How to report identity theft and protect data under the DPDP Act 2023

1. The Hook

"Write the meaning of your name, and I’ll guess it." It sounds like a fun Friday night on r/IndianTeenagers or an Instagram story sticker. You comment "Light," thinking of your name, 'Jyoti' or 'Roshni.' Then someone replies with your surname, your coaching centre’s name, and a screenshot of your LinkedIn. Suddenly, that 10-second "guess my name" game has turned into a doxing nightmare. When your personal data is used to track, harass, or impersonate you, it isn’t just "internet drama"—it’s a legal violation. In a world of AI-assisted stalking, a single data point like your name's meaning can be the final piece of a puzzle used to steal your identity or harass you offline.

2. What the law actually says

Until recently, online privacy in India was a bit of a Wild West, but as of 2024, the legal landscape has shifted. Your primary shield is the Digital Personal Data Protection (DPDP) Act, 2023.

Under this Act, you are the Data Principal (the person the data belongs to). Any individual or platform that collects your data is a Data Fiduciary. Section 6 of the DPDP Act states that your consent for data processing must be "free, specific, informed, unconditional, and unambiguous." If someone uses a game or a trick to collect your personal details and then uses them for something else (like doxing or harassment), they have violated the Act because your consent was not "informed" for that specific purpose.

Furthermore, the Bharatiya Nyaya Sanhita (BNS) 2023, which replaced the IPC, covers the criminal side of this. Section 318 of the BNSS deals with "cheating by personation." If someone uses your name or details to pretend to be you or to trick others, they can face up to three years in prison.

If the doxing leads to financial fraud or serious identity theft, the Information Technology (IT) Act, 2000 comes into play. Section 66C specifically punishes identity theft (using someone else's electronic signature, password, or unique identification feature) with up to three years of jail and a fine of ₹1 lakh. Section 66D covers cheating by personation using a computer resource.

Finally, the Supreme Court in Justice K.S. Puttaswamy (Retd.) vs Union of India (2017) declared the Right to Privacy as a fundamental right under Article 21 of the Constitution. This means you have a constitutional right to control who knows what about you. If you need to dig deeper into how the government handles your data, you can always file an RTI online to ask about data breaches in public systems.

3. Step-by-step playbook

If you’ve been doxed or your identity has been compromised through a social media "game" or leak, follow this sequence to shut it down.

Step 1: Document the breach immediately

Before the harasser deletes their comments or profile, you need evidence.

• What to do: Take full-page screenshots. On a PC, use 'Print Screen'; on mobile, ensure the timestamp and the URL/username are visible.
• What to bring: Save the direct link (URL) to the post or profile. Do not just rely on screenshots; URLs are harder to fake in court.
• Timeline: Do this within minutes of discovery.

Step 2: Report to the platform

Most social engineering happens on Reddit, Instagram, or X (Twitter).

• What to do: Use the "Report" button. Select "Harassment," "Doxing," or "Sharing private information."
• What to upload: Use the platform's internal reporting tool to flag the specific comments.
• Timeline: Platforms usually respond within 24–48 hours. If they refuse to take it down, move to Step 3.

Step 3: File a complaint on the Cyber Crime Portal

This is the most critical step for legal action.

• What to do: Go to the official Cyber Crime reporting portal (cybercrime.gov.in).
• What to bring: You will need your ID proof (Aadhaar or PAN), the screenshots from Step 1, and the URL of the offender.
• Procedure: Select "Report Crime related to Women/Children" if applicable, otherwise "Other Cyber Crimes." Mention Section 66C of the IT Act and Section 318 of the BNSS in the description.
• Expected Timeline: You will receive an acknowledgement number immediately. A police officer should contact you within 7 days.

Step 4: Exercise your 'Right to Erasure'

Under Section 12 of the DPDP Act 2023, you have the right to ask a Data Fiduciary (like a website or an app) to delete your personal data once the purpose for which it was collected is over.

• What to do: Send a formal email to the platform's Grievance Officer (their contact is usually in the 'Privacy Policy' or 'About Us' section).
• The Script: "Under Section 12 of the Digital Personal Data Protection Act 2023, I, as the Data Principal, exercise my right to erasure. My personal information (specify what) was collected without informed consent for the purpose of harassment. I request immediate deletion."
• Timeline: Platforms must act within the timeframes specified in the DPDP Rules (typically 30 days as of 2024).

Step 5: File an FIR if the threat is physical

If the doxer has shared your home address or phone number and you are receiving threats, a digital complaint isn't enough. You need to go to your local police station.

• What to do: Visit the nearest station. If they refuse to register your complaint, follow our guide on how to file an FIR (and what to do if police refuse).
• What to bring: A printed copy of the Cybercrime portal acknowledgement and your evidence folder.
• Timeline: An FIR must be registered immediately for cognizable offences.

Step 6: Escalate to the Data Protection Board

If the platform or the individual who leaked your data ignores your request for deletion, the DPDP Act provides for an escalation path.

• What to do: Once the Data Protection Board of India (DPBI) is fully operational (check meity.gov.in for the latest portal link as of 2026), you can file a formal complaint there.
• Expected Outcome: The Board has the power to levy heavy penalties (up to ₹250 crore in extreme cases) on entities that fail to protect personal data.

For more ways to protect your digital life, you can browse all civic-action guides.

Where it usually breaks

The system looks good on paper, but in reality, you will hit walls. Here is how to climb over them:

1. The "It’s just a prank, beta" brush-off When you go to a local police station, the officer might tell you that a Reddit comment or an Instagram "guess my name" game isn't a "real crime." They might advise you to just "block and move on."

• The Workaround: Remind them of the Lalita Kumari vs. Govt. of UP (2014) Supreme Court judgment, which makes it mandatory for police to register an FIR if the complaint discloses a cognizable offence. Identity theft under Section 66C of the IT Act is cognizable. If they still refuse, ask to file a Zero FIR under Section 173 of the Bharatiya Nagarik Suraksha Sanhita (BNSS), 2023. This forces them to record the complaint regardless of which station the "crime" happened in.

2. The platform ignores your report You reported the doxing to Instagram or X, and you got an automated reply saying "this doesn't violate our community standards."

• The Workaround: Every major social media company (Significant Social Media Intermediaries) is legally required under the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 to have a Resident Grievance Officer in India. Don't just click the "Report" button; find the specific email of their Grievance Officer on their "Legal" or "Contact" page. If they don't resolve it in 15 days, escalate it to the government's Grievance Appellate Committee (GAC) at gac.gov.in.

3. The Cyber Crime Portal is "Under Maintenance" The national portal (cybercrime.gov.in) is notorious for timing out or failing during OTP verification.

• The Workaround: Call the National Cyber Crime Helpline at 1930. This is a 24/7 service. If you can't get through, draft a physical letter and send it via Registered Post AD to the Superintendent of Police (SP) of your district. Under Section 173(4) of the BNSS, if a Station House Officer (SHO) refuses to file your FIR, the SP is legally bound to investigate it or direct an officer to do so.

Templates / script

A. Script for calling the 1930 Helpline

"Hello, I am calling to report a case of identity theft and doxing. My personal data was harvested through a social engineering trick on [Platform Name] and is now being used to harass me. I have screenshots of the URLs and the perpetrator's handle. I want to register a formal complaint and get acknowledgment. My name is [Your Name] and I am calling from [City]."

B. Email to a Platform’s Grievance Officer

Subject: Formal Grievance under IT Rules 2021 – Violation of Privacy – [Your Username/Case ID]

Body: Dear Grievance Officer,

I am writing to report a violation of my privacy and a breach of the Digital Personal Data Protection (DPDP) Act, 2023.

An individual using the handle [Handle Name] has obtained my personal data (including [list data: e.g., full name, coaching centre, location]) without my informed consent through a deceptive post. This data is now being used to dox and harass me at this URL: [Link to the post].

Under the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, you are required to acknowledge this complaint within 24 hours and resolve it within 15 days. Given that this involves the non-consensual disclosure of private information, I request an immediate takedown of the content within 24 hours as per Rule 3(2)(b).

Attached are the screenshots of the violation.

Regards, [Your Name] [Phone Number]

C. Formal Complaint to the Cyber Cell (Draft)

To, The SHO/In-charge, Cyber Crime Cell, [City/District].

Subject: Complaint regarding Identity Theft (Section 66C IT Act) and Cheating by Personation (Section 318 BNS).

Respected Sir/Ma'am,

I, [Your Name], age [Age], resident of [Address], wish to report that on [Date], I was targeted by a social engineering scam on [Platform]. The accused, using the profile [Link/Handle], tricked me into revealing personal identifiers which were then used to [describe what happened—e.g., create a fake profile/dox me].

This act constitutes:

1. Identity Theft under Section 66C of the IT Act, 2000.
2. Cheating by Personation under Section 318 of the Bharatiya Nyaya Sanhita (BNS), 2023.
3. Violation of Privacy as protected under the DPDP Act, 2023.

I request you to register an FIR and initiate an investigation. I have attached the relevant screenshots and URLs as evidence.

Yours faithfully, [Your Name] [Date]

FAQs

1. I am only 17. Can I file a cyber complaint alone? While you can report on the portal, for a formal FIR at a police station, you will usually need a parent or legal guardian to accompany you as a "complainant" because you are a minor. However, if the doxing involves any sexual harassment or child pornography (CSAM), the police must act immediately under the POCSO Act regardless of who reports it.

2. Will the police take my phone away for "evidence"? They might ask for it, but you have rights. If they seize your device, they must provide a Seizure Memo listing exactly what was taken. Under recent Supreme Court observations, they cannot force you to share your password/pattern without a specific court order. Always ask if they can just take a "mirror image" of the relevant data instead of keeping the physical phone.

3. Is there a fee for filing a cyber crime complaint? No. Filing a complaint on the National Cyber Crime Reporting Portal or registering an FIR at a police station is completely free. If any officer asks for money for "stationery" or "investigation costs," that is a bribe. You can report this to the Vigilance Department of your state police.

4. What if I deleted the screenshots or the post was deleted? If you have the URL, the Cyber Cell can still send a notice to the platform (like Meta or X) under Section 94 of the BNSS to recover the deleted data and IP logs from their servers. Most platforms keep "logs" for at least 180 days after deletion as per Indian law.

5. Can I file the complaint anonymously? On the cybercrime.gov.in portal, there is an option to "Report Anonymously" specifically for crimes against women and children. For general identity theft or financial fraud, you are required to provide your details so the police can contact you for the investigation.

6. How long does it take for the content to be taken down? Under the IT Rules 2021, if the content is "obscene" or shows you in a "nude or partial nude" state, the platform must remove it within 24 hours. For general doxing or data theft, they usually have up to 15 days to resolve your grievance after you contact their Grievance Officer.

7. Can I sue the person for money? Yes. Besides the criminal case, the DPDP Act, 2023 allows for the Data Protection Board of India to levy heavy penalties (up to ₹250 crore) on companies that fail to protect your data. For individuals, you can file a civil suit for "damages" in a civil court, but this is a long and expensive process compared to the criminal complaint.