Section 14 of the DPDPA recognises the “Right to Nominate” as a right of the Data Principal.

The DPDP Rules, 2025 leave certain aspects of this right open to debate, as they appear legally unclear.

The section 14 of DPDPA 2023 states as follows:

Right to nominate.

(1) A Data Principal shall have the right to nominate, in such manner as may be prescribed, any other individual, who shall, in the event of death or incapacity of the Data Principal, exercise the rights of the Data Principal in accordance with the provisions of this Act and the rules made thereunder.

(2) For the purposes of this section, the expression “incapacity” means inability to exercise the rights of the Data Principal under the provisions of this Act or the rules made thereunder due to unsoundness of mind or infirmity of body.

The Rule 14(4) of the DPDPA Rules indicate the following:

(4) To exercise the rights of the Data Principal under the Act, she may, in accordance with the terms of service of the Data Fiduciary and such law as may be applicable, nominate one or more individuals, using the means and furnishing the particulars required by such Data Fiduciary for the exercise of such right.

There are several issues in this Section that are debatable under law. Let us discuss them here.

These provisions of DPDPA need to be read along with ITA 2000, Section 1(4) which states as follows

“Nothing in this Act shall apply to documents or transactions specified in the First Schedule by way of addition or deletion of entries thereto”

The schedule I of the Act indicates the following as a document included under this section.

A will as defined in clause (h) of section 2 of the Indian Succession Act, 1925 (39 of 1925) including any testamentary disposition whatever name called.

In view of the above, if the  nomination is in the “Electronic” form as a part of the privacy notice and consent, it would not be recognized as a legally valid document and hence whether it is digitally signed or supported by other means of authentication such as OTP it shall have no validity. Alternatively, the “Nomination” should be treated only as a “Transfer of Custody” of the asset and not like a testamatory document.

Nomination may however be obtained through a written form.

To understand the problem, we can explore the concept of Nomination in other laws particularly in the Banking where there are specific detailed instructions.

The Banking Regulation Act defines  “Nomination” as follows.

45ZA. Nomination for payment of depositors’ money.

(1)Where a deposit is held by a banking company to the credit of one or more persons, the depositor or, as the case may be, all the depositors together, may nominate, in the prescribed manner, one person (Ed: or upto 4 persons as per later amendment) to whom in the event of the death of the sole depositor or the death of all the depositors, the amount of deposit may be returned by the banking company.
(2)Notwithstanding anything contained in any other law for the time being in force or in any disposition, whether testamentary or otherwise, in respect of such deposit, where a nomination made in the prescribed manner purports to confer on any person the right to receive the amount of deposit from the banking company, the nominee shall, on the death of the sole depositor or, as the case may be, on the death of all the depositors, become entitled to all the rights of the sole depositor or, as the case may be, of the depositors, in relation to such deposit to the exclusion of all other persons, unless the nomination is varied or cancelled in the prescribed manner.

(3) Where the nominee is a minor, it shall be lawful for the depositor making the nomination to appoint in the prescribed manner any person to receive the amount of deposit in the event of his death during the minority of the nominee.

(4) Payment by a banking company in accordance with the provisions of this section shall constitute a full discharge to the banking company of its liability in respect of the deposit
Provided that nothing contained in this sub-section shall affect the right or claim which any person may have against the person to whom any payment is made under this section.

Further, the Section 39 of the Insurance Act 1938 defines “Nomination by the Policy Holder” linking it to the event of the death of the policy holder. Rule 19 of the Companies (Share Capital and Debentures) Rules 2014 prescribes the procedure under the Companies Act.

Section 72 of the Companies Act states nomination in the context of shares as ” any person to whom his securities shall vest in the event of his death.”.

All the above regulations apply Nomination only in case of death and not in case of “Incapacity”. Also, in cases where the data principal is mentally incapacitated ab initio, the legal guardian is also called the “Data Principal” by definition. Hence the concept of nominee stepping into the shoes to exercise the rights of the now incapacitated data principal appears to contradict with the need for appointment of a legal guardian.

Further it is established that settlement of dues from a Bank to a nominee follows the “Trustee “Principle”.

The Trustee principle has been endorsed by the Supreme Court of India (in landmark judgments like Smt. Ram Chander Talwar v. Devender Kumar Talwar and Sarbati Devi v. Usha Devi)established that a nominee is merely a custodian or trustee. The Shakti Yezdani v. Jayanand Salgaonkar (SC, 2023) also upholds the same principle.

It is also clarified that the nominee has the legal right to receive the money from the bank, but they do not automatically inherit it. They are legally obligated to hand over those funds to the rightful legal heirs (as designated by a Will or by intestate succession laws)

The primary purpose of Section 45ZA(4) is to protect the banking institution.

• Once the bank verifies the account holder’s death certificate and the nominee’s identity, it transfers the money to the nominee.
• This payment gives the bank a full and valid discharge of its liability. It frees the bank from getting caught in bitter family disputes or waiting for time-consuming court orders like a Succession Certificate
• Up to Four Nominees: Following updates implemented under the Banking Laws (Amendment) Act, 2025, depositors can nominate up to four individuals per account.
• Simultaneous vs. Successive: Nominations can be made simultaneously (where you explicitly split percentages among up to 4 people, totaling exactly 100%) or successively (where Nominee B gets the funds only if Nominee A passes away before the account holder)
• Joint Accounts: If an account is held jointly (e.g., “Either or Survivor”), the nomination event is contingent upon the death of all depositors. The surviving joint holder always retains control of the funds over the nominee while alive.
• Minor Nominees: If a minor is chosen as a nominee, the account holder must appoint an adult guardian/appointee who is authorized to receive the funds on the minor’s behalf if the contingent event occurs during their minority

Sections 45ZC and ZE define the nomination related to safe custody articles and Safe Deposit lockers. Section 45ZG which was inserted after an amendment on November 1 2025 indicate the determination of the priority of nomniation when there are successive nominations. It states as follows:

Priority of successive nominations (Sec 45ZG)

(1) Where the nomination is made in favour of more than one person successively under sub-section (1) of section 45ZA or sub-section (1) of section 45ZC or sub-section (1) of section 45ZE, the nomination shall be effective only in favour of one person in the following order of priority, namely:––

(a) nomination of the first nominee shall be effective if that nominee survives the person or persons who made the nomination;

(b) nomination of the second nominee shall become effective only after the death of the first nominee;

(c) nomination of any nominee lower in the order of nomination shall become effective only after the death of all the nominees whose names are higher in the order of nomination.

(2) Where the order of nomination is not mentioned, persons shall be deemed to have been nominated in the order in which their names appear in the nomination.

(3) The provisions of this section shall not apply to the nominations made simultaneously in favour of more than one person under sub-section (1) of section 45ZA.]

RBI’s nomination may also apply to “Missing Persons” as declared under the BSA. According to Section 111 BSA a person is presumed dead if he has been missing for 7 years continuously.

RBI also permits statement of “Percentage of Nomination” as if nominations settle ownership. This is against the principle that “Nomination is only transfer of custody and not transfer of ownership”.

Hence it may be debated and can be held invalid.

The Gazette notification GSR 790(E) from Ministry of Finance dated 27th October 2025 prescribes the Nomination Rules for the Banks.

This Gazette notification provides the option of “E-Nomination” which is not in conformity with the ITA 2000.

This Gazette Notification is also not in conformity with ITA 2000 in terms of defining the methods of authentication of nomination to include OTP.

In all the above nominations systems, “Nomination becomes effective only in case of death”. The DPDPA however seems to follow the Mental Health Care Act 2017 (s 14) and states that Nomination becomes effective in the case of “Incapacity” of the data principal which is defined as

” inability to exercise the rights of the Data Principal under the provisions of this Act or the rules made thereunder due to unsoundness of mind or infirmity of body.”

This has a parallel in Section 14 of the Mental Healthcare Act, 2017, which allows a person to appoint a “nominated representative”. But unlike that Act, DPDPA provides no mechanism for certifying incapacity or for resolving conflicts with a guardian. Whether the provision works in practice needs examination.

The Considered view of the undersigned is that

1. a) Nomination on “incapacity” needs additional safeguards, including how incapacity is to be certified to the Data Fiduciary and how the nominee’s role relates to that of a lawful guardian under Section 2(j).
2. b) The Ministry of Finance Gazette Notification of 27th October 2025 needs revision in respect of electronic nomination.

Recently, RBI withdrew its notification in respect of opening of accounts by minors with “Independent” operation which was available after 10 years and was inconsistent with DPDPA definition of a “Child”.  Similarly, the above two anomalies may need to be corrected.

Under DPDPA, nomination should be treated as a transfer of custody of the data. On the death of the Data Principal, the purpose of processing generally comes to an end. Under Section 8(7), the Data Fiduciary must then erase the data unless retention is required by law, since continued storage only carries risk. Handing custody to the nominee, or erasing the data at the nominee’s request, discharges this obligation.

Multiple nominees create a practical problem. If they give conflicting instructions, for example one asking for custody and another for erasure, the Data Fiduciary has no way of knowing whom to follow..

The rights of the Data Principal are the rights of access, correction, erasure, grievance redressal and nomination. After death, only two of these remain meaningful: the right to take custody of the data and the right to have it erased. Once custody passes, the nominee holds the data as a trustee for the legal heirs and must deal with it only in that capacity. The other rights lose their purpose.

Also if the the nominee inherits all the rights of the data principal, he can nominate one or more persons as nominees to “exercise the rights of the Data Principal in accordance with the provisions of this Act and the rules “. This also appears inconsistent since the original purpose of collection and processing no longer exists and the continued processing cannot be considered feasible after the death of the data principal.

Hence there needs to be a further discussion on this and an amendment of rules if required.

FDPPI, (www.fdppi.in) in association with Cyber Law College (www.cyberlawcollege.in) of Naavi (www.naavi.org) is launching a program for “Training the Trainers for DPDPA”.

Interested persons may contact Naavi.

The curriculum, the fees, mode of conduct etc will be announced as and when an initial critical number of interested persons express their interest.

Naavi

We are now around 213 days from 13th May 2027 when DPDPA will be fully effective. Many organizations have already started implementation. Action has started on three fronts

1. Engagement of consultants for implementation
2. Conducting Awareness Training
3. Create a Governance Structure for implementation
4. Create Policy documents at all levels
5. Software for Compliance management mainly for “Consent Management”

Some organizations have followed the above order of implementation. Some have also used the reverse order believing that software will do the trick and achieve the compliance.

While one can argue which is the correct order in which Compliance drive should be approached, everybody agrees that there has to be a synchronization of the elements.

Since many organizations have already jumped in with the impolementation in some fashion based on their current understanding of the requirements, they are now wondering if they are in the right track.

As the festival of Dussehra symbolizes the triumph of good over evil, righteousness over discord, and clarity over ignorance, it is the perfect time for organizations to strengthen their digital trust and overcome compliance hurdles.

In today’s evolving regulatory landscape, with the Digital Personal Data Protection Act (DPDPA) ensuring robust Data Protection Impact Assessments (DPIA) is no longer optional; it is essential.

To mark this auspicious season, FDPPI (Foundation of Data Protection Professionals in India) is excited to announce a special Dussehra Offer for businesses looking to elevate their data governance framework.

To assist companies re-visit their current approach to DPDPA implementation, FDPPI and Naavi are giving a special offer for the Dussera 2026 which commences from today.

For all the Corporate members who enrol on a 3 yearmembership  plan (Visit for details) we would provide a free online DPIA session to enable review of their current implementation plan. A suitable appointment may be fixed for mutual convenience to discuss the current implementation plan and identify key areas of course correction if any.

Irrespective of whom the company is already working with, a second opinion from FDPPI is a peer review opportunity before the commitments reach an irreversible state.

Interested entities may contact Naavi or FDPPI through email.

Naavi

It has been an interesting last week when I visited two major Gramina Banks namely Rajashthan Gramina Bank in Jodhpur and Madhya Pradesh Gramina Bank in Indore to discuss with their senior staff such as General managers and Regional managers to discuss DPDPA.

The Gramina Banks after the mergers are one for each state and have 1500 or 2000 branches in their respective states. They therefore are bigger than many other small Banks in the urban areas. Some of these Gramina banks are also getting ready for listing in the Stock Markets. Hence they represent a very interesting study for the impact of DPDPA. Some of them may still depend on their sponsor banks for IT administration but many have developed their own systems also.

NABARD is providing the collective leadership for the 28 such Gramina banks along with the individual assistance the sponsoring Banks are providing to their sponsored entities.

We are watching how the roll out of DPDPA happens in these branches and what lessons can be drawn for the industry.

Naavi

Meity has issued a Gazette Notification on some minor corrections in DPDPA 2026.

The notification is available here.

The corrections are as follows:

1. Short title and commencement.— (1) This Order may be called the Digital Personal Data Protection (Removal of Difficulties) Order, 2026.
(2) It shall come into force on the date of its publication in the Official Gazette.
2. In the said Act,—
(i) in section 9, in sub-section (1), for the words “ child or a person with disability,” the words “child or of a person with disability ”shall be substituted;
(ii) in section 10, in sub-section (2), in clause (c), in sub-clause (ii), for the word “audit”, the words “data audit” shall be substituted;

Necessary modification will be done in www.dpdpa.in.

Naavi

The DGPSI System which started as a model DPDPA Compliance system in 2023 has come a long way in the last 3 years.

What started with DGPSI-Full Version later was modified as DGPSI-Lite version which we are now calling as DGPSI-SME. Subsequently DGPSI has developed in multiple directions. DGPSI-AI was an extension on the technology front. DGPSI HR was an attempt to address the DPDPA Compliance requirements on a functional basis. DGPSI-Hospital and DGPSI-Banks was an attempt to address the requirements of DPDPA Compliance in specific sectors. DGPSI-DP was another attempt to extend the Compliance framework to a category of activity and DGPSI-GDPR was an attempt to extend the framework to other legal frameworks. Together DGPSI has made FDPPI a “Standards Organization”.

DPDPA is a single law for all sectors and all sizes of companies. This was inevitable for the creation of the data protection law. But from the perspective of implementation in the industry this was a challenge which needed to be addressed. The “Framework” with different flavours for different purposes was therefore an attempt to make it possible for the industry to work on Compliance with appropriate modifications tailored to different industries.

In this journey it is now being explored if “Start UPs” can be considered as a “Class of Data Fiduciaries” for whom a simplified DGPSI Frameworks can be designed.

FDPPI has therefore started a project under the Title “Project May 13” to develop an exclusive framework of DPDPA Compliance that would address the “StartUP sector”. “Start Up sector” like the “SME Sector” can represent multiple industry sectors. There can be a Fintech Start up as well as a Health Care start up. But if there is a commonality between them as a “Start Up” it may be possible to create a Version of DGPSI like DGPSI-Lite which is a sector agnostic framework that is applicable to Start Ups.

Until now, DGPSI variants have broadly emerged around questions such as:

Which sector does it belong to?, What function is being addressed?, What technology is involved?, What activity is being performed? or Which law or regulatory framework applies?

Now DGPSI-Start Ups will start addressing the question:

Where is the organisation in its lifecycle? That could make lifecycle-based compliance an important future dimension of DGPSI.

A start-up could therefore move progressively from a basic DGPSI-Startup profile into DGPSI-SME or DGPSI-Full as its organisation matures, while adopting specialised profiles such as DGPSI-AI, DGPSI-HR or sector-specific frameworks wherever necessary.

The frameworks would not necessarily be competing products. They could become building blocks of a larger DGPSI architecture.

At this stage, there are more questions to be answered.

For example:

• • What exactly constitutes a “start-up” for the purpose of a compliance framework?
  • Should recognition be based on age, funding, turnover, employee strength, government recognition or some combination?
  • Should a start-up processing very sensitive or large volumes of personal data receive the same treatment as a low-risk start-up?
  • How should AI-native start-ups be treated?
  • How should start-ups that rapidly become Significant Data Fiduciaries transition into a more mature framework?
  • What should be the minimum compliance baseline?
  • Which DGPSI controls can be simplified?
  • Which controls should never be compromised?
  • Can compliance be embedded into product development and engineering processes?
  • Can investors and customers use the framework as a measure of data-protection maturity?

These questions deserve discussion. This thought is at a very preliminary stage and we can explore this as we go ahead. Your thoughts are welcome.

Project May 13 — the beginning of a conversation

To explore this thought further, FDPPI proposes to conduct a survey titled “Project May 13” to find out from professionals on how a DGPSI framework can be constructed for Start Ups for DPDPA Compliance without Pain.

The objective is to determine whether the underlying proposition is valid.

Can “Start-up” be considered a meaningful class of Data Fiduciary from the perspective of DPDPA implementation?

If the answer is yes, the next question will be:

What should a start-up-specific DGPSI framework look like?

And perhaps the most important question will be:

Can India develop a model in which data protection becomes part of the DNA of a start-up from its earliest days, rather than becoming a compliance burden imposed after the organisation has already grown?

That is the question with which Project May 13 begins.

The thought is at a very preliminary stage. Views, suggestions, criticism and alternative approaches from start-ups, founders, privacy professionals, lawyers, technology professionals, investors, auditors and regulators will be valuable in shaping the next stage of the project.

Project May 13 starts with a question. The framework, if justified, will emerge from the answers.

(To Be continued)

Naavi