What are my rights if my personal data is leaked by a company?

Yes, with India's new data protection law, companies have clear obligations to protect your personal data, and you have enforceable rights when your data is mishandled or breached. Organisations that fail to safeguard data can face significant penalties.

Key points

• Companies handling your personal data must implement reasonable security safeguards.
• You have rights to access, correction, and grievance redressal regarding your data.
• Data breaches must be handled responsibly, and affected individuals informed as required.
• The Data Protection Board can impose substantial penalties for violations.
• Preserve evidence of the breach and any resulting harm.

Relevant law

The Digital Personal Data Protection Act, 2023 governs the processing of personal data and sets obligations for data fiduciaries, along with penalties for breaches. Interim protection also exists under the Information Technology Act, 2000 (Section 43A) and the reasonable security practices rules.

What you can do

• Raise a grievance with the company's Data Protection Officer or grievance channel.
• Preserve evidence of the breach and any misuse of your data.
• Escalate to the Data Protection Board or file a cyber crime complaint if harm results.
• Consult a cyber/data protection lawyer in Kolkata to assess your remedies.