IDPS 2026 Delegates Registration..Rush before October 25

Link for Registration

The flagship program of FDPPI for 2026 namely the IDPS 2026 is scheduled for November 21 in Bangalore at Hotel Fairfield Marriott, Rajaji nagar, Bengaluru.

The program will be a day long event from 9.30 am to 5.00 pm. The Chief Guests subject to confirmation include a sitting Judge of the High Court of Karnataka, a Chairman of a Bank, and an industrialist from a large group in Mumbai. More than 30 speakers are expected to participate.

The topics which will be discussed include

1.Data Valuation and Data Inventory under SSOT principle

2. DPDPA Compliance in Banks

3. The challenge of AI and the AI Governance framework.

 4. Concept of Data Audit in a multi branch operating scenario

5. Guidelines of Supreme Court on AI

6. Audit Exchange Platform of AIDAI

7. Data Governance Framework and Model Governance Framework of RBI

8. Relevance of Patient Safety Officers in DPDPA Compliance of Hospitals

9. Relevance of Branch Managers in DPDPA Compliacne of Banks

…and other related issues.

In the available time, it is proposed to have 3/4 key note addresses and 4/5 panel discussions.

Detailed program is under finalization.

Since the program is being conducted in a hotel the number of delegates would be limited. 80 % of the delegates seats are being booked now keeping 20% for FDPPI members and guests. Bookings will be accepted on first cum first served basis and earl bird discount is available till October 25 2026.

The registration is expected to close during the first week of November 2026.

Request all patrons of Naavi.org to rush with their registrations. Cyber Law College offers all  registrants upto November 1 a special offer of a copy of the book “Wisdom Companion for DPDPA Champions” to be handed over during the conference.

Naavi

Posted in Privacy | Leave a comment

Next Gen DPDPA Requirements: Creating an armyy of DPDPA Trainers

FDPPI has been the leader in the DPDPA domain and has been taking leadership in directing the community towards the requirements of a Post DPDPA eco system.

FDPPI started with conducting Certification programs for professionals to build the capabilities for DPOs in the DPDPA domain, for those who were earlier only aware of GDPR.  Then FDPPI went into providing consultancy to organizations for DPDPA compliance. The drive to compliance was supported with the development of compliacne framework under DGPSI.

Following this, FDPPI realised that post 13th May 2027 there would be a need for Data Auditors and started working on this domain by first creating the AIDAI (Association of Independent Data Auditors of India) and then the code of conduct including AIDAI-DA-SOP 600 to enable collaboration of auditors. The Certification trainging were extended to CIDA (Certified Independent Data Auditors).

At every point when the industry needed a direction, FDPPI was in the forefront and was the pioneer in charting out a path to the goal.

Now one more requirement has surfaced in the industry and it is to find enough capable persons who can undertake the trainings in different organizations on DPDPA.

Training, Consultancy for Implementation and Audit are all inter related activities and professionals often graduate from the DPDPA Trainer to, DPDPA consultant to DPO to Auditor over a period of time.

Currently a large requirement of training has been identified in India and FDPPI is responding to the need by creating a training for Trainers.

Professionals may watch out for the next set of activities in this direction. Interested persons are contacting FDPPI to be part of this training program. Necessary announcements will be mde in these pages soon.

Naavi

 

Posted in Privacy | Leave a comment

MeitY Advisory on Meta: Internet Freedom Foundation raises objection

The Internet Freedom Foundation (IFF) has called for the withdrawal of MeitY’s advisory dated 10 October 2026 to Meta Platforms, which raises serious concerns about restrictions on protest-related reporting on Instagram and Facebook.

Refer here

The advisory reportedly asks Meta to review its content-ranking and recommendation mechanisms to prevent disproportionate exposure to particular narratives. Its timing, coinciding with protests and restrictions on journalists’ and media organisations’ social media accounts, raises concerns about potential censorship and the suppression of legitimate public-interest reporting.

Government action affecting online expression must have a clear legal basis, follow due process, and be open to public scrutiny. Executive advisories should not become instruments for controlling the narratives citizens can access, particularly during public protests.

IFF has demanded that MeitY withdraw and publish its advisories, and that Meta disclose restrictions imposed in response to them, restoring affected accounts and content where no valid legal order exists.

Naavi.org will continue to examine developments at the intersection of digital rights, intermediary accountability and India’s evolving technology law framework.

However we urge media to remember that security of the nation is paramount and anybody who assists the current agitation meant for “regime Change through Violence and Non democratic means” is assisting the people who want to adversly affect the national Security. Hence such reports donot get protection under the Indian Constitution.

Whether the advisory comes from the Home Ministry or from MeitY, it is necessary and we support the same.

We believe that “Freedom” is a “Responsibility” and what we are now seeing on the Delhi streets represent an irresponsible and immature movement which is undemocratic. I request that organizations like IFF kind of organizations should show maturity on when to support opposition to Government and when not to. There is a space between supporting the Government and Urban Naxals which can be neutral and issue based opposition. Educated professionals in the society should try to occupy such neutral position and not lean towards the anarchic tendencies of a few.

Naavi

Posted in Privacy | Leave a comment

Digital Society Day 2026

Today is 17th October. The day when  Information Technology Act 2000 was notified in the year 2000. It was the day from which electronic documents were first recognized under Indian law along with Digital Signature and Digital Contract. Naavi.org has been recognizing this day as the day when the Digital Society was born in India.

In the current times when we are discussing DPDPA, ITA 2000 still remains the mother law for any digital activities in India. Without the recognition of “Digital Documents”, “Digital personal data” does not exist. Without the authentication under section 3/3A of ITA 2000, an electronic consent does not get judicial validity. DPDPA purposefully left the personal remedy for persnal data breach under DPDPA to be covered under Section 43 of ITA 2000 while pullingout only Section 43A for being replaced with the 44 section DPDPA.

Sections 66B,66C,66D,66E,68 all get new meanings under DPDPA because of ITA 2000.

Most importantly Section 11 of ITA 2000 provides human accountability to AI bringing AI into the legal regime.

In several previous years, Naavi has organized major events to mark the occassion. Today with so much of activity around DPDPA, it was not possible to specially recognize the day with any public activity.

Let us howeer remember today as the day that created the future of DIGITAL INDIA.

Naavi

An audio overview:

Posted in Privacy | Leave a comment

Review of the IDBI Bank acquisition vs CIBIL acquisition

An Audio overview

 

Posted in Privacy | Leave a comment

TransUnion-CIBIL share deal vs Fairfax-IDBI Bank share deal

Some commentators have been drawing loose parallels between the proposed Fairfax acquisition of IDBI Bank and the transfer of control of CIBIL to TransUnion between 2014 and 2017. This note is meant to set the record straight on why the two are not comparable.

The IDBI Bank deal

Fairfax Financial Holdings has reportedly been selected to acquire a 60.72% controlling stake in IDBI Bank at ₹81 per share. The stake comes from the Government (30.48%) and LIC (30.24%), for a total of about ₹53,000 crore. The deal has been cleared by the Cabinet Committee but will also need RBI’s fit-and-proper clearance and CCI approval, and Fairfax must make an open offer to public shareholders.

IDBI Bank is a listed company with a market price, and the transaction is a negotiated sale of shares. Above all, the buyer takes on the responsibility of running a bank. If it fails to run the bank well, it risks its ₹53,000 crore. This is not a sale of data. It is a transfer of responsibility for running a regulated business.

Why CIBIL was different

CIBIL was an information company, and almost all of its value lay in its data. That data was the credit history of hundreds of millions of Indians, contributed by every bank and lender in the country. Unlike IDBI Bank, CIBIL was unlisted, so there was no market price to check the deal against. Buying control of CIBIL was, in substance, buying control of India’s most important credit-information database and the commercial benefits that come with it.

Both deals involve personal data. The difference is that IDBI Bank holds its own customers’ data as one bank among many. CIBIL holds pooled credit information from the entire lending system, under the special regime of the Credit Information Companies (Regulation) Act, 2005.

How TransUnion acquired control of CIBIL

November 2000 – Formation. On 10 November 2000, the Government permitted SBI to take equity in a new credit bureau in collaboration with HDFC, Dun & Bradstreet and TransUnion International. SBI and HDFC held 40% each, and D&B and TransUnion 10% each. RBI later directed SBI and HDFC to spread their holdings across other banks and institutions, so that no shareholder held more than 10%. TransUnion has been CIBIL’s technology and analytics partner since 2001.

Up to early 2014 – TransUnion at 27.5%. Before the 2014 sales, TransUnion held 27.5%. SBI and ICICI Bank held 10% each. Bank of Baroda, Bank of India, PNB, Union Bank, Citicorp Finance, HSBC, Standard Chartered, IOB, HDFC and Central Bank of India held 5% each, and Sundaram Finance held 2.5%.

March to May 2014 – Crossing into control. Shortly before these sales, the Government raised the FDI cap for credit information companies from 49% to 74%. In March 2014, PNB and Central Bank of India sold their entire stakes to TransUnion, and by the end of that quarter TransUnion held 47.5%. On 20 and 21 May 2014, two further transactions took it to 55%. In all, six sellers were involved: Citicorp Finance, PNB, Central Bank of India, HDFC, Standard Chartered and Sundaram Finance. TransUnion paid about US$ 50.6 million in cash for this 27.5%, which gave it control of the company. At the then exchange rate, that implies a value of roughly ₹1,100 crore for the whole of CIBIL. TransUnion dates its control of CIBIL from 21 May 2014.

2014–2015 – Domestic investors at low valuations. Aditya Birla PE bought 4%. A year later, SBI sold 4% to India Alternatives and IIFL at a price that valued CIBIL at about ₹1,550 crore.

2016 – 100% FDI permitted. RBI permitted up to 100% FDI in credit information companies, subject to conditions. TransUnion then bought ICICI Bank’s 6% and Bank of Baroda’s 5%, taking its holding from 66.1% to 77.1%.

2017 – 92.1% and rebranding. TransUnion raised its stake to 92.1%, and the company became TransUnion CIBIL. That year Bank of India sold its 5% for ₹190.6 crore, which valued the whole company at about ₹3,800 crore.

What was the data worth?

Credit records cannot lawfully be sold one by one. CICRA limits who may receive credit information, and the DPDPA adds consent and purpose restrictions. Any per-record figure is therefore a way of sizing the asset, not a market price.

TransUnion CIBIL today holds credit files on about 600 million individuals and 32 million businesses, and serves over 7,000 institutions.

  • Lawful commercial value. Industry estimates suggest that lenders pay ₹300–1,500 for a pre-qualified lead with a good credit score. Such a customer may be worth ₹20,000–50,000 over their lifetime in interest margin and fees. These are indicative figures.
  • Black-market floor. Even stolen data has a price. A 2022 NordVPN study found the identities of Indians selling on bot markets at an average of about ₹490 each.

On these benchmarks, the database would be worth something like ₹18,000 crore (at ₹300 per record) to ₹29,000 crore (at ₹490 per record). Control of it changed hands at implied valuations of roughly ₹1,100 crore in 2014, ₹1,550 crore in 2015 and ₹3,800 crore in 2017. The database was smaller then than it is today, but the gap is still large enough to ask whether the shares were sold well below their fair value. Unlike in the IDBI case, there was no market price against which anyone could check.

The timing

The regulatory change that allowed TransUnion to cross 49%, and the share purchases that followed, all happened while Shri P. Chidambaram was Finance Minister (August 2012 – May 2014) and Dr. Raghuram Rajan was RBI Governor. The election results were declared on 16 May 2014. TransUnion completed its majority acquisition on 20–21 May, and the new Government was sworn in on 26 May. Control of India’s largest credit bureau thus passed to a foreign company in the final days of the outgoing Government.

The undersigned had raised objections to this deal at the time and called for an investigation, but none has been ordered. Now some are accusing the present Finance Minister of corruption in the Fairfax deal.

Conclusion

In our considered view, the two deals are different in kind. The CIBIL transaction transferred control of a national credit-data asset in an unlisted company, without public price discovery. The IDBI transaction is a negotiated sale of shares in a listed bank, in which the buyer must run the business and answer to the regulator. If any deal deserves a closer look, it is the first.

Naavi

Also read: Is TransUnion-CIBIL guilty of Accessing Critical Personal Data through surreptitious means?

References sourced through Web search and AI.

 

Posted in Privacy | Leave a comment