Naavi.org

One of the distinguishing features of the Digital Personal Data Protection Act, 2023 (DPDPA) is that it places accountability at the centre of personal data governance. The law identifies the Data Fiduciary as the entity that determines the purpose and means of processing personal data and makes that entity responsible for complying with the obligations prescribed under the Act.

In legal terms, the position appears straightforward. A bank is a corporate entity and therefore the Bank is the Data Fiduciary. Its branches are merely operational units and not separate legal persons. Consequently, the branches are not independently recognized as Data Fiduciaries under DPDPA.

However, legal definitions do not always reflect operational realities.

The Reality of Banking Operations

Modern banks operate on sophisticated Core Banking Systems (CBS), giving the impression that all customer information is centrally managed. While this is technologically true, it does not mean that personal data is processed only at the Head Office.

In the Banking practice before the advent of “Anywhere Banking”, a Customer was a customer of a Branch. This concept has now undergone a change and Banks recognize that a Customer is a Customer of the Bank with a “Parent Branch” being recognized for the purpose of documentation.

This change brought by the Digital Banking system is not however ideal for the compliance of DPDPA since the collection of personal data often originates at the branch level and then gets onboarded on to the enterprise servers. Consent Management therefore happens at the Branch level. However the KYC may be managed by an organization which has a contract signed at the HO level and not at the branch level.

In cases where Branches use the services of centrally appointed service providers for KYC etc, the status of the Head office and its vendor needs to be defined along with that of the branch as either Data Fiduciary, Joint Data Fiduciary or Data Processor.

Customer grievances are handled at branches as well as through the website.

Loans are processed through branch-level officers and by the models governed by the Central office while loan assets are often managed physically at the Branch level. Documents are collected, verified, digitized and stored through branch operations.

Hence, even where centralized databases exist, the operational handling of personal data remains highly decentralized.

For a customer, the Branch Manager is the face of the Bank. It is the branch that decides how the customer is onboarded, how documentation is verified, how service requests are processed and, in many cases, how customer data is shared with third parties for legitimate banking operations.

The Branch, therefore, exercises significant operational control over personal data.

Centralized Systems, Decentralized Processing

This distinction between centralized storage and decentralized processing is becoming even more complicated because many branches independently use:

• • AI-assisted customer service tools.
  • Document verification software.
  • OCR-based KYC applications.
  • Loan scoring models.
  • Fraud detection systems.
  • Analytics platforms.
  • Cloud-based business applications.

Branches also interact with numerous third-party service providers such as:

• • Recovery agencies.
  • Valuation agencies.
  • Legal firms.
  • Marketing agencies.
  • Document digitization vendors.
  • Collection agencies.
  • Technology support vendors.

Each of these relationships may involve processing of personal data.

Although corporate policies may require approval from the Head Office, operational decisions are frequently taken at the branch level, creating a situation where privacy risks arise far away from the office of the Bank’s Data Protection Officer (DPO).

A Governance Gap

This creates an interesting governance challenge for DPDPA Compliance.

Legally, accountability rests with the Bank. Operationally, responsibility is distributed across hundreds or even thousands of branches.

Traditional compliance models tend to assume that privacy governance is centralized. In practice, however, DPDPA compliance succeeds or fails at the operational level.

If a branch employee collects excessive information…

If customer consent is not properly recorded…

If a local vendor mishandles customer information…

If an AI tool is deployed without adequate assessment…

…the resulting non-compliance affects the Bank as a whole.

The law may hold the Bank accountable, but the operational failure occurs at the branch.

The Concept of an Aggregated Data Fiduciary

To bridge this governance gap, DGPSI-Bank proposes the concept of Bank as an “Aggregated Data Fiduciary”  while the branches are “Operational Data Fiduciaries.”

Kindly note that this is a Governance approach and does not legally redefine the concept of Data Fiduciary or a Significant Data Fiduciary. Given the sensitivity of the financial information however, both the Bank and the Branch are to be considered as “Significant Data Fiduciaries”.

Under this model:

• • The Bank remains the sole legal Data Fiduciary under DPDPA.
  • Every branch functions as an Operational Data Fiduciary for governance purposes.
  • Accountability is cascaded to the level where processing decisions are actually implemented.
  • Enterprise-wide legal responsibility remains centralized.

A company has one Board of Directors, yet each factory, plant, regional office and branch has managers responsible for operational compliance.

Similarly, DPDPA accountability should flow from the Board to the branch.

The Role of the Branch Manager

For most customers, the Branch Manager effectively represents the Bank.

Accordingly, the Branch Manager should ordinarily function as the Branch Privacy Officer or Branch Data Protection Coordinator, unless another officer is specifically designated for this purpose.

This should not be confused with the statutory DPO appointed by the Bank.

The enterprise DPO continues to discharge the legal responsibilities prescribed under DPDPA, while the Branch Privacy Officer becomes responsible for implementing privacy controls, maintaining records, ensuring evidence of compliance and coordinating with the central privacy office.

This creates a practical governance hierarchy without altering the statutory framework.

Implications for Independent Data Auditors

The concept of an Aggregated Data Fiduciary also has important implications for Independent Data Auditors.

An audit limited to Head Office policies is unlikely to provide meaningful assurance regarding actual compliance.

Auditors should evaluate:

• • Branch-level consent management.
  • Local vendor governance.
  • AI deployment practices.
  • Record retention.
  • Employee awareness.
  • Incident reporting.
  • Privacy governance.
  • Evidence supporting compliance.

Only then can an Independent Data Auditor provide credible assurance regarding DPDPA compliance.

Beyond Banking

Although the banking industry provides a compelling illustration, the concept has much wider application.

Insurance companies.

Large hospital networks.

Retail chains.

Telecommunication operators.

Educational institutions with multiple campuses.

Government departments with regional offices.

Public Sector Undertakings.

Franchise-based business models.

In all these cases, the legal Data Fiduciary is a single entity, while operational processing is widely distributed.

The Aggregated Data Fiduciary model offers a structured mechanism for distributing operational responsibility without diluting legal accountability.

A Natural Evolution of DPDPA Governance

Earlier, we had proposed the concept of a Super Data Fiduciary to describe organizations that exercise overarching governance over multiple independently operating entities, particularly in sectors such as healthcare.

The concept of an Aggregated Data Fiduciary addresses a different challenge.

It recognizes that within a single legal entity, operational responsibility may itself be distributed across numerous business units that process personal data on a daily basis.

As organizations increasingly adopt AI, cloud services and decentralized digital operations, this governance model becomes even more relevant.

DPDPA establishes legal accountability. Organizations must now develop governance structures that make that accountability operational.

The concept of the Aggregated Data Fiduciary is one such framework. It enables organizations to combine centralized legal responsibility with decentralized operational ownership, thereby strengthening governance, improving auditability and making DPDPA compliance more effective.

It is hoped that regulators, compliance professionals, auditors and industry bodies will examine this concept and contribute to its refinement as India’s data protection jurisprudence continues to evolve.

Open for public Deabte.

Naavi

(This is in continuation of the previous article on Evolution of Data Valuation in India)

DGPSI Full version has indicated a model implementation specification which states

“Organization shall establish an appropriate policy to recognize the financial value of data and assign a notional financial value to each data set and bring appropriate visibility to the value of personal data assets managed by the organization to the relevant stakeholders.”

So far this has remained a suggestion which is more to indicate the auditee that they need to move in this direction. But with CAG guidelines for PSU auditors, the time has come to expand this MIS into a draft policy.

A tentative attempt is made in this direction to present a draft policy here for further discussion.

Copy of draft policy

This draft policy takes into account Naavi’s Theory of Data and Data Valuation Standard of India as supporting documents.

This is work in progress and Comments are welcome.

We can discuss this during our Chennai Seminar on July 17th 2026.

Quote:

                  [ STAGE 1: INTRINSIC VALUE (IV) ]
       Computed via Cost of Acquisition or Market Replacement
                                │
                                ▼
             [ STAGE 2: VALUE MULTIPLIER INDEX (VMI) ]
   Adjusts value based on Consent, Accuracy, Age, and Sensitivity
                                │
                                ▼
               [ FINAL NOTIONAL DATASET VALUE ]

For years, the phrase “Data is the new oil” was thrown around as a vague corporate cliché. Today, that narrative has  shifted from an abstract marketing pitch into a measurable, techno-legal reality. Driven by incoming international accounting frameworks, local regulatory mandates, and indigenous governance models, India is establishing a structured environment where data is recognized not just as an operational by product, but as a quantifiable financial asset.

Evaluating the multi-layered initiatives across India reveals how different agencies are approaching data valuation, along with their current operational status.

1. Macro-Government & Policy Initiatives: The Public Sector Shift

The government has recognized that to build a true digital economy, the state must find a uniform way to measure digital assets.

• MoSPI and SNA 2025 Adoption: The Ministry of Statistics and Programme Implementation (MoSPI) has actively engaged with the United Nations System of National Accounts (SNA 2025) guidelines. These standards formally recognize data as an economic factor of production. Government committees are currently outlining how public sector undertakings (PSUs) should officially categorize and track data assets.

• The CAG Mandate: The Comptroller and Auditor General (CAG) of India has signalled a clear need to capture the intrinsic value of data repositories within public asset reporting.

• Current Status: In Development/Policy Phase. Draft frameworks are under review to determine how state-owned data exchanges and infrastructure datasets can be accounted for without compromising national security or individual privacy.

2. Regulatory Compliance Drivers: The DPDP Act & Toxic Data

The rollout of the Digital Personal Data Protection Act (DPDPA) has upended traditional data accumulation strategies. Data valuation in India can no longer be evaluated through the lens of potential monetization alone; it must be balanced against statutory liability.

• Asset vs. Liability Dynamics: With penalties reaching up to ₹250 crore per non-compliance instance, unconsented, poorly structured, or “zombie” data is no longer an asset—it is an active balance sheet liability.

• Current Status: Active Enforcement Preparation. Organizations are actively filtering their datasets to compute their “clean data” volume. Under this model, data value dynamically depreciates the moment a Data Principal withdraws consent or the processing purpose expires.

3. Indigenous Institutional Frameworks: DGPSI and DVSI

While traditional accounting standards (like Ind AS 38) remain highly conservative about capitalizing internally generated data, pioneering frameworks within India have stepped forward to fill the gap.

• Data Governance and Protection Standard of India (DGPSI): Developed by FDPPI, DGPSI has embedded financial data valuation directly into its governance specifications. Specifically, Model Implementation Specification 9 (MIS-9) explicitly requires organizations to establish a policy assigning a notional financial value to distinct datasets. This ensures the board has visibility into the economic worth of the data assets they oversee. DGPSI’s metric—the Data Trust Score (DTS)—serves as a core indicator of how compliance directly protects and enhances an asset’s baseline value.

• Data Valuation Standard of India (DVSI): Operating alongside DGPSI, the DVSI model introduces a specialized two-stage valuation methodology. It calculates the intrinsic cost of data (using classic cost of acquisition or market parameters) and applies a dynamic multiplier index based on legal compliance, data accuracy, and cryptographic protection.

• Current Status: Operational/Implementation Phase. The newly launched Association of Independent Data Auditors (AIDAI) is actively training and empanelling Certified Independent Data Auditors (CIDAs) to handle data audits that combine compliance testing with these advanced data valuation techniques.

4. Valuation in Insolvency and Distress: The IBC Track

The most concrete financial realizations of data value are currently occurring under distressed corporate conditions.

• Insolvency and Bankruptcy Code (IBC), 2016: Resolution Professionals (RPs) and Registered Valuers regularly encounter scenarios where a failed startup, fintech platform, or e-commerce provider holds minimal physical assets, but possesses massive, highly structured user databases and proprietary transaction algorithms.

• Current Status: Fully Functional Legal Practice. Courts and liquidators treat these data stacks as intangible corporate property under Section 36 of the IBC, utilizing Income or Market-driven slump sales to maximize recovery returns for creditors.

Reconciling Value and Responsibility: The “Data Balance Sheet”

The convergence of these initiatives points toward a inevitable destination: the Data Balance Sheet. Under a double-entry governance framework, personal data under management must be accounted for simultaneously as an economic asset and a corresponding contingent liability (accounting for potential data breaches, regulatory fines, and remediation costs).

Organizations that wait for standard accounting boards to hand down a rigid template will find themselves exposed to severe regulatory and financial risks. Relying on frameworks like DGPSI to understand exactly what data you possess, what value it generates, and what risks it carries is no longer just a compliance choice—it is a baseline requirement for modern corporate sustainability.

(To Be continued)

Naavi

We often discuss the concept of Data Processing under “Data Blind” conditions.  It essentially means that the processor does not have access to identifiable personal data which he is processing. The system is suggested for “Consent Managers”.

We are however discussing another aspect of “Being Blind to the Value of Data”.  There are two examples in India where an organization being “Data Value Blind” suffered adverse consequences. One was Net4India which was liquidated probably because NCLT was blind to the value of data in the organization. Second was the case of CIBIL which quietly transferred data worth around Rs 700000 crores to a foreign organization for a mere Rs 3800 crores.

On the other hand there are multiple examples in US where data valuation has been used to ward off bankruptcy proceedings.

If you are interested in this topic of “Data Valuation”, Please be present on July 17 at Palmgrove, Chennai where FDPPI/AIDAI will be discussing the issues on Data Valuation. (Check for details at www.aidai.org.in)

Naavi

FDPPI and AIDAI (Association of Independent Data Auditors” in association with the Society of Auditors, Chennai.

There are three important educative sessions planned for the seminar.

1. The role of Independent Auditors as “Guardians of Accountability”
2. Data Valuation
3. Need for Chartered Accountants and Advocates to look at Data Audit as a professional add on service. (Panel Discussion involving industry veterans)

Interested persons may register immediately.

REGISTER HERE: 

(Registration fee: Rs 500/-: May be paid here: )

Naavi

A More detailed audio podcast is also available here:

Kannada Discussion:

The above podcasts are explainers of the blog post but would be useful for a deep dive. Kindly go through and let me know your comments.

These are produced using AI . However base content is from me and the audios/videos have been reviewed manually. Hence use of AI is only to assist me.  AI is only a software tool in this context.

Naavi