On 6th June 2026, a one day induction program has been organized for newly empanelled Data Auditors.

This program is available only for empanelled auditors at www.aidai.org.in
On 6th June 2026, a one day induction program has been organized for newly empanelled Data Auditors.

This program is available only for empanelled auditors at www.aidai.org.in
Naavi today addressed a gathering of academicians and administrators on “Impact of DPDPA on Universities and Educational Institutions.
The essence of the talk has been captured in the following:
The audio version in English is fairly detailed and informative.(Following audio podcasts and Video was created using AI based on content of Naavi)
Audio: English: Kannada: Hindi
Video:
Naavi
The Supreme Court has provided a welcome clarification on the wrong interpretation of the Pune Bar Association of Section 63 of ITA 2000. The Bar Association had contended that the section required every Section 63 certificate to be required to be signed by an “Expert” under Section 79A of the Act and therefore was unconstitutional.
Naavi who is a pioneer in this field had rightly interpreted the erstwhile Section 65B of Indian Evidence Act and rightly interpreted that the Certificate either should contain the print out of the electronic document certified as part of the certificate as a visual object being certified or contain the hash value in case the evidence is an audio or a video. Some of the certificates issued by Cyber Evidence Archival Center (CEAC) were based on this principle.
The fact that such certificate issued by a private person like the undersigned was acceptable was first stated in the Suhas Katti Vs State of Tamil Nadu by the trial court and upheld by the session Court.
Subsequently in ITAA 2008, Section 79A was introduced and the role of “Digital Examiner of Evidence” was introduced . However we had interpreted this only as mandatory when the Court had to interpret two contradictory Section 65B reports. At the time of admissibility a certificate from a private person was considered sufficient and could be countered by another Section 65B certificate as a counter by another private expert.
When the Section 63 of BSA replaced Section 65B of IEA, the Government had introduced a confusion through ambiguous drafting.
Some interpreted that the Part B of Section 63 certificate had to be filled up by an Expert under Section 79A of the Act. This had also been supported by a Madras High Court judgement.
Now the Supreme Court bench consisting of CJI Surya Kant and Justice Joymala Bagchi has rightly interpreted that Section 63(4) certificate can be provided by “Experts” who may not be those certified under Section 79A of the ITA 2000 as “Digital Evidence Examiners”.
Naavi’s Interpretation which is consistent with the judgement is that an “Expert” referred to under Section 63(4) should be a person who is technically capable of interpreting the digital document being certified. It is not necessary that he should be a “Cyber Forensic Expert” as some may interpret and that such “Cyber Forensic Expertise” comes from a “University Degree” or similar formal qualification.
A Digital Document seen on a digital instrument using a specific method of viewing and captured in a manner that represents a truthful representation of the visual is like a photographer who captures an image using a camera and submits the output without manipulating the digital copy. The Certificate confirms the method of capture in such a way that any other person with reasonable expertise can repeat the process and should obtain a similar result subject to the document having not been altered subsequent to the certification.
Where disputes arise are instances where an expert has certified a document which is modified by the person in charge or re-created using a different method (say a different browser, using different filters etc., which could alter the rendition) and there after certified by another expert in good faith. In such a case two versions of the same document may exist both being certified by experts in good faith but carrying different versions. In such cases the Courts may have to call in a Section 79A expert to satisfy itself which version has to be relied upon for the specific context.
If any of the Certifying expert has not acted with due diligence, it is his negligence which can even be argued as complicity to produce false evidence. If he has acted in good faith, there may be no error on his part and whoever had altered the document could be charged of tampering with evidence.
One specific disclaimer which Naavi advises certifiers to use now is to declare that “The process used to capture the document did not use technology such as AI which could affect the integrity of observation”.
A probable rendition of the disclaimer may state,
“To the best of my knowledge, the process adopted for capture, preservation and certification of the electronic record did not employ any generative AI, synthetic reconstruction, automated enhancement, interpolation or similar technology that could materially alter the observed content”
We welcome the Supreme Court verdict which clarifies the position.
(Watch out for a more detailed post in due course)
Naavi
Also Refer:
Section 63..Naavi’s Perspective
NotebookLM overview: Video : Audio-English : Audio-Kannada : Audio-Tamil : Audio-Hindi
Albania Government led AI in Governance when Prime Minister Edi Rama appointed an Virtual AI minister Diella as a formally appointed “Minister of State for Artificial Intelligence” and its 83 yet to be born children-robots as additional ministers. After Saudi Arabia which gave citizenship to a humanoid Robot, Sophia and a Polish beverage company appointed MIKA as a CEO , there is a thought that India should also attempt reducing its huge Government expenditure by replacing the Government employees substantially with AI agents.
I hope Mr Narendra Modi takes a look at this proposal.
It is noted that the Ministry of Information Technology (MeitY) may be favourably inclined to the proposal since one of its “officials” has suggested private sector companies that they should have an enterprise AI appointed as a AI-DPO to manage the compliance of DPDPA. Some Cyber Security specialists seem to agree with this possibility. (See the ET Article here).
It is time to consider putting this suggestion into practice by appointing an “Additional Secretary” to the MeitY to manage the responsibilities for DPDPA Compliance.
Under the Seventh Schedule of the DPDPA Rules, associated with Rule 23, the Government is expected to appoint an officer of the Central Government in the MeitY as the Secretary in Charge for “Carrying out assessment for notifying any Data Fiduciary or class of Data Fiduciaries as Significant Data Fiduciary.”.
There is one thought that one “Corporate Official” has suggested that
MeitY may appoint an AI-Secretary for this purpose. This AI-Secretary can be an “Agentic AI” which can log into a company’s network, make a thorough analysis of the Company’s personal data collection and the risk profile presented by its activities and declare whether an organization is a “Significant Data Fiduciary” or not. Since this will be an assessment by the Government it will be binding on the Judiciary at a later day if this question comes up.
Alternatively if the MeitY is endorsing the JIO compliance Management system as an “Approved DPDPA Compliance Management System”, the same system may be configured to send a report to the MeitY initially on the status of an organization as an SDF and there after periodically report the operations of the organization to the DPB or the MeitY.
Once this project succeeds, all Government departments can replace atleast 50% of their Secretaries with AI and another 75% of the employees with AI Children like the Albanian initiative.”
It is needless to say neither Naavi nor Naavi.org considers this as a desirable proposition.
Naavi has in fact suggested under DGPSI-AI framework that for every AI application there must be a designated “Human Handler” to take the responsibility for the activities and decisions taken by the AI.
However in the interest of “Free Speech” and “Freedom of Press of Naavi.org”, the proposition of the “Corporate Official”, we have published the proposal. We are also committed in the spirit of “Confidentiality” of the personal information to keep the identity of this corporate official undisclosed.
We are not also not commenting on whether this “Corporate Official” is a human or a Cyborg or a humanoid Robot like Mika or Sophia or an AI chat bot like Diella.
Request readers to be sensitive to this issue and not ask for the identity of this “Official”.
But we invite public comments on this thought which we consider is relevant in the current state of thinking of MeitY.
Naavi
Professionals are like lotus in the Pond. Everybody want to raise. In the process some want to raise above others and enter into a competing mode. What we need to appreciate is that the Lotus will raise even when the water itself raises, though every body else also raise with us.
This is the principle with which the Association of Internal Data Auditors (AIDAI) wishes to develop.
Independent Data Auditor is the statutory auditor designated under Section 10 of DPDPA to “evaluate the compliance of the Significant Data Fiduciary in accordance with the provisions of this Act”.
This is a new profession created by DPDPA 2023 and is different from the IS audit or other kinds of audits involving “Data” for different purposes. For example an Advocate audits contracts of an organization to check if all vendors are properly bound by contract for Data Protection. A Chartered Accountant checks data to audit the financial transactions or a potential fraud. A Cost accountant checks data to evaluate the cost of creation and holding or pricing for sale. A Company secretary evaluated compliance of an organization to different provisions of the Companies Act.
All of them are well equipped to be “Data Auditor as envisaged under DPDPA 2023”.
FDPPI envisages that the future set of “Data Auditors” is not limited to “Privacy Auditors” who might have acquired a qualification as a “Certified DPO” or equivalent. It is a huge lake of professionals from multiple professions focussing on one goal…”Make India DPDPA Compliant”.
AIDAI or the Association of Independent Data Auditors a part of FDPPI aims to bring together all these professionals into a single forum.
Today at 11.00 am, a brief interaction has been arranged to discuss the role of an Independent Auditor in India and how AIDAI proposes to go about this work.
Naavi
Principle to note: ಜಲವೃದ್ಧ್ಯಾ ವರ್ಧತೇ ಪದ್ಮಂ (Jala Vridhya, vardhate Padmam)