India’s Digital Personal Data Protection (DPDP) framework needs clearer benchmarks for assessing negligence in data breaches, with legal experts flagging gaps in security standards, vulnerability management and incident reporting as organisations grapple with increasingly sophisticated cyber threats.
The concerns assume significance amid vulnerabilities such as the recently reported PHP flaw that attackers reportedly exploited before organisations could deploy patches, raising questions about the extent to which businesses can be held liable for breaches despite maintaining reasonable security measures. The DPDP Act provides for penalties of up to Rs 250 crore for failure to take reasonable security safeguards to prevent personal data breaches. However, the legislation and accompanying rules do not expressly explain how regulators should distinguish between an organisation that has suffered an unavoidable attack and one that has failed to maintain adequate security controls. “The DPDPA is not a strict-liability law. The penalty attaches to inadequate safeguards, not to the breach itself,” said Suvarna Mandal, partner at Saikrishna & Associates.Fiduciaries must implement appropriate technical and organisational measures and reasonable security safeguards, with the Data Protection Board likely to assess these against the nature and scale of data processing, Mandal said. “So a fiduciary hit by a zero-day despite a sound security posture will likely be treated differently from one running unpatched or end-of-life systems,” she added.Section 8(5) of the DPDP Act requires data fiduciaries to take reasonable security safeguards to prevent personal data breaches. Rule 6 of the DPDP Rules specifies minimum safeguards, including encryption, access controls, monitoring, logs and backups. However, the framework does not prescribe detailed benchmarks for patching timelines, vulnerability assessments or circumstances in which a security vulnerability cannot be addressed immediately. This leaves questions about how organisations can demonstrate compliance when attackers exploit vulnerabilities before fixes become available. The Act also does not expressly provide an exemption from liability for unavoidable attacks. Under Section 33, the Board can impose penalties following an inquiry and a finding of a breach of the Act or Rules, after giving the organisation an opportunity to be heard. The timeliness and effectiveness of mitigation are among the factors relevant to determining the penalty. Need for recognised security standardsExperts said compliance with recognised cybersecurity standards, independent audits and documented vulnerability management practices should be considered when determining whether an organisation has taken reasonable safeguards. Mandal pointed to a change from the earlier regulatory framework governing sensitive personal data.”Today’s SPDI Rules treat ISO 27001 certification as deemed compliance; the DPDP Act drops that safe harbour. A single uniform standard across sectors may be impractical,” she said.A better approach would be for the Ministry of Electronics and Information Technology (MeitY) to amend the rules so that compliance with sector-specific frameworks, including the Reserve Bank of India’s IT governance directions and the Securities and Exchange Board of India’s Cybersecurity and Cyber Resilience Framework, counts as evidence of reasonable safeguards, Mandal said. She also said compliance with recognised standards, demonstrated through independent certification and audits, documented policies that are actually followed, patching and vulnerability management, and adherence to CERT-In advisories and its April 2022 directions should help establish that reasonable safeguards were in place.The distinction is particularly relevant as organisations increasingly rely on interconnected technology systems and third-party service providers, potentially exposing personal data to vulnerabilities beyond the immediate control of a single entity.DPDP breach reporting stricter than GDPRIndia’s breach notification requirements are another area requiring attention, particularly when compared with the European Union’s General Data Protection Regulation (GDPR).Under Rule 7 of the DPDP Rules, data fiduciaries must intimate the Data Protection Board and affected individuals of personal data breaches. The framework does not prescribe an equivalent risk threshold for deciding whether a breach must be reported.The GDPR adopts a more calibrated approach. Article 33 generally requires controllers to notify the supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals’ rights and freedoms. Article 34 requires communication to affected individuals when a breach is likely to result in a high risk, subject to specified exceptions.”The GDPR is more calibrated. Breaches unlikely to cause risk need not be reported to the regulator. Individuals are notified only of high-risk breaches, and not where the data was encrypted,” Mandal said.A risk-based threshold in India could reduce notification fatigue and allow regulators to focus on incidents requiring greater scrutiny, she said.Mandal also called for a unified reporting window with common triggers across the DPDP framework, CERT-In requirements, sectoral regulations and stock exchange disclosures, supported by guidance on incident mitigation.The GDPR also contains specific provisions addressing processor obligations and security accountability.Article 33(2) requires data processors to notify controllers of personal data breaches without undue delay. The DPDP framework does not contain an equivalent direct statutory notification obligation on data processors, leaving data fiduciaries to rely on their responsibilities under Section 8 and contractual arrangements.Article 32(1)(d) of the GDPR requires regular testing, assessment and evaluation of the effectiveness of technical and organisational security measures. While Rule 6 of the DPDP Rules prescribes safeguards and requires monitoring and review, it does not expressly impose an equivalent general testing requirement.Article 83(2)(b) of the GDPR also expressly identifies whether an infringement was intentional or negligent as a factor in determining administrative fines. Section 33 of the DPDP Act lists factors relevant to penalties but does not expressly identify intention or negligence.These differences could assume significance when regulators assess the culpability of organisations affected by cyber incidents, particularly where vulnerabilities are exploited despite documented security controls.AI law should not duplicate cyber security obligationsThe debate over cybersecurity obligations also comes as India considers a separate legal framework for artificial intelligence, raising questions about how the proposed legislation would interact with existing data protection and incident reporting requirements.Arun Prabhu, partner and co-head, Digital +, TMT, at Cyril Amarchand Mangaldas, said the proposed AI framework should focus on risks specific to the technology rather than establish a parallel regime for data protection and incident reporting.”The AI law will likely regulate AI-specific matters such as risk classification, risk evaluation and mitigation, transparency, agentic autonomy and synthetic content. Drafted well, it should not create a parallel regime for data protection or incident reporting,” Prabhu said.He said AI could influence both cyberattacks and defensive capabilities, including by reducing the time between the discovery of a vulnerability and its exploitation.”As the recent PHP flaws illustrate, AI plays a role in both cyber attack and defence, including by shrinking the window between discovery and exploitation of a vulnerability. That is a reason to strengthen existing security standards to address AI-driven threats, not to duplicate them in the AI law,” he said.Incident response and security obligations should remain with CERT-In and the DPDP Act, with the AI law cross-referencing existing requirements, Prabhu added.India could also draw lessons from the EU AI Act, which preserves the application of the GDPR while providing for the integration or cross-referencing of certain assessments. A similar approach could help organisations avoid duplicative compliance exercises while ensuring that AI-specific risks, including discriminatory outcomes and inadequate human oversight, receive appropriate attention.For businesses, the challenge is to establish a coherent compliance framework that accounts for the speed at which cyber threats evolve without treating every successful attack as evidence of inadequate security.Clearer standards for vulnerability management, greater clarity on how security controls will be evaluated and better coordination among regulators could help organisations demonstrate due diligence while ensuring that penalties remain proportionate to the nature and severity of violations.
