If you are stuck in such a situation, here is what to do.

Mr. Alok Verma, a resident of Jaipur, found himself inundated with unsolicited calls from various stock recommendation companies over several months. During one such call, he was surprised when the caller knew that his demat account was active, even after he stated he wasn’t involved in the stock market. Upon inquiring, the caller, and subsequently several others from different firms, revealed they had obtained his contact information from a financial news portal called “MarketPulse.”

What baffled Mr. Verma was that he had never registered for an account or subscribed to any services offered by MarketPulse. This raised serious questions about how they acquired his mobile number and personal financial details. Furthermore, it appeared they were sharing this sensitive information with third-party advisory firms without his consent. His attempts to seek clarification from MarketPulse via email went unanswered. Both his depository participant, “CapitalUp,” and the central depository assured him that they have strict policies against sharing or selling customer data, leaving the source of the breach a mystery.

Despite activating the Do Not Disturb (DND) service on his mobile, the calls persisted. These were not random telemarketing calls; the callers knew his name, his mobile number, and his demat account status. The situation escalated as some callers became aggressive and rude when he tried to end the conversations. Mr. Verma felt his digital privacy was severely violated and was looking for a way to stop the daily harassment.

Advice in such cases

If you find yourself in a similar situation, it is crucial to take systematic steps to protect your privacy and stop the harassment.

• Document Everything: Keep a detailed log of all unsolicited calls. Note down the date, time, phone number, and the name of the company they claim to represent. If possible and legal in your jurisdiction, record the conversations as evidence.
• Send a Formal Complaint: Draft and send a formal complaint via email or registered post to the company that allegedly leaked your data (in this case, MarketPulse) and the companies that are calling you. Clearly state that they are processing your data without consent and demand they cease immediately.
• File a Complaint with TRAI: Since DND is not effective, you can file a complaint with the Telecom Regulatory Authority of India (TRAI) for unsolicited commercial communications. You can do this via SMS to 1909 or through the TRAI DND app.
• Lodge a Complaint with SEBI: As the calls are related to stock advisory, you can file a complaint with the Securities and Exchange Board of India (SEBI) through their SCORES (SEBI Complaints Redress System) portal. Many such callers are unregistered advisors, which is a violation of SEBI regulations.
• Send a Legal Notice: Through a lawyer, send a legal notice to the entities involved, demanding they stop contacting you and delete your personal data. This formal step often yields quicker results.
• Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

Applicable Sections of Law

Understanding the legal framework is essential for taking the right course of action. The following laws are pertinent to such cases in India:

• The Digital Personal Data Protection Act, 2023 (DPDPA): This is the primary legislation governing data privacy. Under the DPDPA, your personal data can only be processed for a lawful purpose and with your explicit consent. Sharing your data without consent is a significant breach, and the entity responsible (the “Data Fiduciary”) can face substantial penalties.
• Bharatiya Nyaya Sanhita, 2023 (BNS): If the callers are abusive, threatening, or harassing, their actions may fall under the purview of the BNS. Provisions related to criminal intimidation or stalking could be applicable, allowing you to file a police complaint.
• SEBI (Investment Advisers) Regulations, 2013: These regulations mandate that anyone providing investment advice must be registered with SEBI. Unsolicited calls offering stock tips often come from unregistered entities, which is a regulatory violation.

If you are the complainant

As the person filing the complaint, your role is to be proactive and organized.

• Gather All Evidence: Systematically collect all pieces of evidence. This includes call logs, recordings, SMS messages, emails, and any other communication.
• Draft a Detailed Complaint: Write a clear and concise complaint detailing the entire sequence of events. Mention the names of the companies, the information they possessed, and the harassment you faced.
• File with Multiple Authorities: Do not rely on a single authority. File your complaint with the police (specifically the Cyber Crime Cell), TRAI, and SEBI to cover all bases—criminal, regulatory, and telecom.
• Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

If you are the victim

When you are targeted in this manner, immediate defensive actions are necessary.

• Do Not Engage or Share Information: Never confirm your personal details or provide any additional information to the callers. Do not engage in arguments.
• Block and Report: Immediately block the numbers from which you are receiving these calls. Report the numbers as spam through your phone’s features and to your telecom service provider.
• Secure Your Accounts: Review the security settings on your demat, trading, and other financial accounts. Change passwords and enable two-factor authentication if you haven’t already.
• Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

How the police behave in such cases

With the rise of digital crimes, police departments, particularly their Cyber Crime Cells, have become more adept at handling such complaints. When you approach them, they will typically ask you to submit a written complaint along with all the evidence you have gathered. They can use technical means to trace the phone numbers, even if they are from different states, and identify the individuals or companies behind them. The investigation may involve coordinating with telecom service providers and other agencies. While the process can sometimes be slow, a formal police complaint creates an official record and puts legal pressure on the perpetrators.

FAQs people normally have

Can I sue the company that leaked my data for compensation?
Yes, under the Digital Personal Data Protection Act, 2023, you have the right to seek compensation for damages caused by a data breach. You can file a complaint with the Data Protection Board of India once it is fully operational, or pursue a civil suit.

What if the callers are using fake company names?
This is a common tactic. The police’s Cyber Crime Cell has the tools to trace the origin of the calls through the mobile numbers used. Even if the company name is fake, the individuals behind the calls can be tracked and held accountable.

Will these calls ever stop?
Taking consistent and multi-pronged action—reporting to TRAI, SEBI, and the police, and sending a legal notice—significantly increases the chances of stopping the calls. It sends a clear message that you are aware of your rights and are willing to enforce them.

What evidence is required?

Strong evidence is the backbone of any successful complaint. You should collect:

• Call Logs: Screenshots of your phone’s call history showing the numbers, dates, and times of the calls.
• Call Recordings: If legally permissible, recordings of the conversations where callers mention your personal details or the source of the data.
• Messages: Any SMS or WhatsApp messages received from these entities.
• Emails: Copies of any email communication between you and the companies involved.
• Details of Complaints: A record of the complaint numbers or acknowledgments you receive after filing complaints with TRAI, SEBI, or the police.

How long will the investigation take?

The duration of an investigation can vary widely. A simple case where the company is identifiable and cooperative might be resolved in a few weeks. However, if the perpetrators are using complex methods to hide their identity or are operating from different jurisdictions, it could take several months. The timeline depends on factors like the workload of the investigating agency, the cooperation of telecom companies, and the complexity of the digital trail.

Advocate Sudhir Rao, Supreme Court of India