Naavi.org

(This is in continuation of the previous article on Evolution of Data Valuation in India)

DGPSI Full version has indicated a model implementation specification which states

“Organization shall establish an appropriate policy to recognize the financial value of data and assign a notional financial value to each data set and bring appropriate visibility to the value of personal data assets managed by the organization to the relevant stakeholders.”

So far this has remained a suggestion which is more to indicate the auditee that they need to move in this direction. But with CAG guidelines for PSU auditors, the time has come to expand this MIS into a draft policy.

A tentative attempt is made in this direction to present a draft policy here for further discussion.

Copy of draft policy

This draft policy takes into account Naavi’s Theory of Data and Data Valuation Standard of India as supporting documents.

This is work in progress and Comments are welcome.

We can discuss this during our Chennai Seminar on July 17th 2026.

Quote:

                  [ STAGE 1: INTRINSIC VALUE (IV) ]
       Computed via Cost of Acquisition or Market Replacement
                                │
                                ▼
             [ STAGE 2: VALUE MULTIPLIER INDEX (VMI) ]
   Adjusts value based on Consent, Accuracy, Age, and Sensitivity
                                │
                                ▼
               [ FINAL NOTIONAL DATASET VALUE ]

For years, the phrase “Data is the new oil” was thrown around as a vague corporate cliché. Today, that narrative has  shifted from an abstract marketing pitch into a measurable, techno-legal reality. Driven by incoming international accounting frameworks, local regulatory mandates, and indigenous governance models, India is establishing a structured environment where data is recognized not just as an operational by product, but as a quantifiable financial asset.

Evaluating the multi-layered initiatives across India reveals how different agencies are approaching data valuation, along with their current operational status.

1. Macro-Government & Policy Initiatives: The Public Sector Shift

The government has recognized that to build a true digital economy, the state must find a uniform way to measure digital assets.

• MoSPI and SNA 2025 Adoption: The Ministry of Statistics and Programme Implementation (MoSPI) has actively engaged with the United Nations System of National Accounts (SNA 2025) guidelines. These standards formally recognize data as an economic factor of production. Government committees are currently outlining how public sector undertakings (PSUs) should officially categorize and track data assets.

• The CAG Mandate: The Comptroller and Auditor General (CAG) of India has signalled a clear need to capture the intrinsic value of data repositories within public asset reporting.

• Current Status: In Development/Policy Phase. Draft frameworks are under review to determine how state-owned data exchanges and infrastructure datasets can be accounted for without compromising national security or individual privacy.

2. Regulatory Compliance Drivers: The DPDP Act & Toxic Data

The rollout of the Digital Personal Data Protection Act (DPDPA) has upended traditional data accumulation strategies. Data valuation in India can no longer be evaluated through the lens of potential monetization alone; it must be balanced against statutory liability.

• Asset vs. Liability Dynamics: With penalties reaching up to ₹250 crore per non-compliance instance, unconsented, poorly structured, or “zombie” data is no longer an asset—it is an active balance sheet liability.

• Current Status: Active Enforcement Preparation. Organizations are actively filtering their datasets to compute their “clean data” volume. Under this model, data value dynamically depreciates the moment a Data Principal withdraws consent or the processing purpose expires.

3. Indigenous Institutional Frameworks: DGPSI and DVSI

While traditional accounting standards (like Ind AS 38) remain highly conservative about capitalizing internally generated data, pioneering frameworks within India have stepped forward to fill the gap.

• Data Governance and Protection Standard of India (DGPSI): Developed by FDPPI, DGPSI has embedded financial data valuation directly into its governance specifications. Specifically, Model Implementation Specification 9 (MIS-9) explicitly requires organizations to establish a policy assigning a notional financial value to distinct datasets. This ensures the board has visibility into the economic worth of the data assets they oversee. DGPSI’s metric—the Data Trust Score (DTS)—serves as a core indicator of how compliance directly protects and enhances an asset’s baseline value.

• Data Valuation Standard of India (DVSI): Operating alongside DGPSI, the DVSI model introduces a specialized two-stage valuation methodology. It calculates the intrinsic cost of data (using classic cost of acquisition or market parameters) and applies a dynamic multiplier index based on legal compliance, data accuracy, and cryptographic protection.

• Current Status: Operational/Implementation Phase. The newly launched Association of Independent Data Auditors (AIDAI) is actively training and empanelling Certified Independent Data Auditors (CIDAs) to handle data audits that combine compliance testing with these advanced data valuation techniques.

4. Valuation in Insolvency and Distress: The IBC Track

The most concrete financial realizations of data value are currently occurring under distressed corporate conditions.

• Insolvency and Bankruptcy Code (IBC), 2016: Resolution Professionals (RPs) and Registered Valuers regularly encounter scenarios where a failed startup, fintech platform, or e-commerce provider holds minimal physical assets, but possesses massive, highly structured user databases and proprietary transaction algorithms.

• Current Status: Fully Functional Legal Practice. Courts and liquidators treat these data stacks as intangible corporate property under Section 36 of the IBC, utilizing Income or Market-driven slump sales to maximize recovery returns for creditors.

Reconciling Value and Responsibility: The “Data Balance Sheet”

The convergence of these initiatives points toward a inevitable destination: the Data Balance Sheet. Under a double-entry governance framework, personal data under management must be accounted for simultaneously as an economic asset and a corresponding contingent liability (accounting for potential data breaches, regulatory fines, and remediation costs).

Organizations that wait for standard accounting boards to hand down a rigid template will find themselves exposed to severe regulatory and financial risks. Relying on frameworks like DGPSI to understand exactly what data you possess, what value it generates, and what risks it carries is no longer just a compliance choice—it is a baseline requirement for modern corporate sustainability.

(To Be continued)

Naavi

We often discuss the concept of Data Processing under “Data Blind” conditions.  It essentially means that the processor does not have access to identifiable personal data which he is processing. The system is suggested for “Consent Managers”.

We are however discussing another aspect of “Being Blind to the Value of Data”.  There are two examples in India where an organization being “Data Value Blind” suffered adverse consequences. One was Net4India which was liquidated probably because NCLT was blind to the value of data in the organization. Second was the case of CIBIL which quietly transferred data worth around Rs 700000 crores to a foreign organization for a mere Rs 3800 crores.

On the other hand there are multiple examples in US where data valuation has been used to ward off bankruptcy proceedings.

If you are interested in this topic of “Data Valuation”, Please be present on July 17 at Palmgrove, Chennai where FDPPI/AIDAI will be discussing the issues on Data Valuation. (Check for details at www.aidai.org.in)

Naavi

FDPPI and AIDAI (Association of Independent Data Auditors” in association with the Society of Auditors, Chennai.

There are three important educative sessions planned for the seminar.

1. The role of Independent Auditors as “Guardians of Accountability”
2. Data Valuation
3. Need for Chartered Accountants and Advocates to look at Data Audit as a professional add on service. (Panel Discussion involving industry veterans)

Interested persons may register immediately.

REGISTER HERE: 

(Registration fee: Rs 500/-: May be paid here: )

Naavi

A More detailed audio podcast is also available here:

Kannada Discussion:

The above podcasts are explainers of the blog post but would be useful for a deep dive. Kindly go through and let me know your comments.

These are produced using AI . However base content is from me and the audios/videos have been reviewed manually. Hence use of AI is only to assist me.  AI is only a software tool in this context.

Naavi

The Karnataka High Court, in an important judgment delivered on July 2, 2026, has reminded organizations that employment disputes should not be converted into criminal prosecutions without adequate legal foundation.

(See: Indian Express : Medicaldiologues :  Court Proceedings in YouTube)

In a judgment delivered by Honourable Justice M. Nagaprasanna, the Court strongly criticized the decision of Manipal Hospital to pursue criminal proceedings against a distinguished oncologist who had served the institution for nearly nineteen years before moving to Aster Hospital in a higher position.

While the judgment provides relief to an individual doctor, its significance extends much beyond the parties to the dispute. It highlights an often-overlooked reality of the digital era—that employment records are no longer mere HR documents. They are electronic records capable of becoming crucial legal evidence.

The Background

According to the complaint filed by Manipal Hospital, the doctor resigned from service in 2022 after nearly two decades of association and was formally relieved with appreciation.

About three months later, Manipal Hospital reportedly received, through e-mail from the background verification agency DataFlow, a copy of an experience certificate purporting to have been issued by the Hospital and bearing what was alleged to be the signature of one of its officials.

The Hospital considered the signature to be forged and initiated criminal proceedings by filing a private complaint.

The Police investigated the complaint and submitted a B-Report, indicating that no criminal offence appeared to have been made out. Dissatisfied with this conclusion, the complainant filed a protest petition, following which the Magistrate took cognizance and issued summons to the doctor.

The doctor challenged these proceedings before the Karnataka High Court.

The High Court Restores Judicial Balance

Quashing the proceedings, the High Court observed:

“Such cases should not be even permitted to be tried; the concerned court has erred in taking cognizance of the offence against a doctor and issuing summons without even looking at the documents which were produced at the time when the B report was filed. Therefore, the further proceedings, if permitted to continue, would on the face of it be an abuse of process of law and result in miscarriage of justice.”

During the hearing, the Court also orally advised the Hospital:

“Allow doctors to treat patients. Do not drag them into your inter-hospital disputes.”

Equally noteworthy was the Court’s refusal to permit retaliatory proceedings for malicious prosecution. Thus, while protecting the doctor from an unwarranted criminal trial, the Court also discouraged unnecessary escalation of litigation.

This balanced approach deserves appreciation.

A Forgotten Lesson from the Satyam-UPaid Litigation

The facts of this case immediately reminded me of the well-known UPaid-Satyam controversy that surfaced nearly two decades ago.

UPaid had engaged Satyam Computer Services for software development that later became the subject matter of patent litigation involving Qualcomm and Verizon. During the proceedings, intellectual property assignment documents allegedly signed by software developers assumed great significance.

Two former Satyam employees, who had by then joined Qualcomm and Verizon respectively, denied that the signatures appearing on the assignment documents were theirs.

At that time, Business Standard reported:

“UPaid had filed this case against Satyam in 2007. Satyam had done a project between 1997 and 2002 for which it got $10 million, partly in shares due to UPaid’s inability to pay cash. When UPaid wished to patent the technology, Satyam needed to provide signatures of the people who worked on the technology. Though the company gave UPaid the signatures, some of these employees had moved out.

When UPaid received the patent, it filed a suit against Verizon Wireless and Qualcomm in 2005, as they were using the company’s patented technology. However, one of the former Satyam employees had moved out of the company and joined Verizon. He said the signature was not his.”

The litigation ultimately culminated in a settlement reportedly involving nearly USD 70 million.

Whether or not the disputed signatures were actually forged was less important than the governance lesson that emerged. Employment-related documentation, once produced before a Court, assumes enormous evidentiary significance. A document casually prepared today may become the deciding factor in litigation years later.

The Missing Governance Perspective

The High Court was rightly concerned with the sustainability of the criminal proceedings against the doctor. However, from a governance perspective, another question deserves academic consideration.

How did the disputed experience certificate originate?

If the investigation had proceeded from the standpoint of document governance, several questions might naturally have arisen:

• • Did an original signed experience certificate actually exist?
  • Was the document generated electronically for verification purposes?
  • How did the background verification agency obtain the document?
  • Was the signature reproduced from another legitimate record?
  • Was the document created by someone attempting to facilitate verification without appreciating its legal consequences?
  • Did the prospective employer specifically require such a certificate?

These questions are raised purely for academic discussion. There is no material presently available in the public domain to suggest wrongdoing by the background verification agency or any other participant.

The purpose of raising these questions is only to demonstrate how forensic examination of electronic records would ordinarily proceed.

Every HR Document Is an Electronic Record

More than twenty-five years ago, the Information Technology Act, 2000 recognized the legal validity of electronic records. Today, the Digital Personal Data Protection Act, 2023 reminds organizations that employee records are also personal data requiring appropriate governance.

Yet many organizations continue to treat HR documentation as routine administrative paperwork. That approach is no longer adequate.

Experience certificates…

Relieving letters…

Employment verification responses…

Background verification reports…

Promotion letters…

Digitally signed approvals…

Every one of these documents is an electronic record capable of becoming evidence before a Court. Every one of them carries legal consequences.

The DGPSI Perspective

From the standpoint of the Data Governance and Protection Standard of India (DGPSI), this case demonstrates why HR documentation deserves the same governance standards applied to financial records.

Organizations should implement documented controls covering:

• • Creation and authorization of employment records.
  • Digital authentication and approval mechanisms.
  • Version control and document integrity.
  • Audit trails for every modification.
  • Secure storage and transmission.
  • Formal procedures for responding to background verification requests.
  • Record retention and secure destruction.
  • Periodic Cyber Law awareness training for HR personnel.

Many cyber incidents are not failures of technology. They are failures of governance.Technology merely exposes them.

Hospitals Carry a Higher Fiduciary Responsibility

Hospitals are unlike ordinary commercial enterprises.  They occupy a fiduciary position in society because they deal with human life itself.

Professional differences between hospitals, doctors, recruiters and verification agencies should therefore be handled with restraint unless supported by compelling evidence of criminal misconduct.

The Court’s observations are therefore a timely reminder that criminal law should never become an instrument for resolving competitive employment disputes.

Naavi’s Governance Takeaway

This judgment offers several practical lessons for every organization.

First, every HR document should be treated as a legally significant electronic record.

Secondly, background verification processes should be governed by documented procedures identifying who may issue responses, how authenticity is verified and how audit trails are preserved.

Thirdly, organizations should progressively replace scanned signatures with stronger authentication mechanisms such as digital signatures, secure verification portals or verifiable electronic credentials.

Fourthly, Cyber Law awareness should extend beyond IT departments. HR personnel, recruiters, administrators and vendor managers routinely handle electronic records that may later become legal evidence.

Finally, Data Protection Officers, Chief Information Security Officers and HR Heads should work together. Employee records constitute personal data under the Digital Personal Data Protection Act and require governance over their integrity, confidentiality, authenticity and lawful disclosure.

The Larger Lesson

The importance of this judgment lies not merely in protecting one doctor from an unwarranted criminal trial. Its enduring value lies in reminding organizations that governance begins long before litigation.

Every experience certificate, relieving letter, employment verification response or digitally exchanged HR document becomes part of an organization’s trust architecture.

When questioned before a Court, the issue is no longer whether the document originated in the HR Department. The question is whether the organization can demonstrate its authenticity, integrity, provenance and accountability.

If the answer is uncertain, the governance process—not merely the document—requires strengthening.

That, in my view, is the enduring lesson emerging from the Karnataka High Court’s judgment.

Every HR document is also a Cyber Law document.

Naavi