Indian consumers have spent the last few years watching their data leak, get sold, and get investigated, often from the very companies that promised to protect it. A leading insurance company’s 2024 breach put policyholder medical and financial records up for sale on Telegram, and the company’s first instinct was to deny it before the evidence made denial untenable.
WazirX, a cryptocurrency exchange, lost about $230 million in a hack in July 2024, drained from a multisig Ethereum wallet in a single attack on July 18. The exchange’s response leaned hard on transparency as a recovery strategy: it launched a bounty program offering up to $10,000 for intelligence that helped freeze the stolen funds, plus a reward equal to 10% of any amount recovered by ethical hackers. That number made headlines on its own. But it also did something for the brand: publishing a bounty this large signaled the exchange saw the hack as fixable through its own actions, not something to bury under legal caution and PR silence. Whether users believed the “your funds are secure” language WazirX used before the hack is a separate question from how they judged what came after, and the after is what stuck.
That gap, between the event and the explanation, is where privacy narratives get built or destroyed. Nobody expects a zero-breach world anymore. Enterprise systems get attacked constantly, and Indian users have absorbed enough Aadhaar leak stories and telecom data scandals to have low expectations about perfect security. What they haven’t absorbed yet, and still react strongly to, is being lied to about the scope of a breach after it happens. The credibility problem of the insurance company, cited at the start, wasn’t the leak. It was the sequence of denials that came before the eventual acknowledgment.
The Digital Personal Data Protection Act, passed in 2023 and still being operationalized through 2025 and 2026, has changed the baseline expectation for how companies are supposed to talk about consent and data use. Fintech and health-tech firms have had to rewrite privacy policies from legal boilerplate into something resembling plain language, partly because regulators now expect it and partly because users have started reading the fine print after enough scandals taught them to. PhonePe and CRED have both leaned into this shift by making data control a visible feature rather than a buried settings menu.
RBI’s data localization mandate, requiring payment data to be stored on servers within India, gave companies another storyline to work with, and some used it well. Razorpay and other payment processors folded “your data stays in India” into marketing material aimed at businesses wary of foreign cloud dependencies. It’s a technically accurate claim that also does emotional work, tapping into a broader unease about foreign platforms and Indian data sovereignty that has been building since the WhatsApp privacy policy backlash of 2021, when users briefly fled to Signal and Telegram over fears about data sharing with Meta.
The pattern across all of this is that trust narratives now have to survive contact with screenshots. A privacy policy that says one thing while a leaked database shows another gets caught within hours, not months, because security researchers and journalists actively hunt for the gap. Companies that come out ahead, even after incidents, tend to share three habits: they disclose scope early instead of waiting for forced admission, they explain remediation in specific technical terms instead of reassuring adjectives, and they treat the regulator’s timeline as a floor, not a ceiling, on how fast they communicate.
None of this fixes the underlying tension, which is that India’s digital economy runs on aggregating exactly the kind of data people are increasingly nervous about handing over. UPI needs your transaction history to work. Health apps need your medical records. Ride-hailing apps need your location constantly. The narrative work isn’t about pretending this collection doesn’t happen. It’s about being specific enough, fast enough, and honest enough about what happens to that data that users decide the trade is still worth it, incident by incident, rather than deciding all at once that it isn’t.
___________________________________________________________________________________________________________________________
The views and opinions published here belong to the author and do not necessarily reflect the views and opinions of the publisher.
