Naavi.org

With the closure of public comments on DPDPA Rules on 5th march 2025, many organizations and industry associations have already lodged their objections to different aspects of the rules. Most of them are only considering their vested interests and are not looking at the regulation holistically.

The essence of most of the demands is… “We donot want the regulation. Delay it as long as possible”.

It is shameful that even after 5 years of discussions, the industry is not ready to accept the law and move on.

In one of the latest submissions, the following points have been made.

1.”India’s data protection framework may inadvertently disadvantage start-ups and MSMEs compared to large corporations. Compliance to the DPDP Act demands significant financial and technical resources, which large companies, with dedicated legal and IT teams, are better placed to absorb such requirements. In contrast, start-ups and MSMEs, often operating on tighter budgets, may struggle to meet these obligations without diverting resources away from growth and innovation.

This is a canard and the “Start up argument” is being used as an excuse by the larger organizations.

Actually the act creates many opportunities for Start ups and there are reasonable exemptions to notify exemptions to the start ups which need some relief. What industry associations can do is to help MeitY set up a “Sandbox” to make it easy for Start Ups to claim and manage the exemptions.

2. Among the specific concerns is the supposed “Ambiguity” around the designation of Significant Data Fiduciaries. The objection is “Setting a data volume-based criteria for notifying certain Data Fiduciaries as SDFs may inadvertently disadvantage Indian companies against multinational competitors”.

This is a vague and unsubstantiated allegation. The “Sensitivity” and “Volume” based criteria leaves the companies to make their own Risk Assessment and self evaluate if they have to consider themselves as “Significant” Data Fiduciaries or not. Industry should not expect the Government to do the spoon feeding in this regard. If an organization is not able to assess the personal data processing risks, they need to study the law harder. The wise approach in such cases is to “Err on the safer side”.

If an organization considers itself as “Significant Data Fiduciary” there are only three obligations… Designation of DPO, Conducting of DPIA and Conducting of annual Data Audit from an external data auditor. Even if a company wrongly designates itself as a Significant Data Fiduciary, it only strengthens its data privacy profile.

Our organizations are prepared to adhere to EU laws or US laws even when not mandatory but are reluctant to adhere to the Indian laws. Such tendency is avoidable.

3. A push back is suggested on against potential restrictions on cross-border data transfers, stating that such measures could isolate Indian companies from the global data economy and raise compliance costs. It is claimed “The restrictions on cross-border transfer of data could restrict India’s capacity to maximise data-driven activity, particularly considering the substantial GDP contribution from outsourcing and digital export related activities. Such constraints could impede progress toward the ‘Digital India’ vision”

This is also an unacceptable excuse since we are complaining only against a “Empowering” provision and the same industries are fine with EU isolating itself with its “Adequacy” criteria and exercising its “Data Colonization” strategies over India. India needs to assert its sovereignty over personal data of its citizens and insist on data localization within a short time period. This will give a boost to the local services related to data storage and security.

4. Another objection raised is that “Requiring platforms to verify the identity of parents for every user will place a heavy burden on companies and is not aligned with global privacy standards”.

It is not clear if these organizations donot want the protection sought to be offered to Children. If so, they have to state it openly that Children are the biggest attraction for marketing and profiling them and targeting them with advertising is to be freely permitted. If the task is difficult, it only means that there is a huge business opportunity which the service industry should welcome.

5. It is also stated that ” More safeguards are required that businesses are not forced to disclose proprietary information, such as algorithms, trade secrets, or confidential customer data under Rule 22. A mandatory disclosure of this information basis a government request can negatively impact businesses, significantly disregard the financial resources expended, and potentially stifle innovation”

It appears that “Innovation” is the battering ram with which every inconvenient provision is being attacked. “Innovation” is how to accomplish things within a framework and the adversities arising out of law are the essential barriers that needs to be overcome through innovation. Developing DPDPA compliant solutions is the “Innovation” not the “Free for all” approach.

6. The demand is that even after 5 years of waiting, industry wants another 2 years for compliance and perhaps further time later on as an extension. Though the Government has so far been exhibiting a tendency to bend over backwards on every industry demand, I wish that for once the Modi Government shows commitment to implement its promises.

Unless the law starts hurting, industries will not be motivated to comply and hence the penalties should kick in as quickly as possible and within a time frame of 9-12 months .

It is unfortunate that most of our Industry Associations toe the line of MNCs s and ignore what is good for the Country. MeitY should be able to identify the hidden agenda in the recommendations submitted and uphold the interests of India over the proxies of Tech giants.

Naavi

With the comments on DPDPA rules behind us, organizations now have to start working on how to proceed on the road to compliance.

DGPSI the Crown Jewel of Frameworks for DPDPA Compliance adopts a milestone approach with seven distinctive milestones identified as “Sapthpadi” to DPDPA Compliance.

Organizations need to check their status and identify where they stand today and how they plan to reach their goal.

The C.DPO.DA. training program that FDPPI conducts will trace these seven steps and how best to achieve them. An 18 hour virtual program on week ends with 6 days training of 3 hours each has been planned by the FDPPI team to start from April 12.

The program will be be held between 10.00 am to 1.00 pm on April 12, 13, 19,20, 26 and 27th with a possible extension if required to 3/4 th May to discuss the Examination for Certification.

We have recently conducted two physical programs for this content in Bangalore and Mumbai which has been well appreciated. The Virtual Program is now available across the Country and abroad and will be a great opportunity for all interested individuals. Organizations need to depute select persons from their organization so that they can prepare themselves to be “DPDPA Ready” in the year 2025-26.

The tentative coverage during the six sessions would be as follows. Naavi will be the lead faculty for the program.

For details of registration …please refer https://fdppi.in/wp/virtual-c-dpo-da-program-on-weekends/

Naavi

The extended time line for submission of public comments on DPDPA Rules 2025 ends today.

Naavi/FDPPI has already submitted its response, copy of which is available here.

Subsequent to the submission of our recommendations, a few more additional requirements have been identified in view of the recent data breach reports of Adarsh Developers in Bangalore and also Angel One stock broking firm in both of which the role of the cloud service provider came to the fore.

We therefore discussed whether AWS should be declared as a Significant Data Fiduciary and held responsible for security.

We also discussed that all organizations like Banks handling personal data and declared as Protected Systems under Section 70 of ITA 2000 also should be automatically considered as a Significant Data Fiduciary.

While the Government has preferred to stay neutral on designation of Significant Data Fiduciaries and leave it to the Data Fiduciaries to declare themselves as Significant or Not, there will still be references to the designated Meity official to whom references may be made by organizations asking for a certification whether they are “Not Significant Data Fiduciaries’.

FDPPI will provide its views through the DGPSI framework and also perhaps define “Super Data Fiduciaries” and all Consent Managers as Significant Data Fiduciaries. Where AI algorithm is used, the responsibility for the functioning of the AI rests with the deployer who in turn needs to obtain an assurance from the vendor. Where the vendor is not able to certify the compliance of the AI algorithm from DPDPA perspective, the deployer should consider it as an “Unknown Risk” and may use the AI at his risk and responsibility as a “Significant Data Fiduciary”.

We have also pointed out the need for disclosure of “recent Personal Data Breaches” in the notice as holding it back amounts to misrepresentation.

We have also pointed out that systems of DPB should be declared a Protected System under ITA 2000.

We have also pointed out the recent stand of RBI opposing the Privacy Law in respect of the Credit Rating firms which flags the need for sectoral regulators to be kept within the framework of DPDPA. MeitY needs to ensure that MHA and MOF work along with them in a harmonious manner and not let different sectoral regulators have their own regulations that contradict the DPDPA.

Some of these suggestions may also be considered by MeitY.

Naavi

On 27th February, Angel one became aware of a data breach which it seems to have reported through email to its customers reported a personal data breach and has issued a notification to the data principals probably on March 2. According to one report nearly 8 million users have been affected by the breach.

Report at www.varuta.com

The data breach is reported to involve unauthorized access to AWS resources. The leak was not discovered by the Company directly and was revealed by the monitoring of the Darkweb by its dark web monitoring partner.

In an official statement, Angel One assured its clients that their securities, funds, and credentials were not affected by the breach. In a sweetly worded notice it stated as follows:

The breach re-ignites the issue of what are the responsibilities of the cloud service providers related to securing the access and monitoring of the data exfiltration.

Just as we expect Bankers to monitor their client’s access to the CBS system through an adaptive authentication system, we should raise a question on why is AWS negligent in placing security measures that should identify the data leak when the exfiltration is happening.

While we expect Angel one to encrypt the data and protect the log in from its side, it is reasonable to expect AWS also to protect its systems from unauthorized access just as we expect banks to monitor the authentication requests.

We should also request MeitY to consider that part of the AWS storage and other cloud service providers which caters to “Significant Data Fiduciaries” (Angel One may be one) should be declared as a “Protected System under Section 70 of ITA 2000” so that it is taken seriously by the cloud service providers.

Such systems may be identified as “DPDPA Compliant Storage Service”. If AWS can provide HIPAA compliant Storage service, it should be capable of providing DPDPA Compliant service also (May be a new revenue generation model for AWS and others).

At present the Angelone website does not contain any prominent notice though the email has been sent to the users.

Under DPDPA compliance we need to discuss if it is not necessary to report the data breach (Recent) as part of the notice for the new customers who may be joining the service.

FDPPI has already recommended that “All Data Breaches recorded since 11th August 2023 may be reported to DPB under the powers of Section 36 of DPDPA 2023 “.. Along with this we must add that “In every notice information on past data breach information upto one year should indicated”

Naavi

I had the privilege of participating in the summit Bengaluru 2040 organized by Deccan herald recently .

The video of the discussion on Cyber Crimes is available here.

Naavi

When DPDPA 2023 was enacted, the focus of legislation was “Digital personal Data” and the way the industry is expected to collect and process. The law was drafted as a “Principle based draft and did not find it necessary to state that it was meant to protect the Right to privacy of an individual as envisaged under the Puttaswamy judgement.

The draft also surprised many because it did not provide personal compensation to data principals and instead indicated a possible fine of Rs 10000/- for data principals making false complaints.

Even now when the rules are being finalized, there is a continued demand that it should be more prescriptive and also that a percentage of the fine imposed on the data fiduciary should be paid to the data principal who raises a complaint.

The logic is that Government will impose a fine of Rs 250 crores based on the complaint of the Data Principal and enriches itself but does not provide any compensation to the data principal.

We have repeatedly clarified that the approach of the Government has been innovative and not making the law very prescriptive was a deliberate strategy. We have also further held that the Rules should also follow the “Minimal” principle and should continue to be principle based and not try to address all possibilities of issues that may arise in the implementation.

We are also in principle not supportive of providing “Explanations” within the law or rules which only restrict the applicability and create more avenues for breaking the law rather than following the law.

As regards the compensation to the data principals, we have insisted that Section 43 of ITA 2000 may be invoked by data principals for their personal compensation in case of data breach and the adjudication process under ITA 2000 maybe invoked.

Similarly we have reminded that several sections of ITA 2000 will continue to be relevant even after Section 43A is removed after the notification of Section 44 of DPDPA 2023 out of which Section 43 will be most relevant for claiming of personal remedy.

In the S Umashankar Vs ICICI Bank case, the TDSAT had clarified that Section 43(g) can be invoked when there is “Negligence” in following the “Reasonable Security Practices” prescribed by RBI. Extending this ruling, DPDPA 2023 is already considered as the “Due Diligence” and is applicable for interpreting both Section 79 and Section 85 of ITA 2000 and fixing responsibilities under Section 43(g).

Another lacuna which many point out in DPDPA 2023 is that it does not classify personal data as “Sensitive” and has removed the definition of “Harm” which was present in earlier versions.

However, DPDPA 2023 uses “Sensitivity” and “Risk to the Data Principal” while classifying organizations as “Significant Data fiduciaries”. Hence all those organizations which are processing “Sensitive Personal Data” as we generally understand will now be considered as “Significant Data Fiduciaries” (SDF)and will need to appoint a DPO, Conduct a DPIA and annual Data Audit.

This is better than merely classifying some of the data as “Sensitive” and leave the organization as an Non-SDF. Further the Government has so far refrained from giving definition of who will be an SDF and has left it to the discretion of the organizations to self assess themselves as SDF based on their own assessment of the “Sensitivity” of data processed and the “Likely harm that may be caused to the data principal from their processing”.

In this context of “Harm to the data principal”, the Consumer Protection Act 2019 (Notified on 9th August 2019) comes into prominence. Just as ITA 2000, BNS (New IPC) , BSA (New IEA) are to be considered as an associate law of DPDPA 2023, both Telecom Act and the Consumer Protection Act 2019 (CPA2019) are considered associate laws compliance of which is essential to fulfil the compliance of DPDPA 2023. In this context we can highlight the notification of 30th November 2023 where the Government highlighted the practice of “Dark Patterns” with a list of practices as examples.

The notification defined “Dark Patterns” as any practices or deceptive design pattern using user interface or user experience interactions on any platform that is designed to mislead or trick users to do something they originally did not intend or want to do, by subverting or impairing the consumer autonomy, decision making or choice, amounting to misleading advertisement or unfair trade practice or violation of consumer rights.

In the Privacy Concept this can be considered as a “Practice that is harmful to the data principal” and is similar to the harm “manipulating the intention of the data principal” and “Deceiving the data principal to do things which he would not otherwise do”. This will apply to many E Commerce platforms who are all “Data Fiduciaries” under DPDPA 2023 and AI algorithms which process personal data.

The dark patterns singled out includes False Urgency, Basket Sneaking, Confirm shaming, Forced Action, Subscription trap, Interface interference, Bait and Switch, Drip Pricing, Disguised advertisement, Nagging, Trick question, Saas billing, Rogue malwares etc. (Kindly refer to the notification for explanations on each of these types of dark patterns).

The notification clearly prohibits use of dark patterns by stating “No person, including any platform, shall engage in any dark pattern practice”. The “Offences and Penalties” prescribed under the CPA 2019 include imprisonment and fine. A possible imprisonment of 6 months and fine of upto Rs 20 lakhs may be envisaged for most of the dark pattern practices provided that a complaint is filed by the Central authority authorized under the Act. (Similar to the powers of the DG of CERT In).

In view of these “Cross legislative Provisions”, DPDPA Compliance includes compliance of multiple laws as has been recognized by the DGPSI framework for compliance. This ensures that the “DPDPA 2023 as an Act and the rules to be framed thereunder” will continue to cover topics such as “Sensitive Personal Information ” and “harm to data principal” as well as “personal remedy” under different provisions of other laws.