FDPPI, (www.fdppi.in) in association with Cyber Law College (www.cyberlawcollege.in) of Naavi (www.naavi.org) is launching a program for “Training the Trainers for DPDPA”.
Interested persons may contact Naavi.
The curriculum, the fees, mode of conduct etc will be announced as and when an initial critical number of interested persons express their interest.
Naavi
We are now around 213 days from 13th May 2027 when DPDPA will be fully effective. Many organizations have already started implementation. Action has started on three fronts
Some organizations have followed the above order of implementation. Some have also used the reverse order believing that software will do the trick and achieve the compliance.
While one can argue which is the correct order in which Compliance drive should be approached, everybody agrees that there has to be a synchronization of the elements.
Since many organizations have already jumped in with the impolementation in some fashion based on their current understanding of the requirements, they are now wondering if they are in the right track.
As the festival of Dussehra symbolizes the triumph of good over evil, righteousness over discord, and clarity over ignorance, it is the perfect time for organizations to strengthen their digital trust and overcome compliance hurdles.
In today’s evolving regulatory landscape, with the Digital Personal Data Protection Act (DPDPA) ensuring robust Data Protection Impact Assessments (DPIA) is no longer optional; it is essential.
To mark this auspicious season, FDPPI (Foundation of Data Protection Professionals in India) is excited to announce a special Dussehra Offer for businesses looking to elevate their data governance framework.
To assist companies re-visit their current approach to DPDPA implementation, FDPPI and Naavi are giving a special offer for the Dussera 2026 which commences from today.
For all the Corporate members who enrol on a 3 yearmembership plan (Visit for details) we would provide a free online DPIA session to enable review of their current implementation plan. A suitable appointment may be fixed for mutual convenience to discuss the current implementation plan and identify key areas of course correction if any.
Irrespective of whom the company is already working with, a second opinion from FDPPI is a peer review opportunity before the commitments reach an irreversible state.
Interested entities may contact Naavi or FDPPI through email.
Naavi
It has been an interesting last week when I visited two major Gramina Banks namely Rajashthan Gramina Bank in Jodhpur and Madhya Pradesh Gramina Bank in Indore to discuss with their senior staff such as General managers and Regional managers to discuss DPDPA.
The Gramina Banks after the mergers are one for each state and have 1500 or 2000 branches in their respective states. They therefore are bigger than many other small Banks in the urban areas. Some of these Gramina banks are also getting ready for listing in the Stock Markets. Hence they represent a very interesting study for the impact of DPDPA. Some of them may still depend on their sponsor banks for IT administration but many have developed their own systems also.
NABARD is providing the collective leadership for the 28 such Gramina banks along with the individual assistance the sponsoring Banks are providing to their sponsored entities.
We are watching how the roll out of DPDPA happens in these branches and what lessons can be drawn for the industry.
Naavi
Meity has issued a Gazette Notification on some minor corrections in DPDPA 2026.
The notification is available here.
The corrections are as follows:
1. Short title and commencement.— (1) This Order may be called the Digital Personal Data Protection (Removal of Difficulties) Order, 2026.
(2) It shall come into force on the date of its publication in the Official Gazette.
2. In the said Act,—
(i) in section 9, in sub-section (1), for the words “ child or a person with disability,” the words “child or of a person with disability ”shall be substituted;
(ii) in section 10, in sub-section (2), in clause (c), in sub-clause (ii), for the word “audit”, the words “data audit” shall be substituted;
Necessary modification will be done in www.dpdpa.in.
Naavi
The DGPSI System which started as a model DPDPA Compliance system in 2023 has come a long way in the last 3 years.
What started with DGPSI-Full Version later was modified as DGPSI-Lite version which we are now calling as DGPSI-SME. Subsequently DGPSI has developed in multiple directions. DGPSI-AI was an extension on the technology front. DGPSI HR was an attempt to address the DPDPA Compliance requirements on a functional basis. DGPSI-Hospital and DGPSI-Banks was an attempt to address the requirements of DPDPA Compliance in specific sectors. DGPSI-DP was another attempt to extend the Compliance framework to a category of activity and DGPSI-GDPR was an attempt to extend the framework to other legal frameworks. Together DGPSI has made FDPPI a “Standards Organization”.
DPDPA is a single law for all sectors and all sizes of companies. This was inevitable for the creation of the data protection law. But from the perspective of implementation in the industry this was a challenge which needed to be addressed. The “Framework” with different flavours for different purposes was therefore an attempt to make it possible for the industry to work on Compliance with appropriate modifications tailored to different industries.
In this journey it is now being explored if “Start UPs” can be considered as a “Class of Data Fiduciaries” for whom a simplified DGPSI Frameworks can be designed.
FDPPI has therefore started a project under the Title “Project May 13” to develop an exclusive framework of DPDPA Compliance that would address the “StartUP sector”. “Start Up sector” like the “SME Sector” can represent multiple industry sectors. There can be a Fintech Start up as well as a Health Care start up. But if there is a commonality between them as a “Start Up” it may be possible to create a Version of DGPSI like DGPSI-Lite which is a sector agnostic framework that is applicable to Start Ups.
Until now, DGPSI variants have broadly emerged around questions such as:
Which sector does it belong to?, What function is being addressed?, What technology is involved?, What activity is being performed? or Which law or regulatory framework applies?
Now DGPSI-Start Ups will start addressing the question:
Where is the organisation in its lifecycle? That could make lifecycle-based compliance an important future dimension of DGPSI.
A start-up could therefore move progressively from a basic DGPSI-Startup profile into DGPSI-SME or DGPSI-Full as its organisation matures, while adopting specialised profiles such as DGPSI-AI, DGPSI-HR or sector-specific frameworks wherever necessary.
The frameworks would not necessarily be competing products. They could become building blocks of a larger DGPSI architecture.
At this stage, there are more questions to be answered.
For example:
These questions deserve discussion. This thought is at a very preliminary stage and we can explore this as we go ahead. Your thoughts are welcome.
To explore this thought further, FDPPI proposes to conduct a survey titled “Project May 13” to find out from professionals on how a DGPSI framework can be constructed for Start Ups for DPDPA Compliance without Pain.
The objective is to determine whether the underlying proposition is valid.
Can “Start-up” be considered a meaningful class of Data Fiduciary from the perspective of DPDPA implementation?
If the answer is yes, the next question will be:
What should a start-up-specific DGPSI framework look like?
And perhaps the most important question will be:
Can India develop a model in which data protection becomes part of the DNA of a start-up from its earliest days, rather than becoming a compliance burden imposed after the organisation has already grown?
That is the question with which Project May 13 begins.
The thought is at a very preliminary stage. Views, suggestions, criticism and alternative approaches from start-ups, founders, privacy professionals, lawyers, technology professionals, investors, auditors and regulators will be valuable in shaping the next stage of the project.
Project May 13 starts with a question. The framework, if justified, will emerge from the answers.
(To Be continued)
Naavi
As FDPPI completes eight years of its existence, it is appropriate to look back not only at what the organization has accomplished, but also at why FDPPI was created in the first place.
Organizations often evolve considerably from the time of their formation. Programmes change, technologies change, laws change and the needs of the professional community change. Yet, a well-founded organization should retain a set of principles that provide continuity to its journey.
The objectives with which FDPPI was established were deliberately broader than the creation of a training or certification organization. They sought to establish a professional community that could contribute to the development of a secure and responsible information society.
The overarching objective was:
“To build an empowered community of Knowledgeable, Efficient and Ethical Data Protection Professionals who contribute to the development of a Secure Information Society by lawful means without any profit motive.”
Two specific objectives supported this larger vision:
1. To enhance the intrinsic Value and Worth of the profession of Data Protection Professionals who are directly or indirectly engaged in the activity of generating, managing, preserving and protecting information without any profit motive.
2. To bring harmony in the pursuance of Civil Rights of individuals such as Privacy and Freedom of Expression along with the Right to Information and Right to Cyber Security without any profit motive.
Eight years later, these objectives deserve a closer examination because the developments in Data Protection, Cyber Security, Artificial Intelligence and Data Governance have demonstrated their continuing relevance.
The first part of the FDPPI vision is the creation of an “empowered community”.
Empowerment is different from simply increasing the number of professionals.
A professional may possess a certificate without necessarily possessing the ability to deal with a complex real-world situation. Data Protection professionals are increasingly required to understand law, technology, business processes, information security, risk management, auditing and organizational governance.
The FDPPI objective therefore uses three important words:
A Data Protection professional must understand the applicable law and regulations, but legal knowledge alone is insufficient.
The professional must understand how personal data is collected, processed, stored, transferred, secured, retained and deleted. Increasingly, the professional must also understand how artificial intelligence systems use data and how technology can affect individual rights.
Knowledge must translate into implementation.
Organizations need professionals who can convert legal requirements into policies, processes, controls, contracts, technology requirements, audit mechanisms and measurable compliance.
The professional must therefore be capable of asking:
What does the law require, and how can the organization actually implement it?
Data Protection involves enormous power over information relating to individuals.
A professional dealing with personal data can influence how information is collected, used, disclosed and retained. Professional competence without ethical responsibility can therefore create its own risks.
FDPPI’s emphasis on ethical professionals recognizes that Data Protection is ultimately about trust.
The first specific objective speaks about enhancing the “intrinsic Value and Worth” of the Data Protection profession.
This is important.
FDPPI was not created merely to help professionals obtain employment or commercial opportunities. Its objective was to establish Data Protection as a serious professional discipline.
The profession sits at the intersection of several disciplines:
The Data Protection professional therefore performs a role that cannot be reduced to checking whether a privacy policy exists.
A mature Data Protection professional should be able to understand the organization’s information ecosystem, identify risks, evaluate controls, advise management and participate in the creation of a trustworthy data environment.
This is why professional development is central to FDPPI.
Another interesting aspect of the original objective is that it does not restrict the professional community to people carrying the designation of DPO.
It refers to persons who are directly or indirectly involved in:
generating, managing, preserving and protecting information.
This is a much wider ecosystem.
A Data Protection programme can involve:
This broad definition has enabled FDPPI to evolve beyond a conventional professional association.
It also explains the subsequent development of different FDPPI initiatives, including professional certification, DGPSI and AIDAI.
The second objective perhaps represents one of the most distinctive aspects of the FDPPI philosophy.
It speaks about bringing harmony between:
This formulation is important because rights relating to information do not always operate independently.
There can be legitimate situations in which one interest appears to conflict with another.
For example:
Privacy may require restricting disclosure of personal information.
At the same time, the Right to Information may support transparency in matters involving public interest.
Freedom of Expression may require the ability to communicate information or opinions.
At the same time, organizations and individuals have legitimate interests in protecting information from unauthorized access, manipulation or destruction.
Cyber Security protects the integrity and availability of information, but security controls should themselves operate within the framework of law and respect legitimate rights.
The FDPPI objective does not suggest that one of these interests should automatically prevail over the others.
Instead, it uses the word:
Harmony requires a framework for understanding the legitimate interests involved and applying the law in a balanced manner.
This becomes particularly important in a digital society where information can be copied, distributed and processed at unprecedented speed.
When FDPPI was conceived, Data Protection in India was still developing as a distinct professional discipline.
The Information Technology Act, 2000, including Section 43A, was an important part of the legal framework. Subsequently, the country went through several stages of proposed Data Protection legislation before arriving at the Digital Personal Data Protection Act.
During the same period, the technology landscape changed dramatically.
Cloud computing became mainstream.
Mobile applications became ubiquitous.
Artificial Intelligence emerged as a transformational technology.
Organizations began processing enormous volumes of personal and non-personal data.
Data became an important organizational asset.
Consequently, Data Protection could no longer be viewed only as a question of privacy notices and consent.
It became a question of Data Governance.
This evolution is reflected in FDPPI’s development of the DGPSI — Data Governance and Protection Standard of India.
FDPPI’s journey can therefore be understood as an evolution through several stages.
The first requirement was to create awareness about Data Protection and develop professional knowledge.
The next requirement was to establish measurable professional competence through structured education and certification.
As organizations began asking a more fundamental question — “How do we actually implement Data Protection?” — the need for implementation frameworks became evident.
This contributed to the development of DGPSI.
As compliance frameworks mature, organizations need independent mechanisms to evaluate whether the claimed compliance actually exists.
This is the context in which AIDAI — Association of Independent Data Auditors of India assumes importance.
Thus, the journey has not been a series of unrelated initiatives.
It represents an evolution:
Education → Certification → Standards → Implementation → Audit
The phrase “without any profit motive” appears in the objectives and deserves clarification.
It does not mean that Data Protection professionals should work without remuneration.
Professionals obviously need to be compensated for their knowledge, time and services.
The expression refers to the institutional purpose of FDPPI.
As a Section 8 organization, FDPPI exists for its stated objectives and not for distribution of profits to shareholders.
This distinction is important.
A professional organization can facilitate professional opportunities while itself remaining committed to a larger public-interest objective.
The ultimate beneficiary is therefore not merely the member.
It is the information society.
India is now entering a fundamentally different phase.
The Digital Personal Data Protection framework is creating new responsibilities for organizations and new professional requirements.
Data Fiduciaries will need to understand their obligations.
Data Principals will need mechanisms through which their rights can be exercised.
Data Processors will need appropriate contractual and operational arrangements.
Significant Data Fiduciaries will have additional governance requirements.
Organizations will need policies, processes, technical controls, documentation, risk management and audit mechanisms.
This creates a requirement for professionals who are not merely familiar with the terminology of Data Protection but who can translate law into operational governance.
That requirement is precisely aligned with the original FDPPI objective of creating professionals who are knowledgeable, efficient and ethical.
The next phase of FDPPI’s journey is likely to be shaped by three interconnected developments:
The implementation of India’s Data Protection framework will create a substantial requirement for professional knowledge and organizational capability.
AI introduces questions that go beyond traditional privacy compliance.
Questions concerning data provenance, automated decision-making, algorithmic governance, accountability and responsible deployment require new governance approaches.
This is the background to FDPPI’s work on AIGSI — Artificial Intelligence Governance Standard of India.
As organizations begin to demonstrate their compliance, independent assessment becomes increasingly important.
This is the rationale behind AIDAI and the development of frameworks for professional Data Auditing.
The objective is not to create another layer of bureaucracy.
It is to create confidence in the claims of compliance.
The original objectives also provide a useful explanation for FDPPI’s organizational philosophy.
FDPPI does not necessarily aspire to become a large centralized employer.
Instead, it seeks to build a professional ecosystem.
The Banyan Tree Model captures this philosophy.
A banyan tree begins with a central trunk but continuously develops branches. Some branches eventually take root and become supporting structures themselves.
Similarly, FDPPI’s members and Associate Members can develop their own professional capabilities, initiatives and services while contributing to the larger ecosystem.
The strength of the organization therefore does not depend solely upon the size of its central structure.
It depends upon the strength of the professional community around it.
Looking back after eight years, FDPPI has moved through several stages:
From awareness to education.
From education to certification.
From certification to professional development.
From professional development to standards.
From standards to implementation frameworks.
From implementation to independent audit.
And now, increasingly:
From Data Protection to Data Governance and AI Governance.
The instruments have changed.
The technology has changed.
The law has changed.
The professional requirements have changed.
But the fundamental objectives remain remarkably relevant.
FDPPI continues to seek the development of a community of professionals who are:
Knowledgeable.
Efficient.
Ethical.
And committed to contributing to a Secure Information Society by lawful means.
At the same time, FDPPI continues to believe that Privacy should not exist in isolation from other legitimate rights and interests.
The objective is not to create conflict between Privacy, Freedom of Expression, Right to Information and Cyber Security.
The objective is to develop the knowledge, professional competence and governance mechanisms required to achieve harmony among them.
That philosophy was embedded in FDPPI at its birth.
Eight years of experience have only demonstrated its continuing relevance.
The next phase is not merely about creating more Data Protection professionals.
It is about creating a professional ecosystem capable of making India’s information society more secure, trustworthy and responsible.
FDPPI’s original objectives remain the foundation for that journey.
