with a Data Protection Board complaint for maximum leverage.

File a police complaint if the leaked data is being misused for fraud, since that triggers a parallel criminal investigation under the IT Act and Bharatiya Nyaya Sanhita.

In practice, in this order: 1) Ask the company for a formal breach notification and details of data compromised; 2) File a complaint with the Data Protection Board of India for the breach; 3) Send a legal notice claiming compensation under Section 43A of the IT Act; 4) Report ongoing scam calls/misuse to cybercrime.gov.in or 1930.

Timing matters here: Digital Personal Data Protection Act, 2023 – Section 8 works on limitation periods, so a data breach compensation claim that is right on the merits can still fail if it is brought late. You can post the details on the MyVakeel forum for a practising advocate to review, or book a paid consultation with a Bar Council verified lawyer in cyber law.

Disclaimer: This information is for general awareness and does not constitute legal advice. Statutes and their interpretation change, and outcomes depend on the facts of your case. Please consult a qualified advocate before acting on it.