Privacy Breach vs Data Breach: Difference, Regimes and Remedies

Every data breach involving personal data wounds privacy, but privacy can be breached with no database anywhere in the story, a lens through a window, a tapped call, a secret told. The two phrases therefore name different wrongs: the privacy breach is any violation of a person's privacy interest, the data breach a security incident defined at the data, and each has its own standard, machinery and remedy. Topics 87, 95 and 114 built the surrounding law; this note, as asked, completes the set with the dedicated comparison.

1. The Wider Wrong and Its Security Species

Figure 1: The person and the dataset

• Privacy breach. Any violation of the privacy interest Puttaswamy made fundamental: unlawful surveillance and interception, capture or publication of private imagery, wrongful disclosure of personal information, intrusion into home, body, communications or informational self-determination (Topic 87). The wrong is measured at the person, and it needs no dataset: one photograph, one call, one secret suffices.
• Data breach. The security incident defined at the data: personal data's confidentiality, integrity or availability compromised, by intrusion or accident, the DPDP definition studied in Topic 114. The wrong is institutional before it is personal, a failure of custody, and it exists even while no individual yet feels any invasion.
• The two clean cases. Privacy breach without data breach: the s.66E image, the s.72 official's disclosure, the unlawful tap, no security incident anywhere. Data breach without felt privacy harm: encrypted records exfiltrated and never read, exposure discovered and closed before misuse, the duties run though no one was yet wronged in the felt sense. The leaked medical database is the overlap, both wrongs at once, each regime on its own clock.

2. Regimes and Remedies

Figure 2: Two regimes on one field

• The privacy regime protects the person. Against the State: the Puttaswamy test, legality, legitimate aim, proportionality, policing surveillance, interception and data demands, with the s.69 safeguards and their challenges (Topic 70). Against private actors: s.66E for bodily privacy, ss.72 and 72A for wrongful disclosure, the stalking and voyeurism offences, the intimate-imagery clocks, injunctions and the civil privacy action the courts have been building since Puttaswamy.
• The data-security regime disciplines the custodian. The DPDP Act's reasonable security safeguards, breach intimation to principals and the Board, and schedule penalties to Rs 250 crore; CERT-In's six-hour incident reporting; and, through the transition, the s.43A compensation claim for negligent security, the machinery of Topics 87 and 95.
• Different defendants, different questions. The privacy claim names whoever invaded, the State, the discloser, the publisher, and asks whether the intrusion was justified; the breach proceeding names the custodian and asks whether its safeguards and notifications met the statutory standard: one incident can raise both, but the questions never merge.
• Remedy mapping for the victim. For the invasion: prosecution under the privacy offences, takedown on the two-hour clock for imagery, injunction and damages, constitutional challenge where the State acted. For the breach: the Board's complaint route and penalties, s.43A compensation while it lasts, and claims against the intruder under the access offences (Topics 95, 114)

3. Frequently Asked Questions

What is the difference between a privacy breach and a data breach?

A privacy breach is any violation of a person's privacy interest, unlawful surveillance or interception, capture or publication of private imagery, wrongful disclosure of personal information, and it needs no dataset or security incident: Section 66E, Sections 72 and 72A and the Puttaswamy standard answer it. A data breach is a security incident defined at the data, personal data's confidentiality, integrity or availability compromised by intrusion or accident, and it triggers the custodian's duties, CERT-In reporting, DPDP intimation of principals and the Board, and penalties for failed safeguards, even where no individual yet feels invaded. A leaked personal database is both at once.

What remedies does a person have for each?

For the privacy breach: prosecution of the invader under Sections 66E, 72 or 72A and the BNS offences, removal of intimate or morphed imagery on the two-hour platform clock, civil injunction and damages, and constitutional challenge with the Puttaswamy test where the State intruded. For the data breach: complaint through the fiduciary's grievance channel to the Data Protection Board, whose penalties discipline the custodian, compensation under Section 43A during the transition, and proceedings against any intruder under the unauthorised access and identity theft offences.

4. Related Topics

• Topic 114: Data Breach vs Unauthorised Access. The event and the conduct.
• Topic 95: IT Act Privacy vs DPDP Privacy. The two statutory regimes compared.