Another week, another headline about a data leak. This time it is Bank of Baroda. Before that it was Tata Electronics, with Apple and Tesla supplier files exposed. Before that, files linked to the Kudankulam nuclear power plant, reportedly through a contractor. The pattern is becoming familiar, and so is the public reaction. Someone gets breached, the internet lights up, and the organisation gets treated like it committed the crime rather than suffered it.
I want to take a different approach here.
An Bank of Baroda employee’s inbox is not a fortress wall
Bank of Baroda’s own statement is worth reading carefully. The bank said the incident stemmed from the compromise of one employee’s email account, and that the core banking systems were not accessed and remain secure. That is an important distinction, and it is also a very human one.
Every organisation, no matter how large, no matter how many crores it has spent on information security, runs on people. People check email on their phones. People click links they should not click. People reuse passwords, or fall for a well-crafted phishing message on a tired Monday morning. This is not a Bank of Baroda problem. It is a workforce problem, and every single company reading this blog, including ours, is one convincing email away from the same headline.
So our first reaction to this news is not outrage. It is empathy. A bank moved quickly, identified the compromise, contained it, and said it is now working with regulators. That is exactly what a responsible organisation should do when the worst happens. I do not think Bank of Baroda deserves to be demonised for this. I think it deserves credit for how it responded, even as it deserves scrutiny for what allowed the breach in the first place.
But empathy does not mean we lower the bar
Here is where I want to be very clear, because there is a difference between understanding why something happened and accepting that it is acceptable.
Aadhaar details. Loan documents. Internal audit records. Branch information. That is what was reportedly exposed. This is not a leaked marketing brochure. This is the kind of data that, in the wrong hands, can be used to open fraudulent loans, impersonate customers, or feed identity theft rings that operate for years without detection.
When a single compromised inbox can expose a terabyte of this kind of data, the real story is not the phishing email. The real story is what happened after that email was compromised. Why did one compromised account have a pathway to that much sensitive customer data? Why was there no segmentation stopping a single point of failure from becoming a systemic one? Why did it take social media posts flagging the leak before internet security researchers confirmed it, rather than internal detection catching it first?
These are not accusations. These are the exact questions the DPDPA was written to force every data fiduciary in this country to answer, in advance, not after the fact.
DPDPA is not a compliance checkbox. It is a promise.
We have spent considerable time building compliance technology around the Digital Personal Data Protection Act (Atlas Privacy Manager), and if there is one thing I want every bank, NBFC, and fintech in this country to internalise, it is this: DPDPA is not paperwork. It is not a policy document you file away for the day an auditor asks for it. It is an operating philosophy.
The Act asks organisations to do things that, frankly, should have been common sense long before there was a law demanding it. Minimise the data you collect. Encrypt and segment what you hold. Know exactly where your sensitive data lives and who can touch it. Have a breach response plan tested and ready, not improvised in a crisis. Treat consent as something continuously earned, not a checkbox ticked once at onboarding.
Banks handle the most sensitive data of any industry outside of healthcare. Aadhaar numbers, PAN details, income data, loan histories, family information. When that data leaks, it does not just cost the bank a bad news cycle. It puts real people at risk of real financial and personal harm, for years, because unlike a credit card number, you cannot simply cancel your Aadhaar and issue yourself a new one.
That is why privacy cannot be treated as a regulatory obligation to be managed by a compliance team once a year. It has to be treated as a fundamental right of the customer, defended with the same seriousness as the money in their account. A bank would never accept “we had one weak password” as an excuse for a financial fraud incident. It should hold itself to that same standard when it comes to the data that makes fraud possible in the first place.
What good actually looks like
Bank of Baroda’s response, so far, has the right instincts. Prompt identification, immediate containment, forensic investigation, regulatory engagement. That is the playbook every organisation should be running.
But the organisations that will actually earn customer trust in the next few years are the ones that go further, before a breach happens, not after. They will be the ones who can say, with evidence, that sensitive data is minimised and segmented by design. That every employee’s access is scoped tightly to what their role actually requires. That a single compromised inbox has no path to a terabyte of Aadhaar-linked records. That their DPIAs are not shelf documents but living assessments that actually shape system architecture.
This is not about avoiding blame. It is about building institutions worthy of the trust their customers place in them every single day, often without a second thought, because they have no other choice but to trust their bank with their most sensitive information.
The real takeaway from Bank of Baroda breach
I do not think Bank of Baroda is the villain here. I think it is a large, complex institution that got unlucky in the way every institution eventually does, and it is now doing the right things in response. My concern is not with this one bank. My concern is with an entire industry that still treats privacy as a compliance line item rather than a right owed to every customer whose data it holds.
DPDPA gives us the framework. What is missing, in far too many boardrooms, is the conviction that privacy deserves to be defended as fiercely as the money does.
That conviction is not optional anymore. It is the price of doing business with people’s trust.
