Cyb-D Solutions Pvt. Ltd. is a Chennai based Cyber security firm. This firm was hired by AB Bank after regulators flagged compliance gaps. During the audit, the bank faced insider fraud, were manipulation of online banki

CS Professional · Artificial Intelligence, Data Analytics and Cyber Security - Laws and Practice · PYQS · June 2026
Cyb-D Solutions Pvt. Ltd. is a Chennai based Cyber security firm. This firm was hired by AB Bank after regulators flagged compliance gaps. During the audit, the bank faced insider fraud, were manipulation of online banking records was detected. Cyb-D collected logs and e-mails, but in court, the defence challenged the forensic preservation methods. Regulator also objected to AB bank's merged IT and cyber security policy. According to this policy, RBI mandates a separate cyber security framework. Cyb-D drafted a new cyber security policy covering incident response. VAPT, encryption and data protection, while keeping IT operations distinct. Later, AB Bank's lawyers wanted to use legal analytics tool to predict the outcome of customer disputes. While these tools gave useful insights, concerns about privacy and admissibility in court were raised. Cyb-D solved this by anonymizing data, taking consent and following the IT and data protection bill. In another fraud case, Cyb-D did forensic imaging of employee laptops but the defence argued that missing hash values and time stamps weakened the chain of custody. Cyb-D responded by maintaining proper custody logs and using standard forensic methods. Finally, Cyb-D VAPT testing found serious weaknesses in the bank's mobile app. Manager delayed fixing them and hackers later exploited these flaws causing a customer data breach. The bank was sued for negligence. To prevent this in future, Cyb-D setup a risk escalation system, having strict timelines for fixing issues and a high-level committee. In the light of the above case scenario, answer the following questions: As Cyb-D drafted a new cyber security policy that covers the data protection also. Illustrate the Indian Laws for Data Protection, that must be taken into consideration.

Answer & Explanation:

Indian Laws for Data Protection Individual's data like name, telephone numbers, profession, family, choices, pan card number, credit card details, social security number etc. are disclosed in the electronic transactions and then are available on various websites. Though the authorized collection and the storage of data may only create probability of the loss of information privacy but the unauthorized access, collection, use, misuse, relocation and transmission of the information to the third party essentially result in the intrusion of information privacy of the individuals. Hence, improper control on transmission of information can be the root cause for privacy challenges in electronic transactions. Law will not only determine, what privacy entails, how it is to be valued, and to what extent it should be endowed with legal protection, but also ensures authorized protection to the circumstances under which individuals can value their privacy and protect it from the violation of unauthorized intrusion of others. Vice-Chancellor Knight Bruce, presiding over the High Court of Chancery (Chancery Division) in Prince Albert v Strange (1849) upheld that a third-party intrusion into one's privacy results in grave violation of right to privacy and hence, implies need of legal protection to right to privacy and confidential information. To counter the challenges of information and communication technology, the Indian Legislature has enacted Information Technology Act, 2000, Information Technology (Amendment) Act, 2008 and other legislations too, but challenges of information privacy and data privacy are not addressed in an exclusive and specific manner. India is not having a comprehensive legislative framework to deal specifically with privacy issues in electronic transactions. The Information Technology Act, 2000 was enacted chiefly to facilitate e-commerce; hence privacy is not the primary concern of the Act. To systematically bridge this legislative gap and move away from fragmented electronic transaction rules, the Indian Parliament enacted the Digital Personal Data Protection (DPDP) Act, 2023. This modern statute provides with its first comprehensive, dedicated, and independent legislative framework specifically designed to enforce data fiduciary accountability, protect digital citizen privacy, and penalize unauthorized processing or data breaches within the digital ecosystem.

Topics: Data Protection

Open in Interactive Practice Hub · Full Practice Hub · Chapter Weightage · More in this subject

Related Questions in this Topic