Identity Theft and Data Breach Laws in India: A Complete Guide

Updated: July 15, 2026Published: July 14, 2026

Quick Answer

Identity theft is a criminal offence punishable by up to three years in prison under the IT Act, while corporate data breaches attract massive financial penalties under the DPDPA 2023. Victims can pursue criminal prosecution against hackers and hold negligent companies accountable for failing to protect personal data.

Table of Contents

Key Takeaways

  • Identity theft is punishable by up to three years of imprisonment under Section 66C of the IT Act.
  • Cheating through digital means or impersonation is strictly covered under Section 318 of the newly enacted BNS.
  • The DPDPA 2023 imposes penalties up to ₹250 crore on companies that fail to prevent personal data breaches.
  • Companies are legally mandated to notify both the Data Protection Board and affected users if a data breach occurs.

Introduction

As our reliance on digital platforms grows, the risks of identity theft and corporate data breaches have skyrocketed. Cybercriminals routinely steal personal information to commit financial fraud, while companies holding vast amounts of consumer data frequently fall victim to targeted hacks. In India, the legal framework tackles this dual threat by prosecuting the individual hackers under criminal laws and holding the negligent companies financially accountable under robust new data protection regulations.

Addressing identity theft and data breaches requires a two-pronged approach: prosecuting the offender and holding the data custodian liable.

1. Criminal Remedies (Punishing the Hacker)

If someone steals your digital identity to commit fraud or impersonate you, strict criminal provisions apply:

  • Information Technology (IT) Act, 2000: Section 66C explicitly penalizes identity theft, defined as the fraudulent or dishonest use of another person's electronic signature, password, or unique identification feature, with imprisonment up to three years. Furthermore, Section 66D punishes cheating by personation using a computer resource.
  • Bharatiya Nyaya Sanhita (BNS), 2023: Section 318 explicitly covers cheating through electronic and digital means. It modernizes traditional fraud laws to encompass impersonation using digital identity and unauthorized electronic fund transfers.
  • Bharatiya Sakshya Adhiniyam (BSA), 2023: To convict a cybercriminal, the digital evidence (such as fake social media profiles, IP logs, or unauthorized login attempts) must be legally certified and presented in court strictly under the guidelines of the BSA.

2. Civil Remedies (Holding Companies Accountable)

When a corporation's weak security leads to a data breach, victims now have powerful statutory backing to ensure the company faces severe consequences:

  • Digital Personal Data Protection Act (DPDPA), 2023: This Act places massive responsibilities on "Data Fiduciaries" (companies that collect and process your personal data).
  • Massive Financial Penalties: If a company fails to take reasonable security safeguards to prevent a personal data breach, the Data Protection Board can impose staggering penalties extending up to ₹250 crore.
  • Mandatory Notification: Companies are legally mandated to notify both the Data Protection Board and the affected users (Data Principals) in the event of a personal data breach. Failure to do so can result in additional penalties extending up to ₹200 crore.

Time Limits

  • The "Golden Hour": If identity theft results in unauthorized bank withdrawals, immediately calling the 1930 National Cyber Crime Helpline within the first 2 to 24 hours drastically increases the chances of freezing the stolen funds.
  • RBI 3-Day Rule: For financial fraud resulting from compromised banking credentials, you must notify your bank within 3 working days to qualify for "Zero Liability" protection under RBI guidelines.

Practical Tips

  • Preserve Digital Evidence: Securely save unauthorized login alerts, bank SMS notifications, UPI reference IDs, email headers, and screenshots of fake profiles impersonating you.
  • Where to File Complaints:
    • Report financial fraud immediately to the 1930 helpline.
    • File a detailed complaint regarding identity theft or data breaches on the National Cyber Crime Reporting Portal (cybercrime.gov.in).
    • Visit your local Cyber Crime Police Station to file a physical FIR.
  • Escalation Remedies: If a bank holds you liable for a fraudulent transaction despite timely reporting, escalate to the RBI Banking Ombudsman. For corporate data breaches, grievances can be directed to the Data Protection Board (as it becomes fully operational).

When Should You Consult a Cyber Lawyer?

  • When Your Identity is Weaponized: If cybercriminals use your stolen identity to scam others or commit illegal acts, you need a lawyer immediately to secure anticipatory bail and file a preemptive FIR to protect yourself from false arrests.
  • Seeking Compensation for Breaches: If a corporate data breach results in severe financial or reputational loss, a lawyer can help you navigate consumer courts or the Data Protection Board framework to seek damages.
  • Platform Takedown Requests: If social media platforms refuse to take down fake profiles impersonating you, a legal expert can issue formal notices threatening legal action under the IT Act.

Conclusion

Identity theft and data breaches are no longer just technical inconveniences; they are severe legal violations. While the IT Act and BNS ensure that hackers face criminal prosecution, the DPDPA 2023 serves as a massive deterrent for corporate negligence. By reporting breaches swiftly, preserving electronic evidence, and utilizing the correct legal channels, individuals can reclaim their digital identity and hold responsible parties accountable.

Frequently Asked Questions

Q: What is the punishment for identity theft under Indian law?

A: Under Section 66C of the Information Technology (IT) Act, identity theft is punishable by imprisonment for a term which may extend to three years and a fine of up to rupees one lakh.

Q: Can a company be fined if my personal data is leaked?

A: Yes. Under the Digital Personal Data Protection Act (DPDPA), 2023, companies that fail to implement reasonable security safeguards to prevent personal data breaches can face massive penalties extending up to ₹250 crore.

Q: What should I do immediately if my digital identity is stolen to withdraw money?

A: You should call the 1930 National Cyber Crime Helpline within the 'golden hour' (first 2-24 hours) to freeze the funds, report the unauthorized transaction to your bank within 3 days to limit your liability, and file a formal complaint on cybercrime.gov.in.

Need personalized legal help?

Find advocates on JurisOS and send an enquiry.

Find Cyber Law Lawyers