Sahil Gadkari

To be an Effective DPO in India DPDPA Rules will be available in draft form shortly. The list of rules mandated under the Act is available https://lnkd.in/g4G5qMug Apart from the definition of Significant Data Fiduciary, one of the important rules that is expected would be related to the concept of "Consent Manager". This is another area where Naavi may hold a view different from that of some of the other professionals. While many would try to make the role of "Consent Manager under DPDPA" and extension of the "Account Aggregator" under RBI/DEPA framework, Naavi would like the concept to be improved. Without knowing the mind of MeitY it is difficult to make any comment right now. However, if any of you have a view on how different should the "Consent Manager scheme under DPDPA" should be compared to the Account aggregator scheme, I request you to share it. #accountaggregator #consentmanager #naavi #dpdpa

84

2 Comments

#CyberCrimeAlert A new cybercrime has been uncovered in the Purnia district of #Bihar, where criminals were able to steal money from victims' bank accounts without the need for an OTP (One-Time Password) or any phone calls. The incident came to light on July 12, 2024. The police have arrested 8 members of this gang. Wondering how can this happen? Well, The criminals obtained the victims' Aadhaar biometric data, such as fingerprints, from their land records on a government website. They then used this biometric data to access the victims' bank accounts and transfer money without the need for an OTP or any phone calls. The ease with which criminals obtained and used this data to steal money without OTPs raises serious concerns about the security of our biometric information. It is crucial that we all take steps to protect our digital identities. Try locking you Aadhar Biometrics (if not in use). If you have experienced any cybercrime, please share in the comments below. [Credits - The Logical Indian ] #CyberLaw #CyberCrime #Lawyer #Law #Legal #Aadhar #AadharCard #UIDAI

24

DPDPA Rules will be available in draft form shortly. The list of rules mandated under the Act is available https://lnkd.in/g4G5qMug #dpdpa #dataprivacylaws #dataprotection #grc

7

Pleased to announce 9th Batch of DSCI Certified Data Protection Officer Program scheduled from 29th April to 1st May 2024 at SCOPE Complex, Delhi DSCI Certified Data Protection Officer is a 3-day program specifically designed for Data Protection Officers and their teams. 👉 Register: https://lnkd.in/daKqKZPR Key Topics: - Data Centrality: Trust and Ethics - Data Protection in Enterprise Environment - Data Protection Regime - Subject Matters of Data Protection - Data Protection Roles - DPIA, Data Audit, Sense of Privacy in Enterprize Systems - Sectoral Perspective - Tech Stack for Data Protection - Framework for Implementing Data Protection Programs, Governance - Monitoring and Incident Management - Digital Public Infrastructure and Privacy

42

1 Comment

My Expectations in First 100 Days from this Government: 1. Steps to reduce the divide between rich and poor 2. Notifying The DPDPA 2024 Rules and Data Protection Board 3. Notifying Rules under the Bhartiya Saksha Adhiyam 2023 4. Bringing in The New AI Act of India 5. Bring in The ODR (Online Dispute Resolution) Act , making lower judiciary online 6. Regulations for Quick Commerce companies 7. Regulations for EV and Hydrogen fuel Manufacturing and recycling of batteries. 8. To make Water travel the new highway travel by introduction of water metros 9. Mobile based delivery of Egovernance 10. Establishing Innovation to market hubs and supporting them in goto foreign markets #government #publicpolicy #policy #law #election #citizen #innovation #leadership #technology #management #education #AI #IT #ecommerce

86

10 Comments

Airtel's Data Leak and India's Digital Personal Data Protection Act, 2023 (DPDP Act) Recently, news spread about a potential data leak involving Airtel's 370 million+ users. Airtel clarified that no such breach occurred. But what if it had? Section 18 of the DPDP Act establishes a Data Protection Board which has the authority to impose penalties up to Rs 250 crores on data fiduciaries like Airtel for failing to prevent data leaks. The catch? Despite being passed by Parliament and receiving Presidential assent, the DPDP Act has yet to be notified, rendering it ineffective for now. In this video, I delve into this issue and explain it in detail. #DataProtection #Airtel #DPDPAct #CyberSecurity #PrivacyLaws #IndiaTech #LegalUpdate #CorporateLaw #StartupLaw

318

5 Comments

𝐔𝐏𝐒𝐂 𝐭𝐨 𝐈𝐧𝐭𝐫𝐨𝐝𝐮𝐜𝐞 𝐅𝐚𝐜𝐢𝐚𝐥 𝐑𝐞𝐜𝐨𝐠𝐧𝐢𝐭𝐢𝐨𝐧 & 𝐀𝐈 𝐒𝐮𝐫𝐯𝐞𝐢𝐥𝐥𝐚𝐧𝐜𝐞 𝐭𝐨 𝐒𝐚𝐟𝐞𝐠𝐮𝐚𝐫𝐝 𝐄𝐱𝐚𝐦 𝐈𝐧𝐭𝐞𝐠𝐫𝐢𝐭𝐲 🔍📚 Exciting news in the realm of exam security! The UPSC is rolling out advanced facial recognition and AI-based CCTV surveillance systems to ensure fair conduct in exams. This move comes in response to rising concerns over malpractices in national tests. 𝐊𝐞𝐲 𝐇𝐢𝐠𝐡𝐥𝐢𝐠𝐡𝐭𝐬: •𝑨𝒂𝒅𝒉𝒂𝒂𝒓-𝑩𝒂𝒔𝒆𝒅 𝑨𝒖𝒕𝒉𝒆𝒏𝒕𝒊𝒄𝒂𝒕𝒊𝒐𝒏: Utilizes fingerprint and facial recognition to verify candidate identities. •𝑨𝑰-𝑫𝒓𝒊𝒗𝒆𝒏 𝑴𝒐𝒏𝒊𝒕𝒐𝒓𝒊𝒏𝒈: AI-based CCTV systems will monitor exam halls in real-time, ensuring zero blind spots. •𝑳𝒂𝒓𝒈𝒆 𝑺𝒄𝒂𝒍𝒆 𝑰𝒎𝒑𝒍𝒆𝒎𝒆𝒏𝒕𝒂𝒕𝒊𝒐𝒏: Covers around 80 exam centers, affecting approximately 2.6 million candidates annually. •𝑹𝒆𝒂𝒍-𝑻𝒊𝒎𝒆 𝑨𝒍𝒆𝒓𝒕𝒔: Systems will generate alerts for any suspicious activities or system anomalies. 𝐇𝐨𝐰 𝐀𝐈 𝐢𝐬 𝐏𝐥𝐚𝐲𝐢𝐧𝐠 𝐚 𝐑𝐨𝐥𝐞: AI is revolutionizing exam security by providing real-time monitoring and ensuring the integrity of the examination process. The use of facial recognition and AI-driven surveillance helps in: •Real-time monitoring and alerts ensure no unauthorized activities go unnoticed. •Advanced verification techniques prevent impersonation and fraud, maintaining the integrity of the exams. •AI systems ensure transparent and unbiased monitoring, free from human error. 𝐑𝐞𝐠𝐮𝐥𝐚𝐭𝐢𝐧𝐠 𝐀𝐈 𝐭𝐨 𝐀𝐯𝐨𝐢𝐝 𝐌𝐢𝐬𝐡𝐚𝐩𝐬: To harness the benefits of AI while avoiding potential pitfalls, the following regulations can be implemented: •Ensuring that all biometric data is stored securely and used ethically. •Regularly updating AI algorithms to prevent biases and ensure fair monitoring. •providing clear guidelines on how AI systems are used and monitored, ensuring accountability. •Maintaining a balance between AI surveillance and human invigilators to handle complex situations. How do you think the implementation of AI in exam monitoring will impact the fairness and integrity of competitive exams? Feel free to share your thoughts in the comments! Let's discuss how technology can shape the future of exam security. 🚀 https://lnkd.in/dJhwttBh Disclaimer: The Content in this post is for informational purposes only derived from references and does not constitute any professional advice. We do not claim ownership of any data or Information referenced. #ExamSecurity #AI #FacialRecognition #UPSC #Innovation #AInews #WithLaw #WithLawConsultech #WithLawPeople #learnWithLaw With Law Consultech

4

Hurry ! The DPDP Act imposes penalties for non-compliance ranging from INR 10,000 (approximately USD 120) to INR 250 Crores (approximately USD 30,066,632), depending on the nature of non-compliance. Write to us incase you need assessment for your technology. #compliance #dpdpa #penalty #noncompliance #pharma #hospital #cro #technology #medicaldevice

5

BSNL Big data breach exposes million customers to SIM card crimes, financial frauds, Privacy Violation etc This #Databreach,m was orchestrated by a #hacker known as 'kiberphant0m', involves critical data including International Mobile Subscriber Identity (IMSI) numbers, SIM card information, Home Location Register (HLR) details, DP Card Data, and even snapshots of BSNL's SOLARIS servers. In total, over 278GB of sensitive information has been compromised. Hacker priced the stolen data to sell only at $5,000 (around ₹4,17,000). ➡️ What should BSNL users do? They should monitor for unusual activity on their phones and bank accounts. They should also enable two-factor authentication (2FA) for an additional layer of security on all socialmedia, payment wallets,banking and email accounts. All sms and calls received should be evaluated with caution as phishing schemes and social engineering attacks would be on rise. This crime may become the first crime to be registered under new The Telecommunications Act, 2023 and other laws, Also remains to be seen how the DPDP Act may come into play. #hacking #cybersecurity #cybercrime #bsnl #mtnl #telecom #law #policy #cyberawareness #privacy #dpdpa #dataprotection #technology #leadership #lawyer #news #media #forensics #osint #devops #infosec #IT #grc #iso #soc #isms

140

21 Comments

The government plans to release the Digital Personal Data Protection Rules (DPDP Rules) for public consultation before the beginning of the upcoming parliamentary session .The DPDP Act, the first India digital personal data protection bill, was established to protect the privacy and security of personal data. It outlines rules for organizations that handle personal data and emphasizes the importance of individual consent in accessing, correcting, or deleting personal information. The act applies to organizations dealing with digital personal data in India or processing this data outside of India, but related to offering goods or services to people in India. In particular, section 8 paragraph 2 of the Act clearly states: “A Data Fiduciary may engage, appoint, use, or otherwise involve a Data Processor to process personal data on its behalf for any activity related to the offering of goods or services to Data Principals only under a valid contract.” Obtaining consent by the DPDP Act requires several practical steps to ensure compliance: · Organizations must ensure that they have a clear understanding of the DPDP Act and its requirements, and conduct internal and external audits to assess their data protection and privacy practices. This step helps organizations identify any gaps or areas for improvement. · Organizations must clearly explain to individuals the purpose and intended use of their data. This can be done through easily understandable terms and conditions or privacy policies. · It is essential to allow individuals to give their consent freely, without any coercion or pressure. This can be achieved by implementing clear and prominent consent checkboxes or buttons, allowing individuals to opt in or opt out actively. · Organizations should allow individuals to easily withdraw their consent at any time. Documenting and maintaining records of all obtained consents is crucial to demonstrate accountability and compliance with the DPDP Act. By following these practical steps, organizations can ensure they have obtained valid consent from individuals, thus protecting them privacy and meeting legal requirements. https://lnkd.in/gXTP_4w5 Follow us on Linkedin to stay updated with the latest news and updates on DPDP Acts 2023

9

Have you heard of the new DPDPA?🤔 No, I am not referring to India's much-awaited DPDPA rules. I am talking about Delaware's Personal Data Privacy Act (DPDPA), which was passed in 2023. This legislation sets stringent rules for businesses handling Delaware residents' data, emphasizing transparency, consent, and security. The state's consumer protection unit recently introduced a personal data privacy portal before the January 1, 2025 DPDPA enforcement. It's noteworthy to see a state-level body take such proactive measures to safeguard user privacy, reflecting the growing importance of privacy in our increasingly digital world. The portal is an innovative platform to educate citizens about their rights and empower them to address privacy challenges effectively. By providing clear explanations and resources, the portal makes it easier for you to make informed choices about your data. This initiative by Delaware CPU is worth noting for other governing bodies who are monitoring the implementation of privacy laws within their jurisdiction. As technology evolves, so do the risks to your personal information. Delaware's proactive approach not only addresses today's challenges but also prepares you for future privacy concerns. It sets a standard for how states can protect your privacy rights while embracing innovation. Delaware's new Personal Data Privacy Act (DPDPA), will introduce stringent rules for businesses handling Delaware resident's personal data. Major provisions of law deal with the requirements of having a clear privacy policy, limited data collection, and enhanced consumer rights to consent, opt-out, access, correct, and delete data. These laws provide consumers with greater control over their personal information. However, businesses may face increased operational costs and legal risks for non-compliance. Early preparation, robust security measures, and clear policy development are worth considering for anyone who is governed under this law. Businesses should start now to ensure compliance and uphold data security standards as they are required to meet the compliance requirements by January 2025. Can India take a page from the Delaware Data Protection Privacy Portal for its adoption of the Indian DPDPA? #DPDPA #DataProtection #DelawarePDPA #LawLife #YVLCInsight

13

𝐈𝐧𝐝𝐢𝐚’𝐬 𝐃𝐢𝐠𝐢𝐭𝐚𝐥 𝐏𝐞𝐫𝐬𝐨𝐧𝐚𝐥 𝐃𝐚𝐭𝐚 𝐏𝐫𝐨𝐭𝐞𝐜𝐭𝐢𝐨𝐧 𝐀𝐜𝐭 2023 The Indian parliament enacted India’s first comprehensive data protection law on 11 August 2023, namely the Digital Personal Data Protection Act 2023 (the DPDPA). The DPDPA will replace India’s existing patchwork of data protection rules and is expected to trigger significant changes in how companies subject to Indian data protection laws process personal data. However, the law is not yet operational; no effective date has been established and there is no official timeline for the overall implementation. Stakeholders expect the law to come into force in a phased manner in the next six to 12 months, after: 1. An independent agency responsible for enforcing the DPDPA — the Data Protection Board of India (the Data Protection Board) — is established; and 2.  The Indian government has framed the subordinate rules (which are expected to provide interpretative guidance on procedural steps and enforcement methodology). The DPDPA is triggered when digital personal data is processed within India. The global counterpart of this act would be General Data Protection Regulations (the GDPR) applicable on EU Nations. 𝐒𝐜𝐨𝐩𝐞: The DPDPA regulates the processing of digital personal data, i.e., personal data collected in digital form, or collected in non-digital form and subsequently digitised. Whilst the DPDPA’s personal data definition is similar to that provided under the GDPR, it excludes from its scope personal data made publicly available by the data principal or by any other person under a legal obligation to make that data publicly available. 𝐋𝐞𝐠𝐚𝐥 𝐛𝐚𝐬𝐢𝐬 𝐟𝐨𝐫 𝐩𝐫𝐨𝐜𝐞𝐬𝐬𝐢𝐧𝐠 𝐨𝐟 𝐩𝐞𝐫𝐬𝐨𝐧𝐚𝐥 𝐝𝐚𝐭𝐚: The DPDPA provides that data fiduciaries may lawfully process personal data only with the consent of the data principals or for certain specified “legitimate uses”. 𝐂𝐫𝐨𝐬𝐬-𝐛𝐨𝐫𝐝𝐞𝐫 𝐝𝐚𝐭𝐚 𝐭𝐫𝐚𝐧𝐬𝐟𝐞𝐫𝐬: The DPDPA permits cross-border data transfers to jurisdictions outside of India other than those jurisdictions specifically identified by the Indian government on its list of countries to which data transfers are restricted (to be published); otherwise, the DPDPA does not require the implementation of a transfer mechanism. 𝐃𝐚𝐭𝐚 𝐛𝐫𝐞𝐚𝐜𝐡 𝐧𝐨𝐭𝐢𝐟𝐢𝐜𝐚𝐭𝐢𝐨𝐧: Data fiduciaries are required to notify personal data breaches to the newly created Data Protection Board and to impacted data subjects, regardless of the magnitude of the breach or risk of harm. Further, the DPDPA does not prescribe specific deadlines for reporting. 𝐒𝐢𝐠𝐧𝐢𝐟𝐢𝐜𝐚𝐧𝐭 𝐝𝐚𝐭𝐚 𝐟𝐢𝐝𝐮𝐜𝐢𝐚𝐫𝐢𝐞𝐬: The Indian government will have the power to classify certain data fiduciaries as significant data fiduciaries based on factors such as the sensitivity and volume of data processed, the impact of processing on the rights of data principals, and the impact on the sovereignty, security, and integrity of India.

15

The rules for enforcement of Digital Data Protection Act, 2023 is part of the 100 days agenda of the govt, will that be fulfilled? Regulation of AI, Digital India, overhauling of IT Act, continues to be speculated,

75

1 Comment

🚨 Beware of Fraudsters Impersonating Customs Officers! 🚨 Various incidents have come to light where fraudulent individuals pose as Indian Customs officers, preying on the public’s fear of immediate penal action. These scams primarily use digital means like phone calls or SMS to extract money. Modus Operandi Used by Fraudsters: Fake Calls/SMS: Fraudsters posing as Courier officials/staff contact via calls, text messages or emails claiming that Customs have held a package or parcel and requires payment of Customs duties or taxes before it can be released. Pressure Tactics: Fraudsters impersonating Customs/Police/CBI officials demand payment of Customs duty/clearance fees for packages/gifts that purportedly have been received from a foreign country and require Customs clearance. Targeted individuals are asked to make payments for the release of their goods. Demand of Money: Targeted persons are informed that their package has been seized by Customs due to illegal contents (such as drugs/foreign currency/fake passport/contraband items) or violations of Customs regulations. Fraudsters threaten legal action or fines and demand payment to resolve the issue. CBIC advises the public to take the following measures to safeguard themselves from becoming a victim of such scams by:   DISCERN: Indian Customs officers never contact the general public via phone, SMS, or e-mail for payment of duty in private accounts. Disconnect calls and never respond to messages, if you suspect fraud or encounter any irregularities.  PROTECT: Never share or disclose personal information (Passwords, CVV, Aadhar number, etc.), or send money to unknown individuals or organizations without verifying their identity and legitimacy. VERIFY: All communications from Indian Customs consist of a Document Identification Number (DIN), which can be verified on the CBIC website: https://lnkd.in/dpQ_4Zcx  REPORT: Immediately report such cases to www.cybercrime.gov.in or helpline number 1930. Stay vigilant! Let’s protect ourselves and our hard-earned money. 🛡️

3

What to Expect from DPDPA Rules #dpdpa #naavi #fdppi #significantdatafiduciary #gdpr The Privacy Community of India is waiting for the elections to be over so that the rules under DPDPA 2023 could be released. Hopefully the 100 day program of the Modi 3.0 includes the notification of the rules. We urge that the Government will continue to show the courage to tread its own path in framing the rules without being bogged down by the GDPR and other considerations. Let DPDPA be a "Made in Bharath" act and let even the rules should reflect this. Currently, the introduction of concepts like "Fiduciary" instead of "Controller", Rights like "Nomination", Categories like "Consent Manager", "Data Auditor" etc., DPDPA has broken the myth that GDPR is the gold standard of Privacy and Data Protection and occupied an independent space amongst global data protection laws. Similarly, some innovations are required to be considered when the rules are followed. We request the MeitY to consider one such principle that will make a huge difference to the "Compliance" of the Act by defining the "Significant Data Fiduciary" with reference to a "Process" and not to an "Entity". What this means is that it would not be Company A or Company B which would be designated as "Significant Data Fiduciaries" but "Process X" or "Process Y" of a company. This means that a Company A may have processes X, Y, Z of which one can be Significant data fiduciary process, other can be an ordinary data fiduciary process and yet another could be a data processor activity. This can be achieved through the definition of "Class of data fiduciaries" used in Section 10. Read more at: https://lnkd.in/gQpt7Eit

75

9 Comments

Here's what you need to know about India’s DPDPA. The Union government plans to notify the rules for the Digital Personal Data Protection Act (DPDPA) within the first 100 days of the next government, as reported by Business Standard. This move will significantly impact the management of digital personal data in India. (Source: https://lnkd.in/gmxtYkZM) Explore this detailed mind map that outlines the key components of the Act, designed to enhance your understanding of the legislation. #dataprotection #privacy #dpdpa #india

91

2 Comments

Privacy isn’t just a preference, it’s a requirement. Join our webinar to understand how the Digital Personal Data Protection Act 2023 and GDPR have transformed privacy from an ethical choice to a legal obligation. Speaker: Professor TK Srikanth, International Institute of Information Technology Bangalore, expert in #dataprivacy and digital systems. He is a co-convenor of the E-Health Research Center (EHRC) at IIITB (ehrc.iiitb.ac.in), and is actively involved in multiple collaborative research projects in healthcare, with a focus on #mentalhealth and #publichealth. Moderated by Divya Raj. Agenda highlights: • How privacy laws influence digital system design • The evolution of privacy standards and practices • Challenges faced by developers in ensuring privacy • Practical strategies for privacy-aware application design Ideal for: Designers, developers, and anyone involved in creating digital platforms. Register now: https://lnkd.in/g4T6usme Ameya Ashok Naik #techforgood #privacydesign

27