A More detailed audio podcast is also available here:
Kannada Discussion:
The above podcasts are explainers of the blog post but would be useful for a deep dive. Kindly go through and let me know your comments.
These are produced using AI . However base content is from me and the audios/videos have been reviewed manually. Hence use of AI is only to assist me. AI is only a software tool in this context.
Naavi
The Karnataka High Court, in an important judgment delivered on July 2, 2026, has reminded organizations that employment disputes should not be converted into criminal prosecutions without adequate legal foundation.
(See: Indian Express : Medicaldiologues : Court Proceedings in YouTube)
In a judgment delivered by Honourable Justice M. Nagaprasanna, the Court strongly criticized the decision of Manipal Hospital to pursue criminal proceedings against a distinguished oncologist who had served the institution for nearly nineteen years before moving to Aster Hospital in a higher position.
While the judgment provides relief to an individual doctor, its significance extends much beyond the parties to the dispute. It highlights an often-overlooked reality of the digital era—that employment records are no longer mere HR documents. They are electronic records capable of becoming crucial legal evidence.
According to the complaint filed by Manipal Hospital, the doctor resigned from service in 2022 after nearly two decades of association and was formally relieved with appreciation.
About three months later, Manipal Hospital reportedly received, through e-mail from the background verification agency DataFlow, a copy of an experience certificate purporting to have been issued by the Hospital and bearing what was alleged to be the signature of one of its officials.
The Hospital considered the signature to be forged and initiated criminal proceedings by filing a private complaint.
The Police investigated the complaint and submitted a B-Report, indicating that no criminal offence appeared to have been made out. Dissatisfied with this conclusion, the complainant filed a protest petition, following which the Magistrate took cognizance and issued summons to the doctor.
The doctor challenged these proceedings before the Karnataka High Court.
Quashing the proceedings, the High Court observed:
“Such cases should not be even permitted to be tried; the concerned court has erred in taking cognizance of the offence against a doctor and issuing summons without even looking at the documents which were produced at the time when the B report was filed. Therefore, the further proceedings, if permitted to continue, would on the face of it be an abuse of process of law and result in miscarriage of justice.”
During the hearing, the Court also orally advised the Hospital:
“Allow doctors to treat patients. Do not drag them into your inter-hospital disputes.”
Equally noteworthy was the Court’s refusal to permit retaliatory proceedings for malicious prosecution. Thus, while protecting the doctor from an unwarranted criminal trial, the Court also discouraged unnecessary escalation of litigation.
This balanced approach deserves appreciation.
The facts of this case immediately reminded me of the well-known UPaid-Satyam controversy that surfaced nearly two decades ago.
UPaid had engaged Satyam Computer Services for software development that later became the subject matter of patent litigation involving Qualcomm and Verizon. During the proceedings, intellectual property assignment documents allegedly signed by software developers assumed great significance.
Two former Satyam employees, who had by then joined Qualcomm and Verizon respectively, denied that the signatures appearing on the assignment documents were theirs.
At that time, Business Standard reported:
“UPaid had filed this case against Satyam in 2007. Satyam had done a project between 1997 and 2002 for which it got $10 million, partly in shares due to UPaid’s inability to pay cash. When UPaid wished to patent the technology, Satyam needed to provide signatures of the people who worked on the technology. Though the company gave UPaid the signatures, some of these employees had moved out.
When UPaid received the patent, it filed a suit against Verizon Wireless and Qualcomm in 2005, as they were using the company’s patented technology. However, one of the former Satyam employees had moved out of the company and joined Verizon. He said the signature was not his.”
The litigation ultimately culminated in a settlement reportedly involving nearly USD 70 million.
Whether or not the disputed signatures were actually forged was less important than the governance lesson that emerged. Employment-related documentation, once produced before a Court, assumes enormous evidentiary significance. A document casually prepared today may become the deciding factor in litigation years later.
The High Court was rightly concerned with the sustainability of the criminal proceedings against the doctor. However, from a governance perspective, another question deserves academic consideration.
How did the disputed experience certificate originate?
If the investigation had proceeded from the standpoint of document governance, several questions might naturally have arisen:
These questions are raised purely for academic discussion. There is no material presently available in the public domain to suggest wrongdoing by the background verification agency or any other participant.
The purpose of raising these questions is only to demonstrate how forensic examination of electronic records would ordinarily proceed.
More than twenty-five years ago, the Information Technology Act, 2000 recognized the legal validity of electronic records. Today, the Digital Personal Data Protection Act, 2023 reminds organizations that employee records are also personal data requiring appropriate governance.
Yet many organizations continue to treat HR documentation as routine administrative paperwork. That approach is no longer adequate.
Experience certificates…
Relieving letters…
Employment verification responses…
Background verification reports…
Promotion letters…
Digitally signed approvals…
Every one of these documents is an electronic record capable of becoming evidence before a Court. Every one of them carries legal consequences.
From the standpoint of the Data Governance and Protection Standard of India (DGPSI), this case demonstrates why HR documentation deserves the same governance standards applied to financial records.
Organizations should implement documented controls covering:
Many cyber incidents are not failures of technology. They are failures of governance.Technology merely exposes them.
Hospitals are unlike ordinary commercial enterprises. They occupy a fiduciary position in society because they deal with human life itself.
Professional differences between hospitals, doctors, recruiters and verification agencies should therefore be handled with restraint unless supported by compelling evidence of criminal misconduct.
The Court’s observations are therefore a timely reminder that criminal law should never become an instrument for resolving competitive employment disputes.
This judgment offers several practical lessons for every organization.
First, every HR document should be treated as a legally significant electronic record.
Secondly, background verification processes should be governed by documented procedures identifying who may issue responses, how authenticity is verified and how audit trails are preserved.
Thirdly, organizations should progressively replace scanned signatures with stronger authentication mechanisms such as digital signatures, secure verification portals or verifiable electronic credentials.
Fourthly, Cyber Law awareness should extend beyond IT departments. HR personnel, recruiters, administrators and vendor managers routinely handle electronic records that may later become legal evidence.
Finally, Data Protection Officers, Chief Information Security Officers and HR Heads should work together. Employee records constitute personal data under the Digital Personal Data Protection Act and require governance over their integrity, confidentiality, authenticity and lawful disclosure.
The importance of this judgment lies not merely in protecting one doctor from an unwarranted criminal trial. Its enduring value lies in reminding organizations that governance begins long before litigation.
Every experience certificate, relieving letter, employment verification response or digitally exchanged HR document becomes part of an organization’s trust architecture.
When questioned before a Court, the issue is no longer whether the document originated in the HR Department. The question is whether the organization can demonstrate its authenticity, integrity, provenance and accountability.
If the answer is uncertain, the governance process—not merely the document—requires strengthening.
That, in my view, is the enduring lesson emerging from the Karnataka High Court’s judgment.
Every HR document is also a Cyber Law document.
Naavi
In February 2025, Naavi.org first discussed the concept of a “Super Data Fiduciary” in the context of the hospitality industry such as property sharing. In February 2026, we also discussed the concept in the context of Education Industry”. In this article we have taken the example of the Hospital industry and discussed how this concept is relevant.
One of the notable strengths of the Digital Personal Data Protection Act, 2023 (DPDPA) is its principle-based drafting. Instead of prescribing rigid organizational structures, the Act defines broad responsibilities and leaves organizations the flexibility to implement governance mechanisms appropriate to their business models.
This flexibility is particularly valuable because the architecture of modern enterprises has evolved far beyond the traditional “one company–one business–one customer relationship” model.
Today, organizations increasingly operate as enterprise ecosystems. A single trusted brand may represent dozens—or even hundreds—of legally independent entities connected through ownership, management agreements, franchise arrangements, joint ventures, shared digital platforms, centralized AI systems, and common governance structures.
To the customer, the enterprise appears to be one organization. To the Companies Act, it is many. This divergence creates one of the most significant governance challenges in implementing DPDPA.
The Data Governance and Protection Standard of India (DGPSI) addresses this challenge by introducing a governance concept known as the Super Data Fiduciary.
It is important to clarify at the outset that the Super Data Fiduciary is not a new statutory category created by DPDPA. Nor should it be confused with the Significant Data Fiduciary (SDF) notified by the Central Government under Section 10 of the Act.
Rather, it is a governance designation created within the DGPSI family of sector-specific compliance frameworks to establish enterprise-level accountability wherever multiple autonomous Data Fiduciaries operate under a common identity.
DPDPA recognizes two principal operational actors:
A Data Fiduciary determines the purpose and means of processing personal data.
This model functions effectively where a single legal entity independently manages its processing activities. However, contemporary business organizations rarely fit this model. The digital economy increasingly consists of networks of legally distinct entities that collectively deliver a seamless customer experience.
The legal model remains fragmented. The customer experience is unified.
Consider a nationally recognized healthcare brand such as Apollo Hospitals.
Apollo serves as an excellent illustration—not because it is unique, but because it reflects a governance model that is becoming common across industries.
Today, the Apollo ecosystem includes entities operating under a variety of legal arrangements:
Many of these may be separate legal entities.
Yet no patient walks into a hospital asking,
“Which incorporated company owns this facility?”
The patient simply says,
“I am going to Apollo.”
The trust relationship exists with the brand. The privacy expectation also exists with the brand. The Data Principal neither knows nor reasonably expects to know the legal complexity behind the enterprise.
Consider a common situation.
A patient undergoes treatment at one Apollo hospital. Several months later, the patient visits another Apollo hospital in a different city. The doctor accesses earlier medical records.
From the patient’s perspective, this continuity of care is expected. However, several governance questions immediately arise.
The answers are no longer confined to one organization.
Modern healthcare is supported by interconnected digital infrastructure.
# Appointments may be booked centrally. Electronic Medical Records may be maintained on enterprise cloud platforms.
# Diagnostic laboratories may be located elsewhere.
# AI systems may analyse radiology images.
# Telemedicine consultations may be delivered from another city.
# Billing may be centralized.
# Patient relationship management may be managed by another company.
# Each participating entity processes personal data.
# Some determine purposes. Some determine means. Some merely process on behalf of others. Others establish governance policies affecting every participant.
The traditional distinction between Data Fiduciary and Data Processor is therefore insufficient to explain enterprise accountability.
Large enterprise ecosystems almost always contain an organization that performs functions extending beyond any individual operating company.
This organization may:
Although it may not directly provide healthcare, retail services, education, hospitality, or banking, it exercises substantial influence over how personal data is governed throughout the ecosystem.
DGPSI identifies this governance layer as the Super Data Fiduciary.
Within DGPSI, a Super Data Fiduciary is an enterprise-level governance entity that exercises strategic oversight, standardization, and accountability across multiple autonomous Data Fiduciaries operating under a common brand, platform, or governance structure.
The Super Data Fiduciary does not replace individual Data Fiduciaries.
Nor does it dilute their statutory responsibilities.
Instead, it provides enterprise governance wherever multiple organizations collectively create a unified customer experience.
The model introduces layered accountability rather than centralized liability.
Under the DGPSI model, accountability exists at two distinct levels.
Each hospital, college, retail outlet, hotel, or financial institution remains responsible for:
The enterprise governance layer becomes responsible for:
The two responsibilities complement each other. One is operational. The other is strategic.
One of the principal objectives of DGPSI-Hospital is to translate the broad principles of DPDPA into governance practices appropriate for healthcare institutions.
Healthcare differs fundamentally from many other sectors because data is inseparable from patient safety. Clinical information supports diagnosis, treatment, emergency intervention, medication management, continuity of care, and increasingly, AI-assisted healthcare delivery.
In healthcare, therefore, Data is Life.
DGPSI-Hospital recognizes that while individual hospitals remain statutory Data Fiduciaries, enterprise-wide governance frequently resides with the organization controlling the healthcare ecosystem.
Accordingly, DGPSI-Hospital designates that enterprise governance entity as the Super Data Fiduciary.
The Super Data Fiduciary establishes:
Every participating hospital continues to remain independently responsible for complying with DPDPA. The Super Data Fiduciary simply provides coordinated governance across the enterprise.
This approach does not require any amendment to DPDPA. It merely implements good governance within the flexibility already available under the Act.
Although healthcare provides perhaps the clearest illustration, the governance challenge exists across numerous sectors.
International hotel brands frequently combine owned hotels, managed properties, franchise hotels, centralized reservation platforms, loyalty programmes, and common customer databases.
Large retail chains operate through company-owned stores, franchise outlets, warehouses, logistics companies, e-commerce platforms, and centralized CRM systems.
University systems often include autonomous colleges, online learning platforms, research centres, examination authorities, alumni organizations, and international campuses functioning under one institutional identity.
Banking groups commonly consist of banks, NBFCs, insurance companies, payment service providers, mutual funds, wealth management entities, and technology subsidiaries sharing customer onboarding, KYC infrastructure, fraud monitoring, and analytics.
Airline groups operate code-share arrangements, loyalty programmes, reservation systems, airport services, cargo operations, and alliance partnerships while presenting a unified customer experience.
Marketplace ecosystems integrate merchants, logistics providers, payment gateways, customer service centres, advertising platforms, and recommendation engines.
Digital platform companies increasingly operate cloud services, messaging platforms, identity systems, AI assistants, payment services, and advertising ecosystems through multiple corporate entities under one trusted brand.
In every one of these sectors, the customer trusts the brand rather than the underlying legal entities.
Law evolves more slowly than technology. Waiting for legislative amendments whenever new organizational models emerge would impede innovation and delay effective compliance. Sector-specific compliance frameworks therefore perform an important jurisprudential function.
The DGPSI family—including DGPSI-Hospital, DGPSI-Bank/BFSI, DGPSI-Education, DGPSI-Retail, DGPSI-Hospitality, and future sectoral variants—provides governance mechanisms that address operational realities while remaining faithful to the existing provisions of DPDPA.
The concept of the Super Data Fiduciary is one such governance innovation.
It enables organizations to demonstrate enterprise-wide accountability without altering the statutory responsibilities of individual Data Fiduciaries.
Rather than waiting for Parliament to recognize every emerging organizational model, governance frameworks can evolve first. Over time, judicial interpretation, regulatory guidance, industry practice, and legislative refinement may adopt these concepts where they prove effective.
This is how jurisprudence develops.
The future of data governance will not be defined solely by individual organizations.
It will increasingly be shaped by enterprise ecosystems—networks of legally independent entities operating under common brands, shared technologies, integrated AI platforms, and unified governance structures.
DPDPA provides the legal foundation for protecting personal data. Frameworks such as DGPSI build upon that foundation by translating statutory principles into governance models suited to specific sectors and operational realities.
The Super Data Fiduciary is one such model.
It preserves the statutory autonomy and accountability of every Data Fiduciary while recognizing that enterprise-wide governance often resides at a higher organizational level. By introducing layered accountability, DGPSI aligns legal compliance with the expectations of Data Principals, who place their trust not in corporate charts but in the integrity of the enterprise they choose to engage with.
As India’s data protection jurisprudence matures, governance innovations of this nature will play an important role in ensuring that the law remains effective in an increasingly interconnected and AI-driven economy. The Super Data Fiduciary is not a departure from DPDPA; it is an evolution in its practical application—demonstrating how sound governance can anticipate tomorrow’s challenges while remaining firmly rooted in today’s law.
(..Comments are welcome)
Naavi
On July 1, Meity issued a notice to WhatsApp to hold back its proposal to introduce a new feature of providing an option to the users to register a user name. In the back end WhatsApp will have the mobile number but it will not be displayed. Similar notices have also been issued o Telegram and Signal according to the Hindu report.
The move will raise a backlash from “Privacy” activists who want the feature to “Hide” and send messages. Naavi.org is in support of this move as it is fully aware of the possible ways by which it can be misused to commit anti national activities besides cyber crimes. Meta itself will be a company which can support anti national activities and cannot be trusted.
At the same time, we have to however point out that Naavi.org has earlier brought to the public notice that changes are required in similar use cases in domain name registration and email registration. Today domain name registrar provide a facility to “Privacy Protect” the registrant’s details. The E-Mail Providers like G Mail provide proxy originating IP address and allow any name to be used for display. There are also proton mail type of service providers who thrive by providing identity cover in the name of Privacy.
We also have objection to the Current systems of SMS and E Mail also provide a facility for “No Reply” emails which is an open invitation for “Spam”. The TRAI has tried to introduce restrictions on the marketing messages but does not prevent “No-Reply” ads which is legally an unsustainable way of communication. Many times Banks and other organizations use this for sending a “Notice” with no “reply” option, making this a “Spam”.
Unless a principled stand is taken by the Government on all these aspects, the action against WhatsApp appear to be a selective action.
We therefore request the Government to simultaneously take action as follows.
Naavi
Also refer: Theory of Regulated Anonymity
We are now 314 days away from the full implementation of DPDPA 2023. From 13th May 2027, Banks like all other organizations will be facing the prospect of the inquiries from DPB on customer grievances related to “Data Access”, “Data Deletion”, “Processing without Permission” etc.
FDPPI has been providing assistance to organizations to be compliant with DPDPA by developing specific compliance framework under the umbrella of “DGPSI” or Data Governance and Protection Standard of India, Recently the DGPSI-Hospitals, a framework for hospitals was released and is now under Public discussion.
One of the key issues in the Banking segment is that personal data is collected and used at hundreds of branches while the data may sit in a central server and the DPO may be stationed in the head office without adequate oversight over the branch activities.
Additionally, use of data processors and AI has also increased and needs to be factored in. Many of the Banks also have exposure to RTI act and POSH act which also cannot be neglected.
RBI has its own regulations on cross border data transfer, data retention and AI usage.
Many of the Banks have been notified under Section 70 of ITA 2000 introducing separate obligations of information security.
Most Banks have hundreds of processes covering multiple products, services.
Hence compliance in a Banking environment is complicated and requires special attention.
Hopefully DGPSI-Banks try to address as many concerns as possible in the Banking sector so that before 13th May 2027, Banks can make substantial progress in the implementation of DPDPA.
Watch out for more discussions on this website while the framework takes shape.
Naavi
FDPPI has developed a DPDPA Compliance framework for hospitals named “DGPSI-Hospital”.
A public consultation will be held virtually next week to discuss the framework with interested persons in the public.
Watch out for the announcement of the time. and link.
Naavi
