Featured image courtesy of Internet Freedom Foundation.

The Internet Freedom Foundation (IFF), an advocacy group, on October 24, 2026, urged the Reserve Bank of India (RBI) to direct all regulated entities to notify customers of personal data breaches within a fixed period. This call came just days after State Bank of India (SBI) admitted to the exposure of its customer data on the Dark Web, an incident first reported on October 21. The IFF’s consistent demands show financial institutions and other data fiduciaries face growing pressure to be transparent about security incidents. This comes even as the Digital Personal Data Protection (DPDP) Act awaits full commencement.

IFF engaged with the SBI data breach immediately after its public disclosure. On October 21, the same day SBI confirmed the exposure of customer records, the IFF specifically asked SBI to alert impacted customers. The group cited a critical risk. “Impacted customers are the most likely to receive calls from persons posing as SBI officials who can recite their account details back to them,” The Hindu reported that day. This first request aimed for direct bank action to cut immediate fraud risks for customers.

By October 24, the IFF broadened its focus. It shifted from a specific request to SBI to a systemic demand directed at the RBI. The foundation argued that the central bank should mandate timely breach notifications for all entities it regulates. This escalation, as reported by The Hindu, aims to establish a universal standard for transparency across the financial sector. It avoids addressing individual incidents case by case.

Implications for Indian Startups and Tech Companies

The IFF’s advocacy, particularly its call for an RBI directive, directly affects Indian startups and tech companies. This is especially true for those in fintech or handling sensitive customer data. Even without the full operationalization of the DPDP Act, which will introduce formal breach notification timelines, privacy advocates already demand immediate, transparent communication.

Startups cannot wait for explicit legal mandates to be fully enforced. The IFF’s stance shows a strong public expectation for proactive disclosure and customer protection. Companies must respond.

  • Companies need strong incident response plans. These frameworks must be well-tested and prioritize rapid detection, containment, and transparent communication with affected users. This includes clear internal protocols for identifying exposed information and guiding customers on next steps.
  • Develop pre-approved communication templates and channels for breach notifications. This saves critical time during an actual incident. The IFF’s concern about fraudsters means companies must anticipate how exposed data might be misused. They need to guide customers on protective measures.
  • The DPDP Act’s notification specifics are pending, but its core principles include accountability and user rights. Startups should align internal policies with these principles now, not wait for enforcement. The RBI, influenced by IFF’s advocacy, could introduce its own sector-specific guidelines. These might become mandatory for regulated entities.

The SBI breach showed the tangible risks of data exposure, from potential financial fraud to reputational damage. The IFF quickly moved from addressing a specific bank to advocating for broader regulatory change with the RBI. This shows a strategic push for systemic improvements in data protection compliance. For any Indian business handling personal data, the expectation for data breach transparency and customer notification is rising, regardless of the DPDP Act’s final implementation timeline.

What was the Internet Freedom Foundation’s primary demand regarding the SBI data breach?

The Internet Freedom Foundation’s primary demand was that SBI alert its impacted customers directly about the data exposure, warning them of potential fraud from persons posing as bank officials.

What regulatory body did the Internet Freedom Foundation call upon for broader action?

The Internet Freedom Foundation called upon the Reserve Bank of India (RBI) to direct all regulated entities to notify customers of personal data breaches within a fixed period, pending the commencement of the DPDP Act.

Compiled by Launch91 Desk from the sources linked above. More about Launch91.