India Privacy Act Understand. Assess. Protect.
When something goes wrong

How to report a data breach or data misuse.

Who to contact, in what order, and what to say. Written for individuals first, with a section for organisations.

← Back home

Last reviewed: 26 October 2026. Procedures and timelines change, so confirm on the official sites linked below.

Where the law stands (October 2026). The DPDP Rules were notified on 13 November 2025 and the Data Protection Board of India has been set up. Most duties on organisations, including breach notification and the process for complaining to the Board, start about 13 May 2027. Until then, the routes below still apply: the company's own grievance process, the cyber police, CERT-In, your sector regulator, and the IT Act.

Find your situation

A company leaked or misused my data

Write to the company first, then escalate. Includes a message you can copy.

I lost money or an account was taken over

Act within hours. Call 1930 and your bank.

My organisation had a breach

CERT-In within 6 hours, and the DPDP notifications from 2027.

I keep getting spam calls or SMS

Use the TRAI DND app and 1909.

Who to contact

SituationContactNotes
Money lost to online fraud National Cyber Crime Helpline 1930, then cybercrime.gov.in The helpline runs 24 hours. The sooner you report, the better the chance of freezing the transfer. Tell your bank as well.
Hacking, identity theft, online harassment National Cyber Crime Reporting Portal, cybercrime.gov.in Register the complaint online and keep the acknowledgement number.
A company misused or leaked your data The company's grievance contact Look in its privacy policy. Write to them first, then escalate.
Suspicious calls, SMS or WhatsApp messages Chakshu on Sanchar Saathi, sancharsaathi.gov.in/sfc Report suspected fraud communication.
Lost or stolen phone Sanchar Saathi portal Block the phone so it cannot be used.
A cyber incident at an organisation CERT-In: [email protected], toll free 1800-11-4949 Report within 6 hours of noticing the incident.
Bank, insurer or broker mishandled data The sector regulator's complaint portal RBI for banks and NBFCs, IRDAI for insurers, SEBI for brokers and mutual funds.

A company leaked or misused your data

  1. Collect your evidenceScreenshots, the message or email you received, the date and time, the company and website name, and any account or order number. Do not delete anything.
  2. Write to the companyFind the grievance officer or data protection contact in the company's privacy policy and send your complaint there. Say what happened, what you want done, and by when. Keep a copy and note any reference number. A message you can copy is below.
  3. Give a reasonable deadlineAsk for a reply within 30 days. Once the DPDP complaint rules start, around 13 May 2027, the Rules set an outer limit of 90 days for a company to respond to a grievance.
  4. Escalate to the Data Protection BoardIf you get no reply or an unsatisfactory one, you will be able to complain to the Board, which works as a digital office. The Act requires you to use the company's grievance process first. The Board's official complaint link will be announced by the government, and we will add it here once it is live. Until then, check the official website of the Ministry of Electronics and IT (meity.gov.in).
  5. Use other routes in the meantimeSector regulators (RBI, IRDAI, SEBI) take complaints about the entities they supervise. The National Consumer Helpline, 1915, can guide you on disputes with businesses. If a crime is involved, file at cybercrime.gov.in. Under the IT Act, a company that was careless with sensitive data may owe compensation, claimed before the state's Adjudicating Officer. Speak to a lawyer about that route.

A message you can copy

Subject: Privacy complaint: request for action on my personal data Dear Grievance Officer, I am writing about my personal data held by [company name]. What happened: [Describe it briefly, for example: I received sales calls on 12/10/2026 from a company I never shared my number with, and I believe it came from you.] Details you hold for me: [mobile number / email / customer ID] I request that you: 1. Tell me what personal data of mine you hold and why. 2. Tell me whether you have shared it, and with whom. 3. Stop using it for [purpose]. 4. Correct or delete it where you no longer need it. 5. Confirm in writing what you have done. Please reply within 30 days and share a complaint reference number. If I do not receive a satisfactory reply, I will escalate the matter to the relevant authority. Regards, [Your name] [Your contact details]

Money lost or an account taken over

  1. Call your bank or wallet providerAsk them to block the card, UPI, net banking or wallet right away.
  2. Call 1930This is the National Cyber Crime Helpline, open 24 hours. Fast reporting helps investigators trace and freeze the money before it moves on.
  3. File onlineRegister the complaint at cybercrime.gov.in and keep the acknowledgement number.
  4. Secure your accountsFrom a device you trust, change your passwords, turn on two-step verification, log out of all other sessions, and check for email forwarding rules you did not set up.
  5. Check your mobile connectionsOn the Sanchar Saathi portal you can check the connections registered in your name and report numbers you do not recognise. You can also block a lost phone there.

Your organisation had a breach

  1. Contain it and keep the evidenceIsolate affected systems, preserve logs, and do not wipe anything. Write down what you know and when you learned it.
  2. Report to CERT-In within 6 hoursCERT-In's directions require cyber incidents, including data breaches, to be reported within six hours of noticing them. Email [email protected] or call the toll-free number 1800-11-4949.
  3. Prepare the DPDP notificationsFrom about 13 May 2027, Rule 7 requires you to tell the Data Protection Board without delay, send a detailed report within 72 hours (the Board can allow longer on a written request), and tell each affected person without delay. The Act sets no size threshold, so even small breaches count. Failing to notify can carry a penalty of up to ₹200 crore.
  4. Tell your sector regulator and the police if neededBanks, insurers and securities firms have their own reporting rules. If a crime was committed, file at cybercrime.gov.in.
  5. Fix the cause and reviewClose the gap, test it, and update your response plan. See Data Breaches, Business Obligations and the Compliance Checklist.
This page is general guidance, not legal advice. India Privacy Act is an independent site and cannot receive breach reports or complaints. Please use the official channels above.