The Third Party Nobody Named: Whistleblower Protection Gaps In India's Data Breach Regime
Abhijna Satrasala, BBA LL.B. (Hons.), Symbiosis Law School, Pune
ABSTRACT
India's DPDP Act says companies must report data breaches within 72 hours. It says nothing about the employee who finds the breach and makes the report possible. This paper asks: is that employee protected? Does it matter if they report internally to the Audit Committee under Section 177 of the Companies Act or if they go outside to the Data Protection Board? The answer is concerning. Internal protection only exists if a company treats data breaches as violations a question no Indian court has ever answered. External protection does not exist at all: the DPDP Act has no retaliation rules of its own. Looking at the EU's Whistleblower Directive, the US laws like Sarbanes-Oxley and Dodd-Frank, and even SEBI's informant system, this paper shows that India already has the tools to fix this. It just has not used them for data protection yet. If this gap stays, it does not just hurt one employee — it weakens the enforcement model of the DPDP Act, because that model depends on someone inside the company being brave enough to speak up.
