SBI Data Breach: State Bank of India Customers Have No DPDP Act Remedy

State Bank of India (SBI), the country’s largest lender, has confirmed that personal details of 3,897 customers were found on the dark web. The SBI data breach, disclosed to the stock exchanges on 21 October 2026, is one of the most significant cyber incidents at an Indian public sector bank this year. It has also exposed a gap in the law. The Digital Personal Data Protection Act, 2023, which was meant to give Indians a legal right to be told when their data is compromised, does not yet apply to breaches. Its key provisions take effect only on 13 May 2027.

Also Read:  Inside the HDFC Bank Scandal That Triggered a Market Crash

For the customers caught up in the State Bank of India leak, that means there is no statutory requirement for the bank to inform them, no Data Protection Board to complain to, and no penalty under the data protection law that can be imposed on the bank.

What SBI Disclosed and When

According to SBI’s disclosure to the BSE and NSE under SEBI’s Listing Regulations, the bank received alerts on 16 October 2026 from its threat intelligence service provider, the Defence Cyber Agency and CERT-In, the government’s cyber emergency response team. The alerts concerned customer data that had surfaced on the dark web.

A preliminary review of approximately 375,000 records identified 3,897 customer records containing personally identifiable information. The exposed fields included names, registered mobile numbers, dates of birth, gender, email addresses, residential addresses, branch and customer identification (CIF) numbers, lead IDs and related metadata. SBI said the metadata was tied to loan or lead records.

SBI said it had activated its cyber incident response and containment protocols and engaged an independent CERT-In-empanelled cybersecurity agency to investigate “the nature and extent” of the exposure. The bank said “a detailed assessment is currently underway and appropriate remedial and preventive measures are being implemented as required.” It added that the incident had no material impact on its core operations, financial performance or business continuity.

On 23 October, SBI said in another update that it had individually informed customers whose data was identified as involved, by email and WhatsApp. It said customer balances and funds remained safe and urged customers not to share OTPs, PINs or passwords.

Also Read:  IDFC First Bank Fraud: Inside the ₹590 Crore Shock

The Five Days Before Disclosure

The timeline of the SBI data breach matters. The alerts arrived on 16 October. The same day, a cyber threat monitoring account on X reported that a threat actor calling itself “Siriusim” claimed to have released 375,000 rows of data and 2,722 PDF documents linked to SBI. The claimed dataset reportedly included loan applications, supporting documents and account opening forms. The bank’s exchange filing came on 21 October.

SBI’s filing does not mention the 2,722 documents. The bank has not said what they contain, whether they are genuine, or whether they include copies of identity documents such as Aadhaar, PAN or passports. The Internet Freedom Foundation (IFF), a digital rights group, has written to SBI’s Chairman, with copies to the RBI Governor and the Director General of CERT-In, asking the bank to disclose this and to confirm that affected customers will be protected under the RBI’s customer liability rules if they lose money.

Congress MP Pawan Khera also questioned the bank’s handling of the State Bank of India leak, noting that SBI “did not even detect the breach itself” and saying the bank “owes its customers answers”.

What the Data Protection Law Says

The Digital Personal Data Protection Act, 2023 was passed by Parliament in August 2023. Section 8(5) requires every data fiduciary, which includes banks, to take reasonable security safeguards to prevent a personal data breach. Section 8(6) requires a data fiduciary, in the event of a breach, to inform the Data Protection Board of India and each affected individual. Section 33, read with the Schedule to the Act, allows penalties of up to Rs 250 crore for failure to implement reasonable security safeguards.

On paper, these provisions describe exactly what customers affected by the SBI data breach would need. In practice, none of them is in force.

The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025. They bring the Act into effect in three phases. The first phase, which started on notification, covers definitions and the machinery for setting up the Data Protection Board. The second phase, starting on 13 November 2026, covers the registration of consent managers. The third phase, starting on 13 May 2027, 18 months after notification, covers the substantive obligations: notice to users, security safeguards, breach intimation, data retention, the rights of individuals and the duties of significant data fiduciaries.

Rule 7 of the DPDP Rules, which sets out how and when a breach must be reported, including the 72-hour window for a detailed report to the Board, falls in the third phase. So does the security safeguards rule. Until May 2027, no breach reporting duty under the DPDP Act applies to any company, including SBI.

Even after that date, it is unlikely the Act could be applied to an incident identified in October 2026. Indian law generally does not impose new penalties retrospectively. For the customers affected by the State Bank of India leak, the DPDP Act is therefore not a remedy at all.

Also Read:  Reserve Bank of India Bans Dark Patterns: A Confession Dressed as a Circular

The Rules That Apply Today

What applies instead are rules written for regulators, not for customers.

Under the directions issued by CERT-In on 28 April 2022 under Section 70B of the IT Act, covered organisations must report specified cyber incidents, including data breaches and data leaks, to CERT-In within six hours of noticing them or being informed of them. The RBI’s Cyber Security Framework in Banks, issued in 2016, and its 2023 Master Direction on IT Governance, Risk, Controls and Assurance Practices require banks to report incidents to the RBI within two to six hours and to maintain incident response capabilities.

In the SBI data breach, CERT-In was among the agencies that alerted the bank, so the regulator already knew. The question of whether SBI met its reporting timelines to the RBI is one only the RBI can answer. The RBI has not commented publicly on the incident.

None of these rules requires a bank to tell affected customers. IFF has pointed to an RBI advisory on customer data protection issued in March 2026, which it says recommends that banks notify affected customers through multiple channels. The advisory is not binding.

Customers who suffer loss have some other routes. Section 43A of the IT Act allows compensation where a company handling sensitive personal data fails to maintain reasonable security practices and causes wrongful loss. The Consumer Protection Act, 2019 allows a complaint where a failure to protect data amounts to a deficiency in service. Both require the customer to prove negligence, and a leak by itself does not establish it. The RBI’s framework on limiting customer liability in unauthorised electronic transactions covers losses from fraud, but not the exposure of personal data as such.

A Proposal That Has Not Moved

The government has acknowledged that 18 months is a long wait. On 17 November 2025, IT Minister Ashwini Vaishnaw said: ‘We are in discussions with the industry to further compress the timeline required for compliance.’ In January 2026, MeitY discussed with industry stakeholders a proposal to shorten the timeline for significant data fiduciaries, a category expected to include large banks, from 18 months to 12 months.

No amendment to that effect has been notified. Had the 12-month timeline been adopted, and had SBI been designated a significant data fiduciary, the breach notification and security safeguard provisions would have applied from 13 November 2026, roughly three weeks after SBI’s disclosure. The SBI data breach would still have fallen outside the law, but only just.

A Pattern Across Indian Banks

The State Bank of India leak is not an isolated event. In July 2026, Bank of Baroda disclosed a business email compromise after an employee’s email account was accessed without authorisation, and began a forensic investigation. In April 2024, a technical fault at ICICI Bank mapped about 17,000 newly issued credit cards to the wrong customers on its mobile app, exposing full card numbers and CVVs. In July 2024, a ransomware attack on C-Edge Technologies, a banking technology provider, disrupted payment services at nearly 300 cooperative and regional rural banks. In May 2025, the RBI fined ICICI Bank Rs 97.80 lakh for non-compliance with directions including those on cybersecurity.

In each case, the regulatory response, where there was one, came under banking supervision rules. In none of them did affected customers have a statutory right to be notified.

What Remains Unanswered

The SBI data breach leaves several questions open. The bank has not said how the data left its systems, or whether a vendor, a loan agent or an internal account was involved.

The presence of lead IDs and loan metadata in the exposed fields suggests the data may have come from the loan origination process rather than core banking systems, though SBI has not confirmed this. The bank has not said what the 2,722 documents claimed by the threat actor contain, or whether the remaining records in the 375,000-row dataset relate to its customers.

For now, the 3,897 customers of the State Bank of India leak must rely on the bank’s own assurances and on fraud reporting through the national cybercrime helpline, 1930, if they are targeted. The law that was written to protect them will arrive in May 2027, seven months too late.