SynopsisThe framework under the Digital Personal Data Protection Act is expected to go live in May 2027. Its success will depend on more than just legislation. In this context, DPDPA Forum, a non-profit, is emerging as a hub of dialogue and fresh standards.
India’s data protection regime is entering a decisive phase. The Digital Personal Data Protection Act (DPDPA), 2023, and the rules notified in November 2025 are intended to give citizens greater control over their personal information and impose clearer responsibilities on organisations that collect and process it.
But the success of the framework, expected to go live in May 2027, will depend on more than just legislation. It will be tested by how banks respond when customer records appear on the dark web, how digital-certification companies handle cryptographic failures, and whether organisations can prevent personal information from being copied, forwarded or stored indefinitely.
As S V Ramsunder, director of DPDPA Forum, puts it, “A plan is not readiness, a drill is.” Organisations must know where personal data sits, who can access it, why it is being processed and what happens when a breach is detected.
Ramsunder, a veteran of the Indian Army, said the Forum, a non-profit company based in Mumbai, aims to develop standards and frameworks, publish guidance on the law, and create a continuing platform for debate on privacy and data governance. The forum has currently published draft standards on areas including consent and data governance and sought comments from stakeholders.
For Ramsunder, data protection is an operational discipline requiring repeated practice, clear ownership and tested systems. “That is not only a legal problem, it is an operational one,” he said. “And operational problems are solved the way soldiers solve them, by drill.”
The wake-up call
Recent episodes involving the State Bank of India (SBI) and eMudhra underline the different dimensions of the challenge. In October 2026, SBI disclosed that it had identified 3,897 customer records containing personally identifiable information in a larger set of records found on the dark web. The bank said it had received alerts from its threat-intelligence provider, the Defence Cyber Agency and CERT-In. Its preliminary analysis covered about 375,000 records, while the source, authenticity and full extent of the exposure remained under investigation, according to media reports.
The information reportedly included names, mobile numbers, dates of birth, e-mail and residential addresses, customer-identification details and metadata linked to loan records. SBI said it had activated its cyber-incident response protocols and appointed an independent CERT-In-empanelled cybersecurity agency to investigate. It also said the incident had no material impact on core banking operations or business continuity.
The episode illustrates a central principle of data protection: a breach is not only a question of whether an organisation’s main database was hacked. It is also about where copies of information travel, who can access them, how third-party systems are monitored and how quickly the organisation can establish the chain of custody.
That requirement becomes difficult in large institutions with multiple vendors, legacy systems, e-mail archives, printed reports and data stored in informal channels. The most secure central database cannot compensate for a sensitive report sent to the wrong inbox or a customer document photographed on a personal phone.
The eMudhra incident highlights a different but equally important risk: the failure of trust infrastructure.
On October 17, 2026, a security researcher reported that cryptographic keys associated with eight eMudhra Global TLS intermediate certificate authorities were weak and potentially recoverable. eMudhra revoked the affected intermediate certificates on October 18. The company said the flaw resulted from insufficient randomness during key generation, but that no certificates had been issued from the affected intermediates and that there was no evidence of infrastructure compromise or a breach of customer data.
CERT-In said the compromised keys could potentially have been used to issue fraudulent TLS certificates, impersonate legitimate websites or intercept and modify communications. The incident concerned eMudhra’s global TLS certificate business and, according to the company and CERT-In, did not affect its regulated digital-signature and eSign services in India.
The eMudhra case is significant because it shows that data protection cannot be separated from the security of the systems that authenticate websites, encrypt communications and establish digital identity. Even when no customer database is stolen, a weakness in the trust chain can create the possibility of impersonation, credential theft, financial fraud and sensitive-data exposure.
It also demonstrates why security standards, audits and incident-response procedures must be backed by technical competence and transparent disclosure. A certificate authority does not merely store information; it helps determine whether users can trust the digital environment in which information is exchanged.
Breaches such as these will be dealt with seriously under the new law, which provides for hefty penalties to be levied by the regulator.
Meaning of consent
For citizens, however, privacy risks are often much more ordinary. They arise when a hotel photocopies an identity document, when a retailer demands a mobile number for a bill, when a small business retains documents after a transaction or when a service provider shares information with multiple vendors.
At a recent conclave organised by the Forum, Parveen Goribidnur, a data and AI-governance expert, argued that India’s privacy framework must be designed around the lived experience of the ordinary citizens. Recalling the difficulties faced by a farmer during biometric verification, she said digital policy must prioritise “ease of access, true inclusion, and dignity for every citizen”.
That principle is particularly important for consent. Ashok Yende, advocate and Supreme Court empanelled mediator, said consent must be active, informed and linked to a clearly explained purpose. “Consent should be very active consent,” he said. Citizens should understand what they are agreeing to, what data is being collected and what the consequences may be. “They should know what are the consequences of the consent,” Yende added.
The problem is that consent notices are frequently long, technical and difficult to understand. In practice, many users click “Accept All” because they have no realistic alternative or because the service is designed to make refusal inconvenient.
AI raises the stakes
AI increases both the value and the risk of personal data. AI systems can profile individuals, infer sensitive attributes, automate decisions and reproduce errors at scale.
M Nagarajan, a Gujarat cadre IAS officer and cybersecurity expert, said regulators were often forced into a “catch-up game” because technology was advancing faster than governance systems could understand and regulate it.
But he argued that regulation should not be seen solely as a restriction on innovation. The more important question was whether the right technology was being deployed in the right context.
“Innovation is not just about novelty, but application of the right technology in the right context,” Nagarajan said.
India’s opportunity
India’s size and digital infrastructure give it an opportunity to build privacy systems at scale. Ritesh Jain, former digital head at a foreign bank, described data protection as more than a compliance exercise. Organisations must first understand their data through data lineage and then build controls around it. “You can only protect what you know,” he said.
Jain believes India could develop an operating model for data protection that is practical across large enterprises, government systems and small businesses. Such a model could become part of India’s wider digital infrastructure and help the country export not only technology, but trust.
Rashmi M Oza, a human-rights jurist, cautioned that technological progress cannot come at the cost of individual rights. Privacy must be balanced with development, innovation and public interest through legality, proportionality and minimal intrusion.
That balance will be tested repeatedly. The DPDPA’s larger promise will be realised only when these principles become routine: collect less, explain more, retain only what is necessary, secure every transfer, maintain a human check on high-impact decisions and make accountability visible at every stage.
(Graphics by Mohommad Arshad)
7 mins read
Oct 30, 2026, 04:00:00 AM IST
Gift ETPrime to your friends
Now, gift ETPrime subscription to your friend for Free!
Gift this Story to your friends
Share member-only stories with your friends or family and help them read it for free.
- FONT SIZEAbcSmallAbcMediumAbcLarge
- SAVE
- COMMENT
Refer & Earn
