The True Cost of a Data Breach for Indian MSMEs (And How to Avoid It)

The ransom or the fine is rarely the largest cost. Here is where the money really goes.

When business owners imagine the cost of a breach, they picture a ransom demand or a regulator’s fine. Those are real, but for most MSMEs they are not the largest part of the bill. The larger costs are slower, quieter and harder to insure.

What the numbers say

IBM’s Cost of a Data Breach Report 2025 put the average cost of a breach for organisations in India at about ₹22 crore. That study covers larger organisations, so an MSME’s figure will usually be smaller in absolute terms. As a share of revenue, though, it can be far more damaging.

Where the money goes

• Downtime: orders not taken, production lines stopped, staff idle while systems are rebuilt.
• Investigation and recovery: forensic specialists, rebuilding systems, restoring from backups (if they work).
• Legal and notification: advice, notifying affected customers, responding to regulators.
• Lost business: customers who quietly move to a competitor, and enterprise contracts that are not renewed.
• Management time: weeks of founder attention diverted from running the business.

The regulatory dimension

Under the DPDP Act 2023, failing to take reasonable security safeguards to prevent a personal data breach can attract a penalty of up to ₹250 crore, and failing to notify the Data Protection Board and affected individuals can attract up to ₹200 crore. With the DPDP Rules 2025 now notified, these obligations come fully into force on 13 May 2027. The Board is expected to consider factors such as the nature and gravity of the breach and the mitigation steps taken, which makes documented, reasonable safeguards valuable in their own right.

How to avoid most of it

The majority of breaches we read about start with a small number of causes: stolen or weak credentials, unpatched internet-facing systems, misconfigured cloud storage and successful phishing. That means a focused set of controls addresses a large share of the risk:

• Multi-factor authentication on email, VPN, cloud and admin panels
• A patching routine for anything exposed to the internet
• Backups that cannot be altered by an attacker, tested regularly
• A periodic vulnerability assessment of your website and applications
• Short, regular awareness sessions so staff recognise phishing
• An incident response plan that names people and phone numbers

The honest summary

No control makes a business immune. The aim is to make a breach less likely, to detect it faster when it happens, and to limit the damage. For an MSME, that difference can decide whether an incident is a bad week or the end of the business.

This article is general information, not legal advice. Compliance services do not guarantee certification; certification bodies issue certificates.