Resources · Case Studies

Learn from what went wrong elsewhere.

Publicly reported breaches and regulatory decisions from India and around the world, and what each one means for your DPDP programme.

These are public cases summarised from official or published sources. They are not Primitra client engagements, and we have no affiliation with the organisations named.

Case 01 · 2022

AIIMS Delhi ransomware attack

Healthcare · India

What happened

In November 2022 a ransomware attack hit servers at the All India Institute of Medical Sciences, New Delhi. Hospital services ran manually for days while systems were restored, and the incident was discussed in Parliament.

The lesson

Availability is part of data protection. Offline backups, network segmentation and a tested recovery plan decide how long patients suffer.

Under the DPDP Act

Section 8(5) requires reasonable security safeguards; failing them can attract a penalty of up to ₹250 crore.

Source: PIB / Rajya Sabha reply

Case 02 · 2021

Air India passenger data breach (SITA)

Aviation · India

What happened

Air India disclosed that a cyberattack on its passenger service system provider, SITA, exposed personal data of about 4.5 million passengers, including names, dates of birth, contact and passport details, collected over roughly ten years.

The lesson

Your vendor's breach is your breach in the customer's eyes. Long retention made the impact far larger.

Under the DPDP Act

A Data Fiduciary stays responsible for data handled by its processors (Section 8(1)) and must delete data once the purpose is served (Section 8(7)).

Source: Air India statement (via news reports)

Case 03 · 2023

Meta fined €1.2 billion for EU–US data transfers

Social media · Ireland / EU

What happened

Ireland's Data Protection Commission fined Meta €1.2 billion and ordered it to stop transferring Facebook users' data to the US under standard contractual clauses without adequate safeguards — the largest GDPR fine so far.

The lesson

Cross-border transfers need a documented legal basis and real safeguards, not just template contracts.

Under the DPDP Act

Section 16 lets the Government restrict transfers to notified countries, and sector rules (such as RBI payment data storage) may require local storage.

Source: Irish DPC announcement

Case 04 · 2023

TikTok fined €345 million over children's data

Social media · Ireland / EU

What happened

The Irish DPC found that TikTok set children's accounts to public by default and used design choices that nudged young users towards less private options, and fined it €345 million.

The lesson

Privacy-by-default and fair design matter most where children are involved.

Under the DPDP Act

Section 9 requires verifiable parental consent and bans tracking, behavioural monitoring and targeted ads for children; breaches can attract up to ₹200 crore.

Source: Irish DPC decision

Case 05 · 2021

Amazon fined €746 million over ad targeting consent

E-commerce · Luxembourg / EU

What happened

Luxembourg's data protection authority (CNPD) fined Amazon €746 million for processing personal data for targeted advertising without valid consent. Amazon has challenged the decision.

The lesson

Advertising and personalisation need a clear, separate, freely given consent — not consent bundled into terms of service.

Under the DPDP Act

Under Section 6, consent must be free, specific, informed, unconditional and unambiguous, and limited to the stated purpose.

Source: Amazon SEC filing (Form 10-Q, 2021)

Case 06 · 2020

British Airways fined £20 million after card-skimming attack

Aviation · United Kingdom

What happened

Attackers diverted BA website traffic to a fake site and captured details of more than 400,000 customers. The UK ICO found BA lacked basic security measures that could have prevented the attack and fined it £20 million.

The lesson

Regulators judge whether you had reasonable, proportionate security in place before the incident — not only how you reacted.

Under the DPDP Act

Mirrors the DPDP duty of reasonable security safeguards, including encryption, access control, monitoring and log retention required under the Rules.

Source: UK ICO penalty notice

Could this happen to you?

We can review your security, vendors and consent flows before a regulator or attacker does.

Book a free consultation