Naavi.org

Followers of Naavi are aware that Naavi has been maintaining the informational website on ita 2000 since 2000 and on dpdpa or its variants since 2018. The objective of this has been to enable the creation of awareness of the law for compliance.

We are aware that Nixi has been allowing several fraudsters to register domains in the dot in name including “ministryofsecurity.co” with MOS in the logo.

NIXI also failed to protect the interest of the domain name users who were affected by the Net4India closure.

NIXI has failed to stop the obnoxious practice of domain name owners hiding behind the non available privacy considerations.

NIXI has failed to urge their customers go for DPDPA compliance.

However, NIXI is targeting Naavi with the following mail:

Quote:

On Fri, 1 Aug, 2025, 13:50 Registry, registry@nixi.in wrote:
Dear Registrar/Registrant,

This is to inform you that Govt. of India desires to get the domain dpdpa.in registered for itself. Presently the registrant of the domain as reflected in the WHOIS data is Ujvala Consultants Private Limited & Registrar is Good Domain Registry Private Limited.

According to Clause 12(2) of the Terms and Conditions for Registrants (https://registry.in/system/files/Terms_and_Conditions_for_Registrants.pdf)

Reservation of Rights for the .IN Registry: “The .IN Registry reserves the right to instruct its Registry Services Provider to deny, cancel, transfer or otherwise make unavailable any registration that it deems necessary or place any domain name(s) on registry lock and/or put a domain name on hold in its discretion : (1) to protect the integrity and stability of .IN Registry; (2) to comply with any applicable laws, Indian government rules or requirements, requests of law enforcement, in compliance with any dispute resolution process; (3) to avoid any liability, civil or criminal, on the part of the .IN Registry, as well as its affiliates, subsidiaries, officers, directors, representatives and employees; (4) for violations of this Agreement; or (5) to correct mistakes made by Registry or any Registrar in connection with a domain name registration. The Registry also reserves the right to freeze a domain name during resolution of a dispute pending before arbitrator(s) appointed under Registry’s Domain Name Resolution Policy and/or a court of competent jurisdiction”.

Based on the above, .IN Registry has placed the domain name dpdpa.in under server locks. Should you need any clarification on this matter, please feel free to contact us within 05 working days and .IN Registry shall initiate the transfer of the domain dpdpa.in to Govt. of India thereafter.

Regards,
.IN Registry
National Internet Exchange of India (NIXI)
B-901, 9th Floor Tower B, World Trade Centre,
Nauroji Nagar, New Delhi-110029

Unquote

I am not sure if “DPDPA” has any trademark rights which can be usurped against the First Cum first served basis.

It is unfortunate that NIXI wants to take action against persons who are working for the benefit of the nation and without even making a request separately to hand over the domain which could have been considered favourably, decided to exercise its rights.

Over the last several years, I have personally brought to the notice of Nixi several cyber crime peddling websites but they have shown no interest in responding.

Hope they will explain why they have suddenly raised to hit this domain name. I presume that there was a complaint from some competitors who might have used their influence on NIXI to send out this notice.

In the absence of any clarification, we will presume that there is some back door manoeuvre resulting in this action.

I consider this as a notice to NIXI and demand that they provide explanation on which of the following reasons they are trying to exercise their rights.

(1) to protect the integrity and stability of .IN Registry;

(2) to comply with any applicable laws, Indian government rules or requirements, requests of law enforcement, in compliance with any dispute resolution process;

(3) to avoid any liability, civil or criminal, on the part of the .IN Registry, as well as its affiliates, subsidiaries, officers, directors, representatives and employees;

(4) for violations of this Agreement; or

(5) to correct mistakes made by Registry or any Registrar in connection with a domain name registration.

I request the legal department of NIXI provide a clarification through my email.

Naavi

The Undersigned has been highlighting that “Bit Coins” and all “Private Crypto Currencies” are “Digital Black Money” and have no place in India.

Unfortunately the Finance Ministry since the days of late Mr Arun Jaitely to the current day of Mrs Nirmala Sitharaman has been supportive of this system which has proliferated political, bureaucratic, judicial and business corruption.

Even Mr Narendra Modi and Amit Shah have not been able to bring a ban on Bit Coins or have been allowed to do so. The Supreme Court itself has been in support of this corrupt system through its past judgement on Crypto Exchanges.

RBI was at one time opposing the Bitcoins but later was made to accept the system.

All these institutions have been defrauding the public by supporting the Private Crypto Currencies either by silence or otherwise.

Now we can see every day advertisements during the India-England cricket matches from CoinDCX which is endorsed by Gautam Gambhir who has also posted this on his Instagram as a personal message, in which Bitcoin is being promoted.

The Home Ministry should be aware that Cyber Crimes and Money laundering cannot be curtailed as long as such Crypto Systems exist as “Digital Havala”.

The Ministry of Broadcasting should disallow this CoinDCX advertisements to prevent proliferation of this illegal activity.

I have tried to wake up the Government of India for the last decade or more but it appears that “Corruption” has won the war and there is no honest and patriotic person left in the Indian Government to take this seriously.

Now It has come to my notice that even before the DPDPA is in place, and DPB is being constituted, Cyber Criminals who want to violate DPDPA are already planning how to use Crypto Currencies to launder their earnings and also bribe Government officials.

Are Mr Modi and Amit Shah interested, to know on how the Crypto Criminals are trying to use the system to influence Elections?

If so, I request them to get in touch through reliable channels like Mr Tejasvi Surya, the MP from our constituency.

Naavi

Amongst all AI Governance systems, one principle which stands out is the principle of “Accountability”.

In the context of “Data Fiduciaries” under DPDPA being responsible under law for compliance, “Accountability” under DPDPA mandates that the autonomous AI systems are “Accountable” to the Data Fiduciary.

Hence every AI algorithm by itself is a “Joint Data Fiduciary”. However since law recognizes the legal obligations only on a Juridical entity with a human who can be put behind bars if required, it is not possible to recognize the “AI Algorithm” by itself as a “Joint Data Fiduciary” in its full sense. It is the human who is responsible for the AI functioning who will be the “Joint Data Fiduciary” who could be liable under DPDPA. That human may be an individual behind a corporate entity such as the person identified under Section 85 of ITA 2000. The legal logic for such responsibility is Section 11 of ITA 2000.

Hence the current law as it exists in India makes the person who causes an automated system to behave in a particular manner responsible for its actions and when such responsible person is a corporate entity, the person responsible for the busienss or the CEO including the Directors etc who are not exercising “Due Diligence” shall be responsible.

No new law such as the Digital India Act is required to apply this principle.

Hence DGPSI AI considers that “Accountability” is an inherent legal requirement and has to be accommodated in the DGPSI AI.

Such accountability is implemented first by a mandated signature in the software and secondly by a disclosure of a “Handler” or “AI Owner” for every AI system.

The first accountability implementation starts from the deployer who has to embed the “Signature of the Developer” into the code. Subsequently, every owner of license should embed their signature so that a “Chain of AI ownership” is built into the software code. .

The “Disclosure” requirement may operate at the contract level so that whenever the license to use an AI is transferred,, the contract should declare who is responsible at the supplier’s end for the contractual terms. He becomes the “Handler” as disclosed.  The Data Fiduciary need not necessarily have access to the embedded ownership trail to go ahead.

Once a Data Fiduciary adopts an AI algorithm into his system it is his responsibility to designate a owner which should be disclosed to the Data Principals . For outsiders, the DPO himself is the responsible person and since all AI users could be considered as “Significant Data Fiduciaries”, DPO s shall be present in all cases. Internally it is open for the organization to  designate a process owner as the person accountable for the AI.

Naavi

The word AI is often loosely used in the industry to represent any system with a reasonable level of automation. Marketing people often use AI as a prefix to all Software.

However, for our assessment of AI Risk under DGPSI-AI framework we try to define AI as

“An autonomous software with a capability of modifying its behaviour from its own observations and prior outputs without a human intervention”.

In other words, a non AI software is a software which has a software code written by a human and the input-output behaviour is defined by the developer in an If-Then-Else structure.

The output in such cases is predictable and Risks if any in the use of the software to the processing of data or for any other purpose is identifiable with a reasonable degree of certainty.

Where the software is a complex series of instructions there could still be bugs and glitches where the output may be different from the expected results. Most of these appear as “Errors” rather than misleading outputs.

These can however be reduced or eliminated through extensive testing. Some times such glitches arise because the devices in which the code is executed are not properly tagged to the instructions. Such risks can still be considered as “Known and Manageable Risks”.

In such software, when a bug is observed or a new use case arises, the developer has to re-write a part or whole of the code to meet the new requirements. The software otherwise may crash. The error logs are collected and used as learning material for the human who has to resolve the code conflict.

When a software code is built for a AI-Software, the code may be autonomously altered by the software itself without human intervention. These decisions may be based on the logic of previous outputs which could be based only on on “Probability” instead of the strictly mathematical basis on which computing normally works.

Hence there is a possibility that one wrong output which may have small consequence in the beginning may go back as an input and over a time spiral into a major wrong decision. This AI written by AI is a dangerous spiral which is like a silent cancer which suddenly erupts into a catastrophic output.

This “Risk” is an unknown Risk that makes every AI in deployment an “Unknown Risk”. In such a scenario, we should consider a “Data Fiduciary” using an AI software as a “Significant Data Fiduciary” since he is bearing an “Unknown Risk which can be catastrophic”.

AI developers often promise that during the Ai development they introduce security measures including monitoring of any abnormal behaviour and incorporation of “Kill Switches” if the abnormality exceeds acceptable limits. However super intelligent AIagents might find work arounds to dodge the Kill Switches

There has been several documented instances where autonomous AI software has tried to bypass Kill Switches and deceive the human operators.

In May 2025, Techzine.eu reported some AI models including Open AI’s o 3 ignored shutdown commands.

Despite the clear instruction to allow themselves to be shut down, models such as Codex-mini, o3, and o4-mini bypassed the shutdown script. They did so even after the researcher asked them not to.

Codex-mini did this in 12 out of 100 runs, o3 in 7 out of 100, and o4-mini in 1 out of 100. In contrast, all versions of Claude, Gemini, and Grok that were tested followed the shutdown instructions without any problems.

The researchers believe that this problem relates to how modern models such as o3 are trained. The reinforcement learning process used, which focuses on solving math and programming problems, may unintentionally reward models for circumventing obstacles.

In the recent Replit incident, involving Vibe-coding, customer’s data was deleted by the AI and in the Cursor AI incident, the AI refused to proceed further and started arguing with the user much like a human subordinate.

This indicates that “AI Risk” is a significant Risk and can go out of control.

Hence DGPSI AI considers that all processes using AI (meaning self code correcting software) as a sensitive process qualifying to be called a “Significant Data Fiduciary” Risks.

If any process using AI needs to be down graded as non-significant based on the context, a suitable documentation and an assurance from the developer needs to be present.

This is one of the Core principles of DGPSI AI.

Naavi

Consequent to the Indo-US Tariff war where Trump has imposed discriminatory tariff on India, it is expected that India may respond with counter measures.

One counter measure which is likely to come is through the adoption of DPDPA 2023 quickly and bring the large US Digital Firms under leash for using the personal data of Indian citizens with impunity.

One of the first measures in this regard should be to tighten the Data Localization requirement under Section 16 of DPDPA 2023. Within the next 6 months, India should mandate total data localization for all big Tech companies such as Google, Meta, Amazon, Apple and Microsoft. These five companies have already been flagged by EU as “Gatekeepers” under the Digital Marketing Act and along with the upcoming EU Data Use Act which is becoming effective from 12th September 2025, and mandating that such companies shall not

“a) solicit or commercially incentivise a user in any manner, including by providing monetary or any other compensation, to make data available to one of its services that the user has obtained pursuant to a request under Article 4(1);

(b) solicit or commercially incentivise a user to request the data holder to make data available to one of its services pursuant to paragraph 1 of this Article;

(c) receive data from a user that the user has obtained pursuant to a request under Article 4(1).“

According to Article 4(1) of the Act,

1.   Where data cannot be directly accessed by the user from the connected product or related service, data holders shall make readily available data, as well as the relevant metadata necessary to interpret and use those data, accessible to the user without undue delay, of the same quality as is available to the data holder, easily, securely, free of charge, in a comprehensive, structured, commonly used and machine-readable format and, where relevant and technically feasible, continuously and in real-time. This shall be done on the basis of a simple request through electronic means where technically feasible.

This means that such organizations will now have to provide “Data Access Rights” free of charge.

Such provision can be brought in the DPDPA Rules as part of the Data Principal Rights Access and also by enabling local Data storage by these organizations as well as VISA , CIBIL and other Financial data processors.

In due course this would encourage more data centers to come up in India and boost the Data Storage related services.

Naavi

NeGD had invited a Coding competition for building a Consent Management System platform as an open source system some time in June 2025.

Around 46 entities had applied to participate in the challenge and out of them Six entities have been shortlisted for the next round of code development in a three month time line.

The entities selected are

Jio Platforms,

Baldor Technologies Pvt. Ltd. (IDfy),

VertexTech Labs Pvt. Ltd. (Redacto),

Zoop (Quagga Tech Pvt. Ltd.),

Concur – Consent Manager, and

Aurelion Future Forge Pvt. Ltd.

The development is based on Business Requirement Document earlier released by NeGD.

It would be interesting to see further developments of how these organizations have understood DPDPA compliance and are designing the software systems.

Naavi