Scenario Brief: How a DPDP Penalty for S3 Misconfiguration Could Unfold

RingSafe Regulatory Brief — DPDP Watch — 22 May 2026

The order in one paragraph

The DPDP Board’s 19 May 2026 order against the lender (anonymised in the published version, but widely reported in the financial press) found three independent breaches: (i) the S3 bucket containing 14.3 million Voter ID and Aadhaar masked-ID scans had its bucket policy set to "Principal": "*" from June 2024 to May 2025; (ii) the lender’s incident response plan did not include S3 logging in scope; (iii) the breach was reported 14 days after internal discovery, against the 72-hour mandate.

Why this changes the compliance calculus

For the first 18 months after DPDP commencement, most Indian Data Fiduciaries assumed the Board would prefer remediation orders over financial penalties. This order proves otherwise. Three operational signals to take from it:

• Public-bucket findings now have a quantified penalty. Cloud security posture management (CSPM) is no longer optional hygiene.
• The 72-hour breach notification clock is being measured strictly. Internal discovery + acknowledgement timestamps will be audited.
• Voter ID and PAN images are being treated as identity tokens, not document scans. Storage encryption at-rest is no longer sufficient; tokenisation or hardware-isolated key vaults are now the de facto standard.

RingSafe analysis

The ₹82 crore figure is roughly 1.7% of the lender’s FY25 revenue. This is consistent with GDPR’s “up to 4%” formula being informally applied as a sub-4% domestic ceiling. Boards should now expect DPDP penalties in the 1-3% range for confirmed breaches with negligence findings, with the upper end reserved for repeated non-compliance.

What Data Fiduciaries should do in the next 30 days

• Run a CSPM scan focused on S3 / Azure Blob / GCS buckets that contain identity documents; treat any public read ACL as a P0 incident.
• Audit your breach notification runbook: who has authority to file the Board notice, and within what hours?
• Inventory all storage of Voter ID, Aadhaar, PAN images and migrate to tokenised storage by Q3 2026.
• Test your DPDP playbook with a tabletop exercise focused on a public-bucket scenario.