Mr Vinod Sreedharan is a AI expert with a creative bent of mind. He has applied his creative thoughts to give a visual imagery touch to “Taming of DPDPA and AI with DGPSI-AI”
  |
|
The Meity has released some corrections in DPDPA Rules through a Gazette notification
It essentially consists of some typo corrections. as follows
Necessary corrections are being made at dpdpa.in and the rules posted at the dpdpa rules
Naavi
The Government of Karnataka has recently passed a bill titled “The Karnataka Hate Speech and hate Crimes (Prevention) Bill 2025 (LA Bill No 79 of2025) . It is currently pending Governor’s assent.
The first thing we note in this bill is that it covers both “Speech” and “Crime” and includes “Electronic Form”.
Regulating the speech is subject to restrictions in the constitution. A law to directly curtail speech is ultra vires the Constitution Article 19.
Legislation on “Electronic Documents” is under Information Technology Act 2000 (ITA 2000) and the powers of the State Government to legislate for the use of Electronic document is restricted to Section 90 of the ITA 2000. It does not extend to creating new Cyber Crimes under the power of the State.
Section 6 of the Act provides power to block the hate crime materials and if it is in electronic form, directly conflicts with Section 69 and 69A of the Information Technology Act 2000 (ITA 2000) and rules made there under which places such powers with several restrictions.
For ease of understanding, we quote Section 90 of ITA 2000 here
Section 90: Power of State Government to make rules
(1) The State Government may, by notification in the Official Gazette, make rules to carry out the provisions of this Act.
(2) In particular, and without prejudice to the generality of the foregoing power, such rules may provide for all or any of the following matters, namely –
(a) the electronic form in which filing, issue, grant receipt or payment shall be effected under sub-section (1) of section 6;
(b) for matters specified in sub-section (2) of section 6;
(3) Every rule made by the State Government under this section shall be laid, as soon as may be after it is made, before each House of the State Legislature where it consists of two Houses, or where such Legislature consists of one House, before that House.
It is clear that the powers of the State Government to legislate on the use of Electronic Documents for Governance is restricted and does not extend to defining new Cyber Crimes and prescribing punishments.
This is considered void ab-initio.
Hence including “Electronic” form of communication under the Bill renders the Bill illegal and liable to be struck down.
The world of Electronic Documents constitutes what is generally described as the “Cyber Space” which is recognized as an independent area of activity. Countries such as USA recognize “Cyber” as a separate command for their defence forces exactly for the reason that it represents an extension of the geographical boundaries of the sovereign country similar to the sea and air space.
Hence law of cyber space does not fall under the concurrent list and is the sole domain of the Central Government to legislate. This legislation and all legislations so far in multiple States are therefore unconstitutional and needs to be stuck down.
A suitable petition constitutional bench in the Supreme Court needs to be considered to decide about the status of “Cyber Space” and the rights of a sovereign entity to draw Cyber boundaries and legislate for crimes there in.
Currently ITA 2000 already has established such boundaries and conditions when the extra territorial jurisdictions can be extended to foreign territories. Such powers under Section 75 cannot be left to be exercised by State Government and hence the Karnataka Hate Act cannot include “Electronic Documents” as instruments by which offences under the Act may be committed.
Hence there is a need to omit “Electronic Documents” from the provisions of the Karnataka Hate Bill under Section 2(i) and 2(iv).
Hence the part of the Bill that curtails speech particularly in the electronic form is considered unconstitutional and ultravires the Indian Constitution as well as ITA 2000.
Additionally, the punishment envisaged under the act even for the first time offender is “Imprisonment of not less than one year which may extend to seven years” and for subsequent offences can extend upto 10 years. The offence is “Cognizable”, “Non Bailable” and “triable by the Judicial magistrate First Class”.
Hence the offence is graded as “Heinous” and can be grossly abused by the Police. It can therefore have a “Chilling Effect” as the Supreme Court defines under the “Shreya Singhal Case”.
There is therefore an urgent need for the Bill to be withdrawn by the Assembly, failing which to be rejected by the Governor, failing which to be struck down by the appropriate Courts.
This issue being a serious Constitutional matter, has to be taken up by some public spirited law firm and fought in Karnataka High Court and the Supreme Court.
I hope such people take note.
Comments are welcome.
Refer:
https://www.youtube.com/watch?v=3YmexzlaPko
Naavi
The launch of DGPSI-GDPR is not just another event. It is a symbol of Indian Data Protection eco system coming of age not only to be compliant with DPDPA 2023 but also provide the guidance to the compliance of other data protection laws such as GDPR. The work has started and with the cooperation of the community we will have a framework that is acceptable as a good guidance to all companies firstly in India.
DGPSI (Digital Governance and Protection Standard of India) was developed as a guidance framework for compliance of DPDPA. It is a useful framework today for implementation of the DPDPA 2023 in an organization as well as for audit and assessment.
In India we also have many organizations who process data from outside India and most of them so far treated GDPR as the standard for Data Privacy Compliance. With the coming of ISO 27701:2025, the GDPR Compliance through ISO 27701:2025 as an independent certifiable framework also received a boost.
In this context, most organizations in India are confronted with the need to look at two compliance drives one for DPDPA and another for GDPR.
While some would like to adapt GDPR compliance to DPDPA compliance and use ISO 27701:2025 (modified for India), an alternative is to use DGPSI and adapt it to GDPR compliance.
To facilitate this use of a Made in India framework for compliance of GDPR, DGPSI has now been extended with a DGPSI-GDPR version. This uses the 50 Model implementation specifications of DGPSI with subtle changes to be capable of meeting the GDPR requirements.
This is a a game changer in the domain of Data Protection Compliance in India and a transition point where DGPSI becomes the source framework from which compliance of Data Protection laws of other countries can be carved out.
Currently, FDPPI is working on a draft version of the DGPSI-GDPR version and the Certified Data Auditors of FDPPI will be trained to use the version for GDPR compliance as may be required.
Under DPDPA, data processing activities where process foreigner’s data under a contract are exempted from DPDPA. Such activities involving EU data are now capable of being implemented and audited using DGPSI-GDPR. It is one of the requirements of DGPSI that personal data is classified on the basis of applicable jurisdiction and hence even where the data is currently mixed up, they need to be segregated and a virtual GDPR processing division has to be created. Such virtual division can now use DGPSI-GDPR as the framework for compliance.
Can an India framework take on the compliance of Global Data Protection Compliance? …will be a question in the minds of many data protection professionals.
Let us make it happen. FDPPI invites all data protection professionals in India to put in their efforts to develop the DGPSI family of frameworks to expand and provide guidance to the compliance of GDPR as well as other data protection laws in due course.
Naavi
FDPPI’s Certification program for developing DPOs and Data Auditors in India offers an online examination for professionals to validate their knowledge and skills to be a good DPO in the Indian scenario.
While trainings are conducted by the training partners of FDPPI from time to time (Eg: Virtual Program on December 20-21 conducted by Cyber Law College), the coveted certification of C.DPO.DA. is available for anybody who registers for the online examination and pass through the cut-off marks required.
Whether you are a CIPP certified or DSCI certified or ISO certified or PECB certified or EXIN Certified or ISACA Certified you can appear for this online examination by making payment of the prescribed fees and take the examination.
As a special year end offer, the examination for which the fee is normally Rs 25000/- is being offered at Rs 10000/- till 31st December 2025.
The material for the exam is available in the following three books
The Certification training conducted by Cyber Law College consists of 12 hours of online discussions that cover
Besides training themselves to be DPOs in an organization, some of our trainees may emerge as independent trainers in different parts of the country under a franchise scheme of FDPPI.
FDPPI is also introducing an upgrade over C.DPO.DA. for those who want to be “Independent Data Auditors” which is a position that is likely to open up in 2027 after the Act becomes fully effective. A separate upgradation training for CIDA (Certified Independent Auditor) is being planned to be conducted in 2026 for this purpose.
For the time being it is an opportunity for interested professionals to take the C.DPO.DA. examination at the special year end price of Rs 12000/-. (Inclusive of GST) You can register directly on the CDPODA page of fdppi.in and making a payment of Rs 12000/-. (Indicate in the description that the registration is for examination only)
Naavi
I was just recalling that on 17th December 2022, I was conferred a Life Time award for Cyber Jurisprudence in Chennai. It was a coincidence that on 17th December 2023, at Hyderabad, a “Lifetime Achievement Award for Privacy” was conferred by EndNow Foundation of Hyderabad.
These will continue to inspire me for further work in the field.
Today on December 17, 2025, I am pleased to announce officially the release of the framework “DGPSI-GDPR” which marks the extension of the Made in India for India framework of DGPSI for the global world. This could be the beginning of a new era of DGPSI family growing into a global family of frameworks. This could be a self determined life time achievement which gives satisfaction and a sense of fulfilment.
Closely followed by DGPSI-GDPR, we are adding two more extensions to DGPSI-India in the form of DGPSI-Data Processor and DGPSI-HR. DGPSI-Data Processor provides an Indian Data Processor equipping himself with a DPDPA Compliance culture voluntarily to increase his competitive position in the market. DGPSI-HR has been envisaged for those companies who donot have any individual customer data because they are a B2B organization, but have employee data for which they are still the data fiduciary under DPDPA 2023.
Request professionals to encourage these developments and participate in the further development of these frameworks.
 |
 December 17, 2023 Life time achievement award for Privacy at Hyderabad…Socialwood conference of Endnow Foundation |
Naavi
