Naavi.org

Yes this is a call to induce the FOMO feeling. Some may think I am unethical in invoking the FOMO feeling. But when some thing unique is happening and a deserving person is likely to miss out due to ignorance, it is necessary to take some efforts to ensure that decisions are based on proper information.

The virtual program on August 16 at 10.00 am ( and going upto at least 1.00 pm) is considered a “Curtain Raiser” for the 3 day program on August 21-23 happening at Fairfield Marriott in Bangalore.

Simultaneously it is meant to bridge the knowledge gap for the participants compared to those who have gone through the stage by stage training of FDPPI from CDPP-I, CDPP-G and C.DPO.DA.

Those who went through these modules had the privilege of understanding DPDPA Act, Rules, ITA 2000, GDPR etc before they plunged into C.DPO.DA. which was a common program both for the employment aspirants who wanted to be DPOs and consultants who wanted to be DPDPA auditors.

Since the immediate requirement was for implementation the need for DPOs was more urgent. The time for Independent Data Auditors is after 13th May 2027 and we are now getting ready to understand this new profession. Just as we have been advocating that Companies should start their compliance exercise without waiting for 13th May 2027 since it is a journey that requires time, the Independent Data Auditor activity is also a journey. We have started early talking about it and creating a development road map since it will take time for professionals in this space to blossom.

The program on August 21 will be the first CIDA program. Since some of the participants who are registered will be people who have not gone through the earlier programs on DPDPA and DPO conducted by FDPPI, it was considered our duty to conduct this curtain raiser program to bridge the knowledge gap that may exist. It will also be a refresher for those who have gone through the C.DPO.DA. program earlier.

Hence we are offering this program as complimentary to all those who are registered for the Aug 21 program.

Additionally, we are also offering entry to this program at a fee of Rs 3540/- to those who are not registered for the August 21 program either because they are still undecided or they want to just want to know what it would be like to be a DPO. If some body attends this program as a paid participant and later decides to attend the CIDA program, we will give them a rebate in the fees so that they will not feel that they paid more ..though they will receive more in return.

This kind of offer is unique to FDPPI and it may take time for the market to appreciate the intentions. Hence it is necessary to call out the FOMO feeling.

Let me briefly explain what we are likely to cover in the August 21-23 program.

Keeping the above in mind, we want to cover  Fundamentals of DPDPA and DPDPA rules and also the technical challenges faced by DPOs in the implementation such as Setting up a Governance system, Consent Management, Data Principal Rights Management, Data Breach Management, Security of DPD (DPDPA protected data) etc in the crash program on August 16.

We will not be able to repeat the basics of DPDPA and the DPO requirements when we discuss the audit requirements on Aug 21-23.

It is therefore useful for all participants to attend this e hour session to refresh their thoughts.

We are conducting this one week in advance so that during this week, the participants can go through some of the earlier library of reference videos that we will suggest and also the books , Guardians of Privacy, Wisdom companion, DGPSI and DGPSI-AI.

We hope you will not miss out this opportunity.

Naavi

Download Presentation

Register here : Complete the information form and make the payment.

As a prelude to the CIDA program on August 21,22 and 23, FDPPI will be conducting an introductory crash program on CEDPO to assist participants of CIDA program refresh the implementation aspects of DPDPA.

The program will be virtual and at 10.00 am.

For those who have not registered for CIDA, the same crash program would be made available at a fee of Rs 3000/- plus GST of Rs 540/-. Total Rs 3540/- They can register for this program here

This can be adjusted with the final registration  fee for CIDA.

After payment kindly send a confirmation with email to naavi. If you are filling up the registration form indicate your physical address (for GST purpose) and proper email.

For any other clarification, contact naavi

Naavi

One of the most overlooked aspects of the EU AI Act is not its classification of AI systems into prohibited, high-risk or limited-risk categories. Nor is it the much-discussed governance framework or conformity assessment process. Its most profound contribution lies elsewhere—in recognizing that Artificial Intelligence is capable of affecting not merely privacy, but the entire spectrum of fundamental human rights.

This recognition has led the European Union to introduce the concept of a Fundamental Rights Impact Assessment (FRIA).

For India, which is embarking on its own journey of AI governance while implementing the Digital Personal Data Protection Act, 2023 (DPDPA), this development deserves careful attention.

The Limitations of Data Protection

The DPDPA is a law governing the processing of digital personal data. It protects informational privacy and regulates the relationship between Data Fiduciaries, Data Processors and Data Principals.

However, AI systems have the potential to cause harms that extend well beyond data protection.

Consider a few examples.

• • An AI-based recruitment tool may discriminate against women or older candidates without processing any sensitive personal data unlawfully.
  • An AI-driven credit scoring system may deny financial opportunities to deserving individuals because of biased models.
  • An AI-supported medical diagnosis may jeopardize patient safety.
  • A predictive policing algorithm may affect liberty and equality.
  • A generative AI system may influence freedom of speech, democratic discourse or access to information.

In each of these situations, privacy may not be the principal concern.

The affected rights could include equality, dignity, fairness, consumer protection, access to justice, education, employment and several other constitutional guarantees.

This is precisely why a conventional Data Protection Impact Assessment (DPIA) is no longer sufficient.

What is the Fundamental Rights Impact Assessment?

The EU AI Act requires deployers of specified high-risk AI systems to evaluate how the deployment of AI may affect the fundamental rights guaranteed under the Charter of Fundamental Rights of the European Union.

Unlike a DPIA, which concentrates on risks arising from processing personal data, the FRIA evaluates the possible impact on a broad set of rights such as:

• • Human dignity
  • Equality before law
  • Non-discrimination
  • Privacy
  • Protection of personal data
  • Freedom of expression
  • Freedom of thought
  • Rights of children
  • Rights of persons with disabilities
  • Consumer protection
  • Workers’ rights
  • Right to education
  • Freedom to conduct business
  • Access to justice
  • Healthcare
  • Effective legal remedies

The list extends to more than twenty fundamental rights that AI systems may directly or indirectly affect.

The philosophy behind the FRIA is simple:

Artificial Intelligence must be evaluated not merely for what it does with data, but for what it does to people.

This is perhaps one of the most important conceptual shifts in AI governance.

India’s Constitutional Foundation

India does not have an equivalent of the EU Charter.

However, the Indian Constitution already provides a rich framework of fundamental rights that can serve the same purpose.

Among the most relevant are:

• • Article 14 – Equality before law
  • Article 19 – Freedom of speech and expression
  • Article 21 – Protection of life and personal liberty, including the Right to Privacy recognised in the Justice K.S. Puttaswamy judgment
  • Constitutional guarantees against arbitrary State action
  • Principles of natural justice
  • Consumer rights recognised under statutory law
  • Labour protections
  • Rights of children
  • Rights of persons with disabilities

The constitutional philosophy is already available.

What is presently missing is a structured methodology to evaluate whether an AI system threatens these rights.

India Needs an Indian Fundamental Rights Impact Assessment

As AI becomes embedded in banking, healthcare, education, insurance, public administration and law enforcement, organizations should not limit themselves to asking:

“Is this AI system compliant with DPDPA?”

They must also ask:

• • Is the system fair?
  • Does it discriminate?
  • Does it reduce human autonomy?
  • Does it affect dignity?
  • Does it create barriers to justice?
  • Does it unfairly deny opportunities?
  • Does it threaten democratic values?

These questions belong outside the traditional DPIA.

They require a broader governance instrument.

India therefore needs an Indian Fundamental Rights Impact Assessment (IFRIA).

Integrating IFRIA with DGPSI-AI

The DGPSI-AI framework already adopts a governance-oriented approach instead of treating AI merely as a technological problem.

An expanded governance model could consist of four complementary assessments.

1. Data Protection Impact Assessment (DPIA) with a focus on :

• • Compliance with DPDPA
  • Personal data processing
  • Privacy risks
  • Consent and lawful processing

2. AI Risk Assessment (AIRA) with a focus on:

• • Model reliability
  • Bias
  • Hallucinations
  • Security
  • Robustness
  • Operational risks

3. Indian Fundamental Rights Impact Assessment (IFRIA) with a focus on :

• • Equality
  • Fairness
  • Human dignity
  • Constitutional rights
  • Consumer interests
  • Employee rights
  • Public interest

4. Algorithmic Accountability Assessment with a focus on :

• • Explainability
  • Transparency
  • Auditability
  • Human oversight
  • Traceability
  • Governance effectiveness

Together, these four assessments would provide a comprehensive governance architecture that is significantly broader than current compliance approaches.

Moving Beyond Compliance

Many organizations still perceive AI governance as another compliance exercise. That could be a mistake. Good governance is not merely about avoiding penalties. It is about earning trust.

AI systems influence employment, healthcare, finance, justice and democratic participation. Consequently, governance must protect not only data but also the constitutional values upon which society is built.

The EU has acknowledged this reality through the Fundamental Rights Impact Assessment.

India has the opportunity to adapt the same philosophy within its own constitutional framework rather than merely copying foreign regulations.

The Road Ahead

The next generation of AI governance in India should move beyond the traditional focus on privacy. Privacy remains an essential right. But it is only one among many rights that intelligent systems may affect.

As India develops its own AI governance ecosystem, the objective should be to protect human rights, not merely personal data. The DGPSI-AI, implementation specification no 9 supporting the Governance principle of “Ethics” states,

“The Deployer of an AI shall take all such measures that are essential to ensure that the AI does not harm the society at large…”

Under this provision, an Indian Fundamental Rights Impact Assessment could be considered as part of the best practice.

A structured Indian Fundamental Rights Impact Assessment (IFRIA), integrated with DGPSI-AI and the proposed AI Governance Standard of India (AIGSI), would represent a significant step in that direction.

The future of AI governance will not be determined solely by the sophistication of algorithms.

It will ultimately be judged by how effectively those algorithms preserve human dignity, constitutional freedoms and the rights of every individual whose life they influence.

Comments are welcome.

Naavi

The August 21-23 program on CIDA (Certified Independent Data Auditors) has been further enriched with the addition of the following coverage.

RBI Guidelines on AI usage in Banks and REs

RBI guidance on Data Governance in Banks and REs

AIGSI: AI Governance standard of India.

This should be of interest to Bankers and CERT IN auditors in particualar

Register before August 8 to catch with the Master Class on CEDPO as a preparation for the course.

Naavi

For more details on Independent Data Auditors, visit www.aidai.org.in

Naavi