The most comprehensive public database of Indian data privacy enforcement actions — covering DPDPA 2023, IT Act Section 43A, CERT-In directions, RBI data localisation enforcement, CCI data-related fines, and GDPR actions affecting Indian companies.
Statute, rules and Data Protection Board milestones — from MeitY, PIB, the eGazette, India Code and PRS.
| Date | Authority | Company / Entity & Summary | Violation | Penalty | Outcome | Provenance |
|---|---|---|---|---|---|---|
| 2026-07-03 | MeitY |
Tata Electronics
MeitY has launched a probe into a reported data breach at Tata Electronics that is linked to the Apple supply chain. The investigation focuses on potential violations of data...
|
Data breach | No financial penalty (Warning/Order) | Investigation Ongoing | ◐ Press reported |
| 2025-01-03 | MeitY |
Draft DPDP Rules
MeitY published the draft Digital Personal Data Protection Rules for public consultation, detailing consent, breach-notification and Board-operation mechanics.
|
Subordinate legislation | N/A (Rules) | Consultation | ◐ Press reported |
| 2023-08-11 | MeitY |
Statute — All Data Fiduciaries
The Digital Personal Data Protection Act, 2023 received Presidential assent, establishing India's first comprehensive data-protection statute with penalties up to ₹250 crore per breach.
|
Legislation enacted | Up to ₹250 Cr (framework) | Enacted | ◐ Press reported |
Penalties and orders from RBI, SEBI, IRDAI, CCI, TRAI, DoT, UIDAI and NPCI — the precedent landscape shaping Indian data-protection enforcement today.
| Date | Authority | Company / Entity & Summary | Violation | Penalty | Outcome | Provenance |
|---|---|---|---|---|---|---|
| 2026-08-29 | IRDAI |
Star Health & Allied Insurance
Star Health suffered a major data breach that triggered 13,000 complaints to the insurance ombudsman. The Insurance Regulatory and Development Authority of India (IRDAI)...
|
Data breach / non‑compliance with data security regulations | ₹3.39 Crore | Fine Imposed | ◐ Press reported |
| 2026-02-03 | Competition Commission of India |
WhatsApp, Meta Platforms
The Competition Commission of India imposed a joint penalty of ₹213 crore on WhatsApp and its parent Meta for anti‑competitive practices linked to its 2021 privacy policy. The...
|
Anti‑competitive abuse of dominance under Competition Act 2002 | ₹213 Crore | Fine Imposed | ◐ Press reported |
| 2024-11-18 | Competition Commission of India |
WhatsApp / Meta
The CCI imposed a ₹213.14 crore penalty on Meta over WhatsApp's 2021 privacy policy and ordered a 5-year bar on sharing user data with other Meta companies for advertising.
|
Data-sharing / abuse of dominance | ₹213.14 Cr | Fine Imposed | ◐ Press reported |
| 2024-08-01 | Reserve Bank of India |
Manappuram Finance Limited; Ola Financial Services Pvt. Ltd.; Visa Worldwide Pte. Limited
The RBI imposed monetary penalties on three payment system operators for violations of KYC and other regulatory guidelines under the Payment and Settlement Systems Act. Notices...
|
Non‑compliance with KYC and regulatory guidelines | ₹41.5 Lakh, ₹87.55 Lakh, ₹24.074 Lakh | Fine Imposed | ✓ Primary source |
| 2021-07-14 | Reserve Bank of India |
Mastercard
The RBI barred Mastercard from onboarding new domestic customers for failing to comply with the 2018 payment-data localisation directive. The ban was lifted in June 2022 after...
|
Data localisation non-compliance | Business restriction | Business Ban / Restriction | ◐ Press reported |
| 2021-04-23 | Reserve Bank of India |
American Express & Diners Club
The RBI stopped American Express and Diners Club from onboarding new customers over payment-data localisation non-compliance; the restriction on Amex was lifted in August 2022.
|
Data localisation non-compliance | Business restriction | Business Ban / Restriction | ◐ Press reported |
CERT-In directions and advisories (IT Act Section 70B, 6-hour reporting mandate) plus reported Indian data breaches.
| Date | Authority | Company / Entity & Summary | Violation | Penalty | Outcome | Provenance |
|---|---|---|---|---|---|---|
| 2024-09-20 | CERT-In / IRDAI |
Star Health & Allied Insurance
A reported breach exposed policyholder health and personal data of Star Health customers, prompting CERT-In and IRDAI scrutiny and litigation over the alleged leak.
|
Sensitive health-data breach | Investigation | Investigation Ongoing | ◐ Press reported |
| 2022-04-28 | CERT-In |
All body corporates & intermediaries
CERT-In issued directions requiring cyber-incident reporting within 6 hours and 180-day log retention, effective 28 June 2022 — India's first strictly enforced...
|
6-hour breach reporting mandate | Penalty / imprisonment (framework) | Enacted | ◐ Press reported |
Judgments and tribunal rulings from the Supreme Court, High Courts, TDSAT and IT Act Section 43A adjudications.
| Date | Authority | Company / Entity & Summary | Violation | Penalty | Outcome | Provenance |
|---|---|---|---|---|---|---|
| 2026-10-05 | High Court / Supreme Court |
Star Health
The Supreme Court declined to quash the ongoing data breach case against Star Health, allowing the matter to proceed. The decision underscores enforcement of data protection...
|
Data breach | No financial penalty (Warning/Order) | Adjudication Order Issued | ◐ Press reported |
| 2026-10-05 | High Court / Supreme Court |
Star Health and Allied Insurance Company
The Supreme Court declined to quash the criminal case against researcher Himanshu Pathak for allegedly accessing and downloading thousands of Star Health customers' personal,...
|
Unauthorized access and download of personal data | No financial penalty (Warning/Order) | Investigation Ongoing | ◐ Press reported |
| 2026-09-29 | High Court / Supreme Court |
UIDAI
The Karnataka High Court dismissed the NIA's petition to compel UIDAI to share Aadhaar authentication logs of a terror suspect, holding that Section 91 of the CrPC cannot...
|
Unauthorized request for Aadhaar authentication logs | No financial penalty (Warning/Order) | Adjudication Order Issued | ◐ Press reported |
| 2026-08-27 | High Court / Supreme Court |
PhysicsWallah
The Delhi High Court issued an order against PhysicsWallah for employing dark patterns that violate user privacy, mandating the removal of such practices. The court emphasized...
|
Dark patterns | No financial penalty (Order) | Adjudication Order Issued | ◐ Press reported |
| 2017-08-24 | High Court / Supreme Court |
K.S. Puttaswamy v Union of India
A nine-judge Supreme Court bench unanimously held privacy to be a fundamental right, laying the constitutional foundation for India's data-protection regime.
|
Right to privacy | Landmark judgment | Adjudication Order Issued | ◐ Press reported |
Major GDPR and global DPA enforcement actions affecting Indian IT/ITES companies or subsidiaries — benchmarks for DPDPA precedent.
| Date | Authority | Company / Entity & Summary | Violation | Penalty | Outcome | Provenance |
|---|---|---|---|---|---|---|
| No verified entries yet — new leads are pending review. | ||||||
KensaraAI's AI agents continuously scan your infrastructure, automate DSAR handling, manage consent records, and auto-start breach notification clocks.