Financial Data Security and Privacy in India: Cybersecurity, Legal Gaps and Consumer Protection

Summary: Financial data security and privacy have become major concerns in India because of the rapid expansion of digital transactions, online banking and financial technology. Banks and financial institutions collect sensitive information, including account details, transaction records and credit histories, for financial services and loan assessments. However, inadequate security arrangements may expose individuals and organisations to data theft, unauthorised transactions and cyber fraud. This article examines financial data protection under the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and the regulatory framework of the Reserve Bank of India. It discusses the importance of consent, data protection responsibilities, consumer remedies and regulatory supervision. The study considers the SBI mobile banking dispute involving unauthorised transactions and the Supreme Court’s decision in Internet and Mobile Association of India v. RBI, which examined the limits of RBI regulatory powers. It also considers personal, corporate, government and third-party financial data leaks, together with the 2018 Cosmos Bank cyberattack. The research identifies weak passwords, inadequate monitoring, employee negligence and insufficient cybersecurity awareness as significant vulnerabilities. Although legal safeguards exist, their effectiveness depends on practical implementation and enforcement. Stronger institutional security, regulatory monitoring, accountability and public awareness are necessary to reduce financial data leakage and protect consumers from cyber fraud.

Financial Data Security and Privacy Concerns in India

The increasing use of digital transactions has made financial data security and privacy significant concerns in India. Financial data, including bank account details, transaction records, and credit information, is essential for banking and loan assessments. However, inadequate security measures can expose this information to data theft and cyber fraud.

Legal Framework for Financial Data Protection

The Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and the regulatory framework of the Reserve Bank of India provide legal mechanisms relevant to data protection and financial security. In Internet and Mobile Association of India v. Reserve Bank of India (2020), the Supreme Court highlighted the legal limitations on regulatory powers by setting aside the RBI’s directions on proportionality grounds. Similarly, the SBI mobile banking dispute discussed in this study demonstrates the risks associated with unauthorised transactions and weaknesses in financial security.

Cybersecurity Threats and Banking Frauds

The 2018 Cosmos Bank cyberattack further illustrates how vulnerabilities in banking systems can result in substantial financial losses. Weak passwords, inadequate monitoring, employee negligence, and insufficient cybersecurity awareness remain important challenges.

Consumer Protection and Effective Regulatory Enforcement

Although legal protections exist, their effectiveness depends on proper implementation and enforcement. Stronger security systems, institutional accountability, effective regulatory monitoring, and public awareness are essential to reducing financial data leakage and cyber fraud. Therefore, protecting financial information requires not only adequate legislation but also responsible practices and effective implementation.

Financial Data Security and Privacy in India: Data Collection, Emerging Trends in Financial Fraud, Cybersecurity, Legal Gaps and Loopholes, and Consumer Remedies

Abstract

In the current situation we are using all the digital transactions to make quick transactions and time saving methods. Now it is very important to be digitalised so that people have to get more aware of usage and their protection. As we also need to notice about our data collection for financial purposes and their privacy. In this article the main focus is in the financial data collection of what all the securities are provided by the government, how the procedure is followed and also its gaps, legal loopholes. And also how financial fraud can be made in the current situation, how newly it’s emerging through technology. Remedies which can easily resolve the disputes of customers.

Importance, Purpose of Protection Digital Personal Data Protection Act, 2023 and Constitutional rights of an individual, understanding of the regulation given by the RBI, Information Technology Act, 2000 provides remedial measures on how it helps for the protection of individual data from data theft and financial fraud. How digitalisation paved the way for people to data theft and financial fraud through technology and also its regulation. Whether Fintech gave the way for development or paved the way for destruction. Relevant case law which gives our more clarification about these disputes.

Key words: Data collection, Privacy, Legal Gaps and loopholes, Financial fraud, Technology, Remedies, Data theft, Fintech.

1. Introduction

¹Financial data means what transaction based information is available is the financial data, for example if we have the bank account all data is having the bank what amount you deposit, withdraw and having the balance all these data and all stored by the bank but this we are having the security for our data. At the same time this data is also helpful for us to determine the loss and profit of what we are making, in day-to-day life. Because we are now mostly sending all the money in digital transactions instead of cash. Now the usage of this digital platform for the money transaction is increased more, it is also an easy process for us. Mostly this data is used for giving the loan to the bank. The bank checks before giving the loan they can check whether they can return the loan or they are able to deceive the bank, through the financial data they can check the transaction whether this particular person is returning the money to all the lenders or the installments. The data also has three qualities, Accuracy, Completeness and also the timeliness. It maintains not only the financial data of the individual but also the organisation, government officials, each and every person of the citizen. Our focus in this area is whether our data have proper protection. For this what are all the legal remedies and also the legislation and practical way we are following.

2. Methodology

This study is provided through the doctrinal methods for which I choose some existing laws, relevant case laws, rules and regulation and also how the practical way is happening. Firstly I framed the three research questions and after that I completely answered this question into the existing facts, laws, rules and regulations which are actually followed in our day to day life. And also in the discussion it explains the existing facts for example if the law is providing this and also how we are following, gaps and loopholes of the legal system that affects the society. I include all the sources which are existing laws and case laws and also the journals, books and also our research papers which expressly speak about these matters and also finally I came to my suggestions.

3. Research Question

• Even though we are having the proper law, it is protecting from cyberfraud and also providing proper legal remedies for the people?
• RBI has the full power to regulate all the networks of finance?
• Is there any possibility of leakaging of the financial data and also how the leakage creates the cyberfraud?

4. Analysis

4.1. Even though we are having the proper law, it is protecting from cyberfraud and also providing proper legal remedies for the people?

²There are some sections which are mentioned about the financial data collection in the DPDP(Digital Personal Data Protection Act), 2023. In this Act, section 2((t) define about the personal Data that means if the information of the person that is related to whatever but it is considered as the Personal Data, as per this section even the financial data is also considered as the personal data because the each and every individual’s financial data is collected. Section 4 provides the protection of the data even if it is the financial or other data it must be used only with the consent of the individual. So it is protecting individual rights.

Sec 5 stated about the notice of the consent , before asking the consent to the person then the bank or other Data Fiduciary has to explain for what purpose your data are collecting and it is useful so that they can get a clear idea about the security.

State Bank of India v. Prashant Mahadeorao Buradkar and Others – Mobile Banking Fraud

³State Bank of India v. Mr, Prashant Mhadeorao Buradkar and others, in this case Prahant Manohar has the bank Account in the SBI it was the joint account with his brother and also the he had the mobile banking for the easy transaction, the bank account was linked with the vodafone mobile number, after some days that number got deactivated, but some one is went to the vodafone office and get that number the reason he stated that he miss the Sim card, he made the unauthorised online transaction Rs.10,50,000, he noticed this and uninformed to the bank. He alleged the vodafone and also the SBI for not maintaining the security for that because for the mobile banking they have the specified code then how he transferred all these money. He filed a complaint under the sec 43, 43A and also sec 46 of the Information Technology Act, 2000 so that the court said the vodafone and the SBI has to compensate for the both have to pay Rs 6,00,0000. After that they both went to the appeal but it was dismissed because of negligence. So in this case the financial data is not secured by the SBI. The SBI also has the responsibility for the loss, they have to give the proper security. The law is strong but practically there is weakness in the society.

4.2. RBI has the full power to regulate all the networks of finance?

The role of the RBI is to regulate the people’s financial system and also protect them from the loss. Sec 35A of the Banking and Regulation Act, 1949 stated that the RBI can issue directions to the Banking sector if it is necessary to protect the interest of the public Internet banking system policy . If the RBI issued something so that the Bank has to follow that without asking any questions.after issuing that the RBI has the right to cancel or withdraw the direction which the RBI issued , they can cancel by the request of others or can cancel by their own initiatives.

Internet and Mobile Association of India v. RBI – Regulatory Powers and Restrictions

⁴Internet and Mobile Association of India v. RBI, in this case the RBI issued certain direction to the banking sector regarding the individuals and the other business, organisation or anyone cannot deal with the virtual currencies, because the RBI found there is the risk for the people to deal with the virtual currencies, but business sectors and who and all are dealing with the digital currency they filed a case against the RBI. The issue is arising that the RBI has any restriction to give the direction?. The court decision clearly explains this matter, the RBI has the power to regulate this kind of matters and also it has completely banned digital currencies, but there is no reasonability in the direction so the court set aside the direction issued by the RBI, because no reasonable measures are followed or mentioned. It is the absolute power but has certain restrictions for that.

4.3. Is there any possibility of leakaging of the financial data and also how the leakage creates the cyberfraud?

⁵Yes there is a possibility of leakage of financial data and also it paved the way for cyberfraud. The financial data leakage leads to loss of reputation, financial loss. This happens because of weak security and also lack of a management system. There are different types of financial data, they are,

Personal Financial Data Leaks

If someone gets the details of the credit card number, bank details of the particular person then they can use it as they want so that it leads to the financial loss of the customer. It may be tax records, mortgage documents, this happens because of the weak security system.

Corporate Financial Data Leaks

This is also a serious issue profit and loss of the company, trade secrets and also the strategies of the investment, strategies of the profits everything is leak means then the company may leads to the loss, the cyber criminals hack the data also, there is the examples for the leakage of corporate financial data, sony pictures hack, because of this hack the financial information of the company like salaries , sales records and also the serious business losses.

Government Financial Data Leaks

The leaks happen because of the unauthorised use of economic policies , this may also happen through the whistleblowers and also the employees who are in their own field leak the data for monetary benefits.

Third Party Financial DataLeaks

This happens because the other company provides the services to the bank, with the help of the bank the other company gets the information about the one particular company

Cosmos Bank Cyberattack Case (2018)

⁶Cosmos Bank Cyberattack Case(2018)

In this incident the Cosmos Bank is located in Maharashtra, in August 2018, the hackers hacked the system of the bank and stole the money. Firstly they create the fake ATM card and withdraw the money from different ATMs and steal across Rs.81.99 crore, secondly they do the international money transfer, the attacker used the SWIFT transfer method and stole Rs. 311.92 crore , this money is transferred to the HongKong bank account. Totally they stole Rs. 94.42crore

5. Discussion

All the laws and also the regulations which were given by the Central and State government are there but in practice how it is applied whether it is practice in the good manner or the regulation and control, is everything going in the good manner not beyond the control of the government and also the legal system. As per the practical life area we are also responsible to check why they are collecting our data and how they protect the data, even though we are in the care of the fraud. Therefore there is no use of proper act or regulations if the practical era is affecting because of not following the act and regulation, after we see this king of case law the question is also arising about the strict checking of the regulatory authority, for example any law or any Act is came to the force the regulatory authority has to check the working persons are following all the rules and regulations? But here there is negligence and also lack of proper security measures.

The RBI has the power to regulate all kinds of the issues which are relating to the financial era, but according to the Internet and Mobile Association of India v. RBI case the court also said about the restriction for regulation, in this case the RBi decide to regulate to protect from the risk i the virtual currency, this is for the public interest also. As the sec 35A of the Banking and Regulation Act, 1949, mentioned about the power of the RBI, in the practical area it is different from what the Act was said to be. So that in the financial data security also the RBI can take a decision but there is restriction for the decision. The power is given to the RBI but there is restriction of that power.

The leakage of the financial data amounts to cyberfraud? Yes we already saw what are the financial leakage is happening in the country and also the real life incident Cosmos Bank Cyberattack Case(2018) clearly explains us about the hackers hacked the financial data through the computer, this is only happens through the lack of the security in the baking sector, this lead the consequences of the financial loss, through this case we analysed the leakage will automatically leads to the cyber fraud and that results the financial loss and other loss.

The major loopholes are the lack of security and also the weak passwords and also the weak management system in every sector, lack of awareness of the working employees, how the data is to be protected and so their mistakes lead to financial data theft in the country. There is lack of the monitoring system in the country , for examples the employees is there means the employer is not checking the all the activities in done by the employees, and also the employers are also in their own decision making for the employer also someone need to monitor for them the government is there to monitor everything but they are not the full time monitoring the work of the everyone. So the lack of monitoring the work will also lead to the leakage of the data. If we regulate all the loopholes in the laws and also in the practical area then we regulate all of these problem and also we are just saying technology increases the cyberfraud, the reality is the security of all the data is stolen not only because of the hackers and also of the lack of security in the financial data system. And also the main reason is negligence

6. Conclusion

As per the analysis of the research question, the proper law is available but the usage of the law is less, monitoring everything and the regulation of the security is less. Because of the loopholes the security weakness for the strong and perfect security we need means the employees negligence has to become reduced for the negligence reduction the action must be in strong. The awareness of the people is also important. Leakage of the data is possible, for the reduction has to be in the proper way.

7. Reference

• Egnyte, Financial Data Security: Compliance & Protection, https://www.egnyte.com/guides/financial-services/financial-data-security (last updated Sept. 6, 2026).
• The Digital Personal Data Protection Act, No. 22 of 2023, § [relevant section], Gazette of India, Extraordinary, Part II, and 1, Aug. 11, 2023, https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf (last visited Oct. 18, 2026).
• State Bank of India v. Prashant Mahadeorao Buradkar, Cyber Appeal No. 7 of 2014 (Telecom Disputes Settlement & Appellate Tribunal, New Delhi, Sept. 12, 2024), https://indiankanoon.org/doc/142562357/ (last visited Oct. 18, 2026).
• Manupatra Academy, Internet and Mobile Association of India v. Reserve Bank of India, MANU/SC/0264/2020, 2020 INSC 264 (Mar. 4, 2020), https://www.manupatracademy.com/home/subject-wise-case-guide-law-students-internet-mobile-reserve-bank-of-india (last visited Oct. 18, 2026).
• Manzoor A. Khanday et al., AI and Financial Data Leaks: Preventing Corruption and Strengthening Cybersecurity (2025), https://www.researchgate.net/publication/396382871_AI_and_Financial_Data_Leaks_Preventing_Corruption_and_Strengthening_Cybersecurity (last visited Oct. 18, 2026).
• Cyberattack on Cosmos Bank (Scribd), https://www.scribd.com/presentation/596388636/Cyberattack-on-Cosmos-Bank-PPT (last visited Oct. 18, 2026).

Notes:

¹ Egnyte, Financial Data Security: Compliance & Protection, https://www.egnyte.com/guides/financial-services/financial-data-security (last updated Sept. 6, 2026).

² The Digital Personal Data Protection Act, No. 22 of 2023, § [relevant section], Gazette of India, Extraordinary, Part II, and 1, Aug. 11, 2023, https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf (last visited Oct. 18, 2026).

³ State Bank of India v. Prashant Mahadeorao Buradkar, Cyber Appeal No. 7 of 2014 (Telecom Disputes Settlement & Appellate Tribunal, New Delhi, Sept. 12, 2024), https://indiankanoon.org/doc/142562357/

⁴ Manupatra Academy, Internet and Mobile Association of India v. Reserve Bank of India, MANU/SC/0264/2020, 2020 INSC 264 (Mar. 4, 2020), https://www.manupatracademy.com/home/subject-wise-case-guide-law-students-internet-mobile-reserve-bank-o f-india (last visited Oct. 18, 2026).

⁵ Manzoor A. Khanday et al., AI and Financial Data Leaks: Preventing Corruption and Strengthening Cybersecurity (2025), https://www.researchgate.net/publication/396382871_AI_and_Financial_Data_Leaks_Preventing_Corruption_a nd_Strengthening_Cybersecurity (last visited Oct. 18, 2026).

⁶ Cyberattack on Cosmos Bank (Scribd), https://www.scribd.com/presentation/596388636/Cyberattack-on-Cosmos-Bank-PPT (last visited Oct. 18, 2026).

***

AUTHOR: T. Valentina CO-AUTHOR: Vinoth Kumar.R | AFFILIATION: LL.B(Hons.) Third year, Vinayaka Mission’s Law School, Paiyanoor, Chennai – 603104