About the Data Incident Index
Mission
Make personal data breaches and leaks easier to find, understand and study.
Why the Index exists
Personal data about patients, students, customers and employees is held by more organizations than ever, and it keeps getting exposed: through attacks, mistakes, insiders and suppliers.
What is known about each breach is scattered across press reports, breach notices, regulator decisions and court filings. Laws such as the GDPR, the UK GDPR and India's Digital Personal Data Protection Act require organizations to protect that data and, in many cases, to report when they fail.
The Data Incident Index exists to organize that information into a structured, searchable public record, starting with the GDPR and adding the DPDP Act next.
Editorial independence
The Data Incident Index is maintained by Raidu. Commercial relationships do not determine whether an incident is included, removed or classified.
- Inclusion, removal and classification follow the published methodology only.
- Record removal is never sold, and payment is never accepted to change an evidence status.
- Organizations named in a record can submit a response or correction at no cost.
- Raidu products are not promoted inside incident records.
Who maintains it
Raidu funds the work, provides the infrastructure and maintains the taxonomy. Records are built automatically from public reporting and, so far, none of them has been reviewed by an editor. Each record says whether it has been reviewed, and only a reviewed record names its reviewer. Inclusion and classification follow the published methodology.