SBI Data Leak Shows the Gap Before DPDP Breach Duties Take Effect

State Bank of India (SBI) told the stock exchanges on 21 October 2026 that customer data linked to it had surfaced on the dark web. The bank said it received alerts on 16 October from its threat intelligence provider, the Defence Cyber Agency and CERT-In. A preliminary review of about 3.75 lakh records found 3,897 containing personally identifiable information, including names, registered mobile numbers, dates of birth, email and residential addresses, customer identification (CIF) numbers, and lead IDs tied to loan records. SBI says account balances are safe and that it informed affected customers by email and WhatsApp on 23 October. It has not said how the data left its systems.

The DPDP Act does not yet apply to this incident. Section 8(6) requires a Data Fiduciary to inform the Data Protection Board and every affected Data Principal of a personal data breach, and Rule 7 of the DPDP Rules, 2025 requires a detailed report to the Board within 72 hours. Both come into force on 13 May 2027, and nothing in the Act suggests they reach back to earlier breaches. Until then, SBI's reporting duties come from the CERT-In Directions of April 2022 and the Reserve Bank of India's rules for banks. Those rules are built around reporting to regulators, not to the people whose data leaked.

The fields in the leak point to where the risk sits, though SBI has not confirmed the source. Lead IDs and loan metadata suggest records from the loan origination process, which in most banks runs through direct selling agents and outside software vendors. Under the DPDP Act, those parties are Data Processors. Section 8(1) makes the bank responsible for their processing regardless of any contract, and Section 8(5) requires it to protect personal data in its possession or under its control, including data processed on its behalf. So a leak at a lead-generation partner in 2027 will be the bank's breach to report.

Banks and other large fiduciaries should use the months before May 2027 to map every place lead and onboarding data goes outside their own systems, and to rewrite processor contracts with breach-notice and deletion clauses. The Centre's proposal to shorten the compliance window for Significant Data Fiduciaries to 12 months has not been notified, but a bank of SBI's size is a likely candidate for that designation and should plan as if the shorter window will apply.