Your company could suffer a reportable personal data breach without anyone hacking its systems.
Under Section 2(u) of the Digital Personal Data Protection (DPDP) Act, a personal data breach includes unauthorised processing or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access that compromises the confidentiality, integrity or availability of personal data.
Examples:
- An employee emails customer records to the wrong recipient.
- A spreadsheet containing personal data is accidentally made public.
- An unauthorised employee accesses confidential customer information.
- A system failure destroys personal data or makes it inaccessible.
None necessarily involves a cyberattack.
The takeaway: Your breach response process must cover human errors, internal misuse and operational failures, not just hacking incidents.
This article is general information, not legal advice.