SBI Says It Has Individually Informed Every Customer Whose Data Was Involved
Two days after telling the stock exchanges about a cyberattack, the State Bank of India told its customers. The bank's statement that it has individually informed every customer whose data was identified as being involved was made on October 23, 2026 through its own channels rather than by a further exchange filing, and the difference between the two communications is the part worth noting.
What the Bank Said
The bank said that it had individually informed all customers whose data was identified as being involved, and reiterated that account balances and funds are safe. The communication to affected customers was reported as having been made individually, by email and by WhatsApp.
The statement was carried on the bank's own official channel. Neither account of it reports a further filing with the exchanges, so on what is reported the October 21 disclosure remains the only communication made to the market about this matter.
No Number of Customers Has Been Given
Neither account states how many customers were informed. The figure that has been reported throughout, 3,897, is a count of customer records identified as containing personally identifiable information, and neither account says that count corresponds one to one with customers.
Records and individuals are different quantities. One customer can account for more than one record, so the number of people who received a message is not derivable from the number that has been published. Anyone advising on this matter should keep the two apart until the bank states the second one, and should not describe the reported figure as a number of customers.
The Sequence as It Now Stands
On the two accounts of this matter, the dates are these. The bank was alerted on October 16, 2026. It disclosed the matter to the stock exchanges on October 21, 2026. It told affected customers on October 23, 2026. Seven days separate the first of those from the last.
A chronology of that kind is the first thing any later inquiry builds, and it is built from documents rather than from recollection. Each step in it should be evidenced by something dated: the alert as received, the internal decision to disclose, the filing itself, and the sending records for the customer messages.
Where one of those is missing, the gap appears in the chronology rather than in the narrative, which is the point of keeping the chronology. An account that reads well but cannot be tied to dated documents at each step is not a record of what happened.
Two Communications, Two Audiences
The October 21 communication went to the stock exchanges and was reported as having been made under the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015. The October 23 communication went to individual customers through the bank's own channels. They are different audiences, reached by different means, and only the first was reported as the discharge of a disclosure obligation to the market.
Keeping them apart matters when the sequence is later reconstructed. A filing to the exchanges is a dated document in a regulated series. A message sent to a customer by email or a messaging application is evidenced by the sending records, and those records are what would answer a question about who was told and when.
No Commenced Provision of the Act Required It
The duty to give intimation of a personal data breach to each affected Data Principal is in section 8 of the Digital Personal Data Protection Act, 2023. Chapter II of that Act, in which section 8 sits, comes into force eighteen months after publication of commencement notification G.S.R. 843(E) dated November 13, 2025, which falls in May 2027.
So the customer notification was not made in discharge of that duty, because the duty has not commenced. That is a statement about the Act and not about every instrument that might bear on a bank, and nothing here should be read as a view on whether some other requirement applied.
What a Notification of This Kind Does Not Settle
Telling a customer that her data was involved is not a determination that there has been a personal data breach within the meaning of the Act. That expression is defined, the definition has elements, and a communication sent while an examination continues does not apply them.
Nor does it fix the scope of the incident. The bank has said that the source and extent of the exposure remain under investigation, which means the set of affected individuals is itself provisional. A notification sent on one view of the facts may have to be followed by another.
Key Takeaways
The notification came on October 23: It was made through the bank's own channels and was not reported as a further exchange filing.
The bank's words were about identification, not about counting: It said it had individually informed all customers whose data was identified as being involved.
The record count is not a customer count: The 3,897 figure counts records containing personally identifiable information, and no account says it corresponds one to one with customers.
The two communications served different purposes: The October 21 filing went to the market under the Listing Obligations and Disclosure Requirements Regulations; the October 23 message went to individuals.
No commenced provision of the Act required the notification: The intimation duty in section 8 sits in Chapter II, which commences eighteen months after publication of the commencement notification.
The chronology is the record: Seven days separate the alert of October 16 from the customer notification of October 23, and each step in between should be evidenced by something dated.
Nothing is determined yet: The source and extent remain under investigation, so the affected set is provisional.
Key Statutory Provisions
Section 8 of the Digital Personal Data Protection Act, 2023: General obligations of a Data Fiduciary, including the duty to give intimation of a personal data breach to the Data Protection Board of India and to each affected Data Principal. It sits in Chapter II and has not commenced.
SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015: The framework under which the October 21 disclosure to the stock exchanges was reported to have been made.
Commencement notification G.S.R. 843(E) dated November 13, 2025: Places Chapter II of the Act, including section 8, in the group commencing eighteen months after publication.
Sources and References
Report of the bank's statement, with the manner of notification
Independent report of the same statement, with the bank's words
Digital Personal Data Protection Act, 2023, Act No. 22 of 2023, Chapter II
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers should consult a qualified legal professional for advice specific to their circumstances.
Comments