For years India had no dedicated personal data protection law. That changed with the Digital Personal Data Protection Act, 2023 (DPDP Act), and in November 2025 the government notified the rules that bring it into force. Businesses now have until May 2027 to comply with its core obligations, including strict breach notification and security requirements backed by penalties of up to ₹250 crore.
Many breaches of Indian companies are first discovered not by the company itself, but when customer records appear for sale on a dark web forum or a Telegram channel. Under the DPDP regime, finding out late is no longer just embarrassing. It can make the difference between a well-managed response and a costly penalty. This guide explains the rules and where dark web monitoring fits.
This article explains how dark web monitoring can support DPDP compliance. It is not legal advice. Confirm your obligations with legal counsel.
What Is India's DPDP Act?
The DPDP Act governs how organisations collect, use and protect digital personal data of individuals in India. It applies to Indian businesses and to foreign companies that process personal data in connection with offering goods or services to people in India.
The Act uses its own terms:
- Data Principal: the individual the data is about.
- Data Fiduciary: the organisation that decides why and how data is processed. Most of the obligations fall here.
- Data Processor: a vendor that processes data on behalf of a Data Fiduciary.
- Significant Data Fiduciary: a larger or higher-risk organisation designated by the government, with extra duties such as audits and impact assessments.
- Data Protection Board of India: the regulator that investigates breaches and imposes penalties.
The DPDP Compliance Timeline
The Ministry of Electronics and Information Technology notified the DPDP Rules on 13 November 2025 and set a phased rollout:
Eighteen months sounds generous, but building the detection and response capability needed to meet a 72-hour reporting deadline takes time. Organisations that start in 2027 will be late.
Reasonable Security Safeguards
Section 8(5) of the Act requires every Data Fiduciary to protect personal data with reasonable security safeguards to prevent a breach, including data handled by its processors. The DPDP Rules set out the minimum expected, including:
- Encryption, masking or similar techniques to protect personal data.
- Access controls over the systems that hold it.
- Logging and monitoring that give visibility into access, so unauthorised use can be detected, investigated and fixed.
- Backups and measures to keep processing going after a compromise.
- Keeping relevant logs for at least one year for detection and investigation.
- Contracts that require processors to take appropriate safeguards too.
The emphasis on detection is important. A company that cannot tell when its data has been taken will struggle to show its safeguards were reasonable.
Breach Notification Under the DPDP Rules
The Act defines a personal data breach broadly: any unauthorised processing, accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access that compromises the confidentiality, integrity or availability of personal data. When one happens, the Data Fiduciary must:
- Notify the Data Protection Board without delay, describing the nature, extent, timing and location of the breach and its likely impact.
- Send a detailed report to the Board within 72 hours of becoming aware of the breach, covering the facts, likely causes, mitigation, any findings about who was responsible, steps to prevent a repeat, and the notices sent to affected people.
- Notify every affected Data Principal without delay, in clear and plain language, explaining what happened, the likely consequences, what the company has done, what the person can do to protect themselves, and who to contact.
Unlike some laws, there is no minimum size or risk threshold for notifying individuals. Every affected person must be told.
Don't forget CERT-In
Since 2022, CERT-In directions have required many organisations in India to report specified cyber incidents within six hours of noticing them. DPDP breach reporting sits alongside these existing obligations, so incident response plans need to cover both.
If you first learn about a breach because your customer data is being sold on a forum, the 72-hour clock starts then, and you will already be behind in understanding what was taken. Earlier detection gives you more time to investigate and report accurately.
Penalties
These are maximums. When deciding the amount, the Board considers factors such as the nature, gravity and duration of the breach and the steps taken to reduce its impact.
Why Indian Data Ends Up on the Dark Web
India has one of the world's largest online populations and a fast-growing digital economy, which makes Indian personal data valuable to criminals. In recent years, data said to belong to customers of major Indian insurers, consumer brands and online platforms has surfaced on dark web forums and Telegram channels, sometimes before the companies publicly acknowledged a problem.
The data usually gets there in a few ways:
- Ransomware and extortion, where stolen data is posted on leak sites if a company does not pay.
- Infostealer malware on employee or vendor devices, which captures logins to admin panels, CRMs and cloud storage.
- Misconfigured cloud storage and APIs found by attackers scanning the internet.
- Insiders and third parties who misuse or sell access to customer databases.
Where Dark Web Monitoring Fits
DarkThreat monitors stealer logs, criminal forums, Telegram channels and ransomware leak sites for your domains, brands, staff and suppliers, and alerts your team when exposure appears. See DarkThreat plans.
A DPDP Readiness Checklist
- Map your personal data: what you collect, where it is stored, and which vendors process it.
- Strengthen access controls and multi-factor authentication on every system holding personal data.
- Turn on logging and keep logs for at least a year.
- Set up external monitoring for leaked credentials and customer data on the dark web.
- Write a breach playbook covering the Board's initial intimation, the 72-hour report, CERT-In reporting and customer notices, with templates ready in advance.
- Update vendor contracts so processors must protect data and report incidents to you quickly.
- Run a tabletop exercise based on a realistic scenario, such as your customer database being offered for sale on a forum.
Key Takeaways
- India's DPDP Rules were notified on 13 November 2025, with most obligations applying from 12 May 2027.
- Data Fiduciaries must take reasonable security safeguards, including monitoring to detect unauthorised access.
- Breaches must be reported to the Board without delay, with a detailed report within 72 hours, and every affected person must be told.
- Penalties reach ₹250 crore for weak security and ₹200 crore for failing to notify.
- Dark web monitoring helps detect breaches earlier and gives evidence for accurate reporting.
Frequently Asked Questions
Does the DPDP Act apply to companies outside India?
Yes, if they process digital personal data in connection with offering goods or services to individuals in India.
Does the DPDP Act require dark web monitoring?
No law names a specific tool. The rules do require reasonable safeguards, including visibility and monitoring to detect unauthorised access, and fast breach reporting. Dark web monitoring is one practical way to detect when personal data has already left your systems.
When do we have to report a breach?
The Board must be informed without delay once you become aware of a breach, with a detailed report within 72 hours. Affected individuals must also be informed without delay.
Is there a minimum number of affected people before we must report?
No. The DPDP Rules require notifying the Board and every affected Data Principal regardless of the size of the breach.
How does DPDP relate to CERT-In reporting?
They are separate obligations. CERT-In directions require many organisations to report specified cyber incidents within six hours, while the DPDP Rules cover personal data breaches. One incident may trigger both.
Related Resources
- Detecting Customer PII Leaks Before Regulatory Notification Is Required
- GDPR Breach Notification and Dark Web Monitoring: A Compliance Guide
- How to Tell Your Customers About a Data Breach: Legal and PR Guide
- What to Do in the First 48 Hours of a Data Breach
- DORA and Dark Web Monitoring: Requirements for EU Financial Firms
