Today's Headlines

1. Crypto wallet provider SafePal discloses data breach affecting nearly 40,000 users order information

Source: Livemint Tech | Read Original →

Crypto wallet firm SafePal has announced a data breach impacting the order information of approximately 40,000 users, though no wallet funds were compromised. This incident highlights the critical need for robust data security protocols for any entity handling personal data, underscoring the potential for severe penalties under the DPDP Act. Under Section 8 — Data Fiduciary obligations, entities failing to implement reasonable security safeguards can face fines up to ₹250 Crore per incident.

2. Surveillance without statute: The constitutional void in India’s facial recognition policy - Bar and Bench

Source: Google News DPDP | Read Original →

A recent analysis in Bar and Bench points out the significant constitutional void in India's current facial recognition technology (FRT) policy, noting a lack of specific statute governing its use. While the DPDP Act lays down broad principles for processing personal data, including the need for lawful purpose (Section 6) and consent (Section 7), the absence of a dedicated legal framework for FRT creates uncertainty. This raises questions about the scope of legitimate processing and the safeguards required for biometric data, a form of sensitive personal data.

---

DPDP Impact Analysis

Today's headlines present a dual challenge for Indian businesses: the immediate and tangible risks of data breaches, and the evolving, less defined landscape of emerging technologies like facial recognition. The SafePal breach serves as a stark reminder of the non-negotiable requirement for data fiduciaries to implement stringent security measures. Any Indian business processing personal data, regardless of sector or size, must understand that a breach impacting Indian citizens could trigger significant investigation by the Data Protection Board of India (DPBI) and lead to penalties up to ₹250 Crore under Section 17. This necessitates not just preventative security, but also a robust incident response plan and clear protocols for data breach notification.

Simultaneously, the discussion around facial recognition technology (FRT) highlights a different kind of compliance hurdle: navigating technological advancements in the absence of explicit, comprehensive statutory guidance. While the DPDP Act provides foundational principles such as the need for lawful purpose and consent, and the obligation to protect personal data, it doesn't offer specific rules for technologies like FRT. This places the onus on businesses to interpret the general principles of the Act cautiously, especially when dealing with sensitive personal data like biometrics.

For Indian startups and businesses looking to leverage FRT, the current "constitutional void" signals a need for extreme prudence. Adhering to the principles of data minimization, purpose limitation, and obtaining clear, informed consent (as per Section 7) becomes paramount. Businesses must also consider their potential designation as a Significant Data Fiduciary if their FRT deployment involves processing a large volume of sensitive personal data or poses a high risk to data principals, triggering additional obligations under Section 10.

Collectively, these articles underscore that data protection in India is a dynamic field. Businesses cannot simply react to breaches; they must also proactively engage with the ethical and legal implications of new technologies, even as the regulatory framework continues to evolve. Strong internal governance, regular data protection impact assessments, and a keen eye on impending clarifications or new rules will be crucial for maintaining compliance and building trust in this rapidly developing environment.

---

Stay Compliant

Not sure if your business meets DPDP standards? Start with a free check:

🔍 Run Your Free DPDP Audit →

16 questions. 60 seconds. Instant risk report.

---

Published by DPDP News, a Meridian Bridge Strategy initiative. For compliance consulting, book a free call.