Today's Headlines

1. India's Data Protection Board: Established In Law, Absent In Fact - Live Law

Source: Google News DPDP | Read Original →

Nearly three years post-enactment, the Data Protection Board of India (DPBI), a critical enforcement body for the DPDP Act 2023, remains unformed. This ongoing delay leaves a significant vacuum in the regulatory framework, creating uncertainty for Data Fiduciaries regarding grievance redressal and the impending enforcement of penalties. Businesses are operating without a clear authority to address compliance ambiguities or adjudicate disputes under the Act.

2. Anthropics AI hacked three companies during tests, highlighting growing security risks

Source: Livemint Tech | Read Original → Anthropic's AI models successfully breached the systems of three companies during controlled security tests, showcasing the advanced capabilities of AI in exploiting vulnerabilities. This incident underscores the escalating cybersecurity risks posed by sophisticated AI tools, demanding that Data Fiduciaries strengthen their technical and organisational measures under Section 8(5) of the DPDP Act to prevent Personal Data breaches. Failure to do so could lead to significant penalties, potentially up to ₹250 Cr, for a single breach incident.

3. How Meta’s AI glass puts civilian privacy at risk | Explained

Source: The Hindu Tech | Read Original → Meta's AI-powered smart glasses are under scrutiny for their potential to capture audio and video discreetly, raising substantial concerns about civilian privacy and the right to peaceful protest. This development highlights the challenge for technology developers and deployers to ensure transparent Personal Data collection and respect the Rights of Data Principals under the DPDP Act, especially concerning incidental data capture in public spaces.

4. As privacy backlash grows, Meta reassures public about AI glasses

Source: The Hindu Tech | Read Original →

Amid increasing public backlash, Meta has clarified the privacy safeguards embedded in its AI glasses, including a mechanism that disables the camera if the recording indicator light is tampered with. While an effort to address concerns, this scenario underscores the critical need for explicit and informed consent as per Section 6 of the DPDP Act for any Personal Data collection, particularly when wearable technology blurs the lines of public and private space. Businesses innovating in this domain must prioritise privacy by design.

5. India’s DPDP Rules and GCC Employment Data: Why HR Compliance Needs a Privacy Reset - Nasscom

Source: Google News DPDP | Read Original → Nasscom has issued a strong advisory indicating that the forthcoming DPDP Rules will necessitate a comprehensive overhaul of Human Resources data management practices for Global Capability Centers (GCCs) and other Indian enterprises. This means companies must re-evaluate their entire employee data lifecycle – from hiring to offboarding – to ensure compliance with DPDP Act principles like data minimisation, consent for processing Personal Data, and secure storage under Section 8 — Data Fiduciary obligations.

---

DPDP Impact Analysis

The absence of the Data Protection Board of India (DPBI) continues to cast a long shadow over the full implementation and enforcement of the DPDP Act 2023. For Indian businesses, this means a protracted period of regulatory uncertainty, where the ultimate adjudicator for data protection complaints and the authority for imposing penalties remains in limbo. While the Act's provisions are law, the lack of a functional DPBI significantly hinders clarity on compliance nuances, slowing down the establishment of clear precedents and an efficient redressal mechanism for Data Principals. Businesses are left in a holding pattern, knowing the rules exist but lacking the full operational framework for compliance assurance and enforcement.

Concurrently, the evolving landscape of Artificial Intelligence presents a dual challenge. On one hand, as demonstrated by Anthropic's AI models successfully hacking companies, AI is rapidly becoming a sophisticated tool for cyberattacks. This demands that Indian Data Fiduciaries drastically elevate their data security protocols, ensuring their systems are robust enough to withstand AI-powered threats as mandated by Section 8(5) of the DPDP Act. The consequences of failing to do so, particularly in the event of a Personal Data breach, remain severe, with penalties potentially reaching ₹250 Cr.

On the other hand, AI's integration into consumer devices, such as Meta's AI glasses, introduces complex privacy dilemmas regarding passive data collection. Businesses developing or deploying such technologies in India must meticulously navigate the requirements for obtaining explicit consent under Section 6, adhering to purpose limitation under Section 5, and respecting the Rights of Data Principals. The backlash against Meta's glasses underscores that public expectation for privacy and transparency will drive enforcement, even in the absence of a fully operational DPBI.

Finally, the Nasscom advisory on HR data compliance highlights that the DPDP Act's impact is pervasive, extending deep into an organisation's internal operations. Every Indian business, regardless of size or sector, processes employee Personal Data, making their HR departments critical nodes for compliance. A "privacy reset" for HR means re-evaluating everything from recruitment data collection to payroll processing and employee monitoring, ensuring strict adherence to Data Fiduciary obligations for Personal Data protection. This comprehensive re-evaluation is non-negotiable for all employers.

Collectively, today's news reinforces that while the DPBI's establishment is delayed, the core principles and responsibilities enshrined in the DPDP Act are very real and continue to impact Indian businesses. From safeguarding against advanced AI threats and navigating ethical AI deployment to overhauling internal HR data practices, proactive compliance, robust security measures, and transparent data handling remain paramount. Businesses cannot afford to wait; the legal mandate and the potential financial penalties are too significant to ignore.

---

Stay Compliant

Not sure if your business meets DPDP standards? Start with a free check:

🔍 Run Your Free DPDP Audit →

16 questions. 60 seconds. Instant risk report.

---

Published by DPDP News, a Meridian Bridge Strategy initiative. For compliance consulting, book a free call.