Construction Firm Claims Rs 150 Crore Data Loss from AWS Cloud Storage; Unable To Retrieve Now

A builder named Adarsh Developers has filed an FIR against Amazon Web Services (AWS), claiming a data loss worth Rs 150 crore. The company used AWS's cloud storage services to store their financial and customer data, but due to some actions by individuals at Redington and AWS teams, they lost over six years of business data. This has caused substantial financial and operational losses.

AWS has stated that despite their best efforts, they are unable to retrieve the lost data. The FIR has been filed under the Bharatiya Nyaya Sanhita (BNS) and Information Technology Act. A probe has been initiated, but Redington have not commented further.

According to an AWS spokesperson — "The claims against AWS are false. AWS operated as designed and is not responsible for the deletion of Adarsh Developers' data."

The Bengaluru-based builder has 36 years of experience in developing residential, commercial, and hospitality projects, used Amazon Web Services (AWS) to store their financial data and customer information. In May 2023, AWS representatives assured the company that their cloud storage servers would ensure data retrieval even in the event of cyber-attacks or natural disasters.

In December 2023, Adarsh Developers procured cloud storage facilities through an SAP implementation partner, SAVIC Technologies Pvt Ltd, for Rs 88,59,924, including GST. The agreement was to maintain the data securely for three years until November 2027.

However, on January 9, 2024, the implementation partner informed Adarsh Developers that due to actions by individuals at Redington and AWS teams, there had been a data loss.

The complaint stated that employees at Redington Group had entered the storage area at the root level and deleted the account completely, resulting in the loss of over six years of business data. This data loss has caused substantial financial and operational losses, estimated at Rs 150 crore.

AWS India has stated that despite their best efforts, they are unable to retrieve the lost data. The FIR has been filed under the Bharatiya Nyaya Sanhita (BNS) and Information Technology Act, and a probe has been initiated.

It's a complex situation with significant implications for data security and cloud storage practices. Do you think AWS and Redington should be held accountable for this data loss? Comment in the comments section below.

Regulations regarding data protection in India

India has a comprehensive framework for data protection, primarily governed by the Digital Personal Data Protection Act (DPDP Act) of 2023. Here are some key points:

1. Consent-Based Data Processing: Organizations must obtain proper consent from individuals before collecting and processing their personal data.
2. Rights of Data Principals: Individuals have several rights under the DPDP Act, including the right to information, access, rectification, data portability, and the right to be forgotten.
3. Obligations of Data Fiduciaries: Organizations (data fiduciaries) are required to implement reasonable security practices and procedures to protect personal data.
4. Data Protection Board: The DPDP Act establishes a Data Protection Board of India to oversee compliance and address grievances.
5. Penalties and Fines: Violations of the DPDP Act can result in significant penalties and fines.

Additionally, the Information Technology Act, 2000 (IT Act) and its associated rules, such as the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules), also play a crucial role in data protection.