Today's Headlines

1. CoinDCX launches ₹100 crore cybersecurity network after impersonation-linked controversy

Source: The Hindu Tech | Read Original →

Indian crypto exchange CoinDCX has unveiled a significant ₹100 crore Digital Suraksha Network dedicated to bolstering cybersecurity, research, and user education. This proactive measure follows an "impersonation-linked controversy," underscoring the critical need for robust data protection frameworks, aligning with Section 8 (5) (a) and (b) of the DPDP Act concerning reasonable security safeguards.

2. Kenya probes Meta Ray-Ban smart glasses privacy concerns

Source: The Hindu Tech | Read Original →

Kenya's data protection authority has launched an investigation into Meta Ray-Ban smart glasses over privacy concerns, specifically scrutinizing the "unlawful processing of data to train Meta AI." This international development highlights growing regulatory scrutiny on emerging technologies that passively collect personal data, setting a precedent for how global data protection boards, including India's, may interpret Section 5 (Purpose Limitation) and Section 6 (Consent) for AI-driven data collection.

3. 96% of Indian Websites Collect User Data Without Consent, Reveals Largest DPDP Compliance Study - Tribune India

Source: Google News DPDP | Read Original →

A recent comprehensive study has uncovered a startling statistic: an estimated 96% of Indian websites are reportedly collecting user data without obtaining explicit consent. This finding signals a significant and widespread compliance gap across the digital landscape, directly contravening Section 6 (Consent) of the DPDP Act 2023, which mandates clear, specific, and unambiguous consent for processing personal data.

---

DPDP Impact Analysis

Today's news paints a stark picture for Indian businesses regarding their compliance readiness under the Digital Personal Data Protection (DPDP) Act 2023. The revelation that a staggering 96% of Indian websites are collecting user data without explicit consent is not merely a statistic; it's a massive regulatory red flag for every Data Fiduciary operating online. This widespread non-compliance with Section 6 (Consent) exposes virtually all online businesses to potential penalties, which can soar up to ₹250 crore for significant breaches. The era of implied consent is over; businesses must urgently implement robust Consent Management Platforms (CMPs) and ensure their data collection practices are transparent, specific, and affirmative.

Adding to the urgency, CoinDCX's substantial investment in a Digital Suraksha Network following an "impersonation-linked controversy" underscores the critical importance of proactive cybersecurity. While a commendable step, it highlights that many businesses often strengthen their defenses only after a data incident. The DPDP Act, particularly Section 8 (Reasonable Security Safeguards), places a clear obligation on Data Fiduciaries to prevent such incidents from occurring in the first place. Businesses cannot afford to wait for a breach; implementing comprehensive security measures is not just good practice but a statutory requirement to avoid hefty fines and reputational damage.

Furthermore, the investigation into Meta Ray-Ban smart glasses in Kenya, focusing on privacy concerns related to AI training, serves as a crucial international precedent for Indian businesses developing or deploying emerging technologies. As AI, IoT, and smart devices become more prevalent in India, the Data Protection Board of India will likely scrutinize data collection and processing methods under Section 5 (Purpose Limitation) and Section 6 (Consent). Indian startups and tech companies must embed "Privacy by Design" principles from the outset, ensuring that new innovations comply with data protection laws both domestically and by observing global trends.

Collectively, these developments indicate that the grace period for DPDP compliance is rapidly closing. The Act is not just a legal framework but a fundamental shift in how businesses handle personal data. From the basic requirement of obtaining explicit consent for website data collection to implementing advanced cybersecurity and navigating the complexities of emerging technologies, Indian businesses must prioritize data protection as a core operational imperative. Proactive compliance is no longer optional; it is essential for business continuity, trust, and avoiding severe financial and legal repercussions.

---

Stay Compliant

Not sure if your business meets DPDP standards? Start with a free check:

🔍 Run Your Free DPDP Audit →

16 questions. 60 seconds. Instant risk report.

---

Published by DPDP News, a Meridian Bridge Strategy initiative. For compliance consulting, book a free call.