TransUnion-CIBIL share deal vs Fairfax-IDBI Bank share deal

Some commentators have been drawing loose parallels between the proposed Fairfax acquisition of IDBI Bank and the transfer of control of CIBIL to TransUnion between 2014 and 2017. This note is meant to set the record straight on why the two are not comparable.

The IDBI Bank deal

Fairfax Financial Holdings has reportedly been selected to acquire a 60.72% controlling stake in IDBI Bank at ₹81 per share. The stake comes from the Government (30.48%) and LIC (30.24%), for a total of about ₹53,000 crore. The deal is not yet final. Valuation discussions with the Government were still under way in September. The deal will also need RBI’s fit-and-proper clearance and CCI approval, and Fairfax must make an open offer to public shareholders.

IDBI Bank is a listed company with a market price, and the transaction is a negotiated sale of shares. Above all, the buyer takes on the responsibility of running a bank. If it fails to run the bank well, it risks its ₹53,000 crore. This is not a sale of data. It is a transfer of responsibility for running a regulated business.

Why CIBIL was different

CIBIL was an information company, and almost all of its value lay in its data. That data was the credit history of hundreds of millions of Indians, contributed by every bank and lender in the country. Unlike IDBI Bank, CIBIL was unlisted, so there was no market price to check the deal against. Buying control of CIBIL was, in substance, buying control of India’s most important credit-information database and the commercial benefits that come with it.

Both deals involve personal data. The difference is that IDBI Bank holds its own customers’ data as one bank among many. CIBIL holds pooled credit information from the entire lending system, under the special regime of the Credit Information Companies (Regulation) Act, 2005.

How TransUnion acquired control of CIBIL

November 2000 – Formation. On 10 November 2000, the Government permitted SBI to take equity in a new credit bureau in collaboration with HDFC, Dun & Bradstreet and TransUnion International. SBI and HDFC held 40% each, and D&B and TransUnion 10% each. RBI later directed SBI and HDFC to spread their holdings across other banks and institutions, so that no shareholder held more than 10%. TransUnion has been CIBIL’s technology and analytics partner since 2001.

Up to early 2014 – TransUnion at 27.5%. Before the 2014 sales, TransUnion held 27.5%. SBI and ICICI Bank held 10% each. Bank of Baroda, Bank of India, PNB, Union Bank, Citicorp Finance, HSBC, Standard Chartered, IOB, HDFC and Central Bank of India held 5% each, and Sundaram Finance held 2.5%.

March to May 2014 – Crossing into control. Shortly before these sales, the Government raised the FDI cap for credit information companies from 49% to 74%. In March 2014, PNB and Central Bank of India sold their entire stakes to TransUnion, and by the end of that quarter TransUnion held 47.5%. On 20 and 21 May 2014, two further transactions took it to 55%. In all, six sellers were involved: Citicorp Finance, PNB, Central Bank of India, HDFC, Standard Chartered and Sundaram Finance. TransUnion paid about US$ 50.6 million in cash for this 27.5%, which gave it control of the company. At the then exchange rate, that implies a value of roughly ₹1,100 crore for the whole of CIBIL. TransUnion dates its control of CIBIL from 21 May 2014.

2014–2015 – Domestic investors at low valuations. Aditya Birla PE bought 4%. A year later, SBI sold 4% to India Alternatives and IIFL at a price that valued CIBIL at about ₹1,550 crore.

2016 – 100% FDI permitted. RBI permitted up to 100% FDI in credit information companies, subject to conditions. TransUnion then bought ICICI Bank’s 6% and Bank of Baroda’s 5%, taking its holding from 66.1% to 77.1%.

2017 – 92.1% and rebranding. TransUnion raised its stake to 92.1%, and the company became TransUnion CIBIL. That year Bank of India sold its 5% for ₹190.6 crore, which valued the whole company at about ₹3,800 crore.

What was the data worth?

Credit records cannot lawfully be sold one by one. CICRA limits who may receive credit information, and the DPDPA adds consent and purpose restrictions. Any per-record figure is therefore a way of sizing the asset, not a market price.

TransUnion CIBIL today holds credit files on about 600 million individuals and 32 million businesses, and serves over 7,000 institutions.

  • Lawful commercial value. Industry estimates suggest that lenders pay ₹300–1,500 for a pre-qualified lead with a good credit score. Such a customer may be worth ₹20,000–50,000 over their lifetime in interest margin and fees. These are indicative figures.
  • Black-market floor. Even stolen data has a price. A 2022 NordVPN study found the identities of Indians selling on bot markets at an average of about ₹490 each.

On these benchmarks, the database would be worth something like ₹18,000 crore (at ₹300 per record) to ₹29,000 crore (at ₹490 per record). Control of it changed hands at implied valuations of roughly ₹1,100 crore in 2014, ₹1,550 crore in 2015 and ₹3,800 crore in 2017. The database was smaller then than it is today, but the gap is still large enough to ask whether the shares were sold well below their fair value. Unlike in the IDBI case, there was no market price against which anyone could check.

The timing

The regulatory change that allowed TransUnion to cross 49%, and the share purchases that followed, all happened while Shri P. Chidambaram was Finance Minister (August 2012 – May 2014) and Dr. Raghuram Rajan was RBI Governor. The election results were declared on 16 May 2014. TransUnion completed its majority acquisition on 20–21 May, and the new Government was sworn in on 26 May. Control of India’s largest credit bureau thus passed to a foreign company in the final days of the outgoing Government.

The undersigned had raised objections to this deal at the time and called for an investigation, but none has been ordered. Now some are accusing the present Finance Minister of corruption in the Fairfax deal.

Conclusion

In our considered view, the two deals are different in kind. The CIBIL transaction transferred control of a national credit-data asset in an unlisted company, without public price discovery. The IDBI transaction is a negotiated sale of shares in a listed bank, in which the buyer must run the business and answer to the regulator. If any deal deserves a closer look, it is the first.

Naavi

Also read: Is TransUnion-CIBIL guilty of Accessing Critical Personal Data through surreptitious means?

References sourced through Web search and AI.

 

Posted in Privacy | Leave a comment

DPDPA during Mergers and Acquisitions

The essence of the DPDPA is that no personal data coming under the Act may be processed except under a valid legal basis. The law is due for full implementation on 13th May 2027.

There was an announcement that the Cabinet Committee approved a divestment proposal whereby the Government of India and LIC will sell shares of IDBI Bank Ltd. to Fairfax Financial Holdings, for a total value of Rs 52,878 crores.

Canadian billionaire Prem Watsa-led Fairfax will pay Rs 81 per share, higher than the benchmark fair value of Rs 75.99 determined by two independent valuation agencies, as per an official statement.

The transaction needs approval from the Reserve Bank of India (RBI), which will conduct a “fit and proper” assessment, as well as the Competition Commission of India (CCI) and other statutory authorities. This is considered the largest financial sector FDI.(Details here)..

This is a partial divestment. The Government and LIC will continue to hold residual stakes of 15% and 19%, respectively. Fairfax already owns a stake of up to 40% in Catholic Syrian Bank. As per RBI regulations, it may be necessary for Fairfax to give up its Catholic Syrian Bank holding within two years or for the two banks to merge. This aspect requires verification against the applicable RBI requirements.

IDBI Bank had 2,174 branches, 69 Business Correspondent outlets and 3,011 ATMs as of a recent date. The total deposits were around Rs 3,47,163 crores and net advances were Rs 2,53,626 crores. Around 70% of the loan portfolio is said to be retail. The total estimated customer base could be around 2.5 crores, although this figure needs verification as a current count of unique customers.

There has been a discussion in DPDPA professional circles about the impact of DPDPA on this deal.

This deal is a share acquisition and is perhaps unlike the deal of Axis Bank a few years back, when it took over the retail business of Citi Bank in India.

From a DPDPA perspective, the Citi–Axis Bank deal involved the transfer of a retail banking business and its associated customer relationships, while the Fairfax deal is more a transfer of an equity stake. This deal is, however, similar in one respect to TransUnion’s acquisition of CIBIL shares, when the stakes of multiple banks were acquired by TransUnion to raise its holding to around 90%. CIBIL was not a listed company, while IDBI Bank is.

Whether a change of control of an organisation is also a change of control over the underlying personal data, and whether it can be considered a transfer of personal data, is a debatable point.

To the extent that a foreign investor may control an organisation but may not have direct access to its personal data, the IDBI Bank deal, and perhaps the TransUnion deal as well, may be viewed as a transfer of equity stake rather than a transfer of personal data. However, the fact that Fairfax’s principal is a person of Indian origin, unlike the foreign ownership structure in the TransUnion example, does not by itself determine the DPDPA implications.

The important distinction is between ownership of shares, control over the purposes and means of processing personal data, and actual access to or disclosure of that data. A change in shareholding does not automatically transfer personal data to the shareholder. However, it may influence how the organisation governs, accesses or uses that data. Any resulting change in processing or disclosure must be examined separately.

In the DPDPA, Section 17(1)(e) provides an exemption from the provisions of Chapter II, except sub-sections (1) and (5) of Section 8, and those of Chapter III and Section 16, where processing is necessary for a scheme of compromise or arrangement, merger or amalgamation of two or more companies, reconstruction by way of demerger or otherwise, transfer of an undertaking, or division of one or more companies, approved by a court, tribunal or other authority competent to do so under any law for the time being in force.

This exemption may not apply to the present transaction merely because shares are being transferred. On the facts presently disclosed, the transaction appears to involve a transfer of shares rather than a transfer of IDBI Bank’s undertaking or its customer database to another entity. The applicability of Section 17(1)(e) would require examination of the actual transaction structure and the processing undertaken in connection with it.

The current deal will therefore not automatically change IDBI Bank’s existing DPDPA obligations. Its status as a Significant Data Fiduciary, however, should be verified against the formal designation under the Act. If Fairfax tries to use customer data for its other businesses, Fairfax may become a Data Fiduciary in respect of that processing, depending on whether it determines the purpose and means of such processing.

It is stated that Fairfax has other business interests in insurance. If Fairfax tries to use bank customers’ data for insurance marketing, it could become a Data Fiduciary in respect of that activity. If, however, an Indian subsidiary of IDBI Bank takes over the insurance business, the processing would still need to be examined for a valid legal basis, including whether consent is required for the additional purpose. The common ownership of the businesses would not, by itself, authorise unrestricted sharing of customer data.

By 13th May 2027, IDBI Bank should review the legal basis for its existing processing and ensure that its consent-based processing and notices comply with the applicable DPDPA requirements. Fresh consent is not automatically required from every existing customer merely because ownership changes. It is, however, debatable whether the change of ownership of an organisation through this sort of share transaction should be treated as information that must be provided to all Data Principals, if the DPDPA had been in effect. The answer may depend on whether the transaction results in a material change in processing purposes, data access or disclosures.

It is a good time to set out the compliance requirements for this sort of deal, using this example.

One area for discussion is the DPDPA Rule regarding Consent Managers, which states:

“The control of the company registered as the Consent Manager shall not be transferred by way of sale, merger or otherwise, except with the previous approval of the Board and subject to fulfilment of such conditions as the Board may specify in this behalf.”

If the transfer of controlling interest in a Consent Manager is specifically regulated, the question arises whether a similar control should be considered for a Significant Data Fiduciary, such as a bank. The Consent Manager operates under a distinct regulatory regime, so the same requirement cannot automatically be extended to banks. Nevertheless, the provision raises an important policy question about changes in control of organisations that process large volumes of personal data.

While this discussion may be deferred for the time being, FDPPI takes note of the issue and would like to add a clause in the DGPSI Model Implementation Specifications stating that data security should include an appropriate control preventing the personal data of an organisation from being made available to holding companies or investors without a documented lawful basis, appropriate authorisation and necessary safeguards, except where such access is otherwise permitted under applicable law.

The control should require the organisation to assess any change in shareholding or management control for its implications on personal data access, processing purposes, disclosures and group-company arrangements. Any additional regulatory approval or permission required by applicable law should be obtained.

This would ensure that a change in ownership does not become an indirect route for unrestricted access to personal data by investors or related entities.

Naavi

Also Read:

Case Study on Valuation of IDBI acquisition

Analysis of Valuation method (Business Standard) 

Posted in Privacy | Leave a comment

Webinar with MMA, Chennai on 16th October 2026

Naavi will be addressing a webinar at MMA, Chennai on 16th october 2026 at 3.00 pm to 4.30 pm.

Invitation from MMA is here:

Greetings from Madras Management Association!

We are pleased to invite you to our exclusive webinar tomorrow on, “Enterprise DPDPA Compliance & Data Governance – Legal, IT & HR Heads- Regulatory & Governance“ scheduled for tomorrow, Friday, October 16th, 2026, from 03:00 PM to 04:30 PM IST via Zoom. Registration starts at 2:45 PM IST.

The session will be facilitated by Mr. Vijayashankar Nagaraja Rao ( NAAVI) — is a pioneer in the field of Cyber Law, Data Protection and Cyber Jurisprudence in India & Chairman of FDPPI. He has been actively involved in building professional capabilities in Data Protection and supporting the development of India’s data protection ecosystem. His work covers the intersection of law, technology, governance and business, with a focus on practical approaches to DPDPA compliance and responsible data governance.

.Session & Join Details

  • Topic: Webinar on Enterprise DPDPA Compliance & Data Governance – Legal, IT & HR Heads- Regulatory & Governance
  • Time: Tomorrow, October 16, 2026 | 02:45 PM IST (Login & Registration) | 03:00 PM IST (Session Starts)
  • Direct Zoom Link: Click Here to Join Meeting
  • Meeting ID: 861 6903 2400
  • Passcode: 188696

Important Guidelines for Attendees

  • Early Login & Name Format: Please log in by 02:45 PM IST to complete the registration process smoothly. Kindly set your Display Name as:

    [First Name] - [Organization Name] (e.g., Jane – MMA).

    a) Please note: It is mandatory to mention your organization’s name, which will help us keep a record of attendance.

  • Camera Protocol: We encourage all participants to keep their cameras turned on throughout the session to foster an engaging environment.
  • Audio Protocol: To ensure an uninterrupted experience, all attendees will be muted by default upon entry. Microphones will be unmuted during the dedicated Q&A session in the final 30 minutes.
  • Session Recording: Please note that the session will be recorded and made available upon request.

We look forward to your active participation!

Naavi

Posted in Privacy | Leave a comment

The Rules of Nomination under DPDPA may require a correction

Section 14 of the DPDPA recognises the “Right to Nominate” as a right of the Data Principal.

The DPDP Rules, 2025 leave certain aspects of this right open to debate, as they appear legally unclear.

The section 14 of DPDPA 2023 states as follows:

Right to nominate.

(1) A Data Principal shall have the right to nominate, in such manner as may be prescribed, any other individual, who shall, in the event of death or incapacity of the Data Principal, exercise the rights of the Data Principal in accordance with the provisions of this Act and the rules made thereunder.

(2) For the purposes of this section, the expression “incapacity” means inability to exercise the rights of the Data Principal under the provisions of this Act or the rules made thereunder due to unsoundness of mind or infirmity of body.

The Rule 14(4) of the DPDPA Rules indicate the following:

(4) To exercise the rights of the Data Principal under the Act, she may, in accordance with the terms of service of the Data Fiduciary and such law as may be applicable, nominate one or more individuals, using the means and furnishing the particulars required by such Data Fiduciary for the exercise of such right.

There are several issues in this Section that are debatable under law. Let us discuss them here.

These provisions of DPDPA need to be read along with ITA 2000, Section 1(4) which states as follows

“Nothing in this Act shall apply to documents or transactions specified in the First Schedule by way of addition or deletion of entries thereto”

The schedule I of the Act indicates the following as a document included under this section.

A will as defined in clause (h) of section 2 of the Indian Succession Act, 1925 (39 of 1925) including any testamentary disposition whatever name called.

In view of the above, if the  nomination is in the “Electronic” form as a part of the privacy notice and consent, it would not be recognized as a legally valid document and hence whether it is digitally signed or supported by other means of authentication such as OTP it shall have no validity. Alternatively, the “Nomination” should be treated only as a “Transfer of Custody” of the asset and not like a testamatory document.

Nomination may however be obtained through a written form.

To understand the problem, we can explore the concept of Nomination in other laws particularly in the Banking where there are specific detailed instructions.

The Banking Regulation Act defines  “Nomination” as follows.

45ZA. Nomination for payment of depositors’ money.

(1)Where a deposit is held by a banking company to the credit of one or more persons, the depositor or, as the case may be, all the depositors together, may nominate, in the prescribed manner, one person (Ed: or upto 4 persons as per later amendment) to whom in the event of the death of the sole depositor or the death of all the depositors, the amount of deposit may be returned by the banking company.
(2)Notwithstanding anything contained in any other law for the time being in force or in any disposition, whether testamentary or otherwise, in respect of such deposit, where a nomination made in the prescribed manner purports to confer on any person the right to receive the amount of deposit from the banking company, the nominee shall, on the death of the sole depositor or, as the case may be, on the death of all the depositors, become entitled to all the rights of the sole depositor or, as the case may be, of the depositors, in relation to such deposit to the exclusion of all other persons, unless the nomination is varied or cancelled in the prescribed manner.

(3) Where the nominee is a minor, it shall be lawful for the depositor making the nomination to appoint in the prescribed manner any person to receive the amount of deposit in the event of his death during the minority of the nominee.

(4) Payment by a banking company in accordance with the provisions of this section shall constitute a full discharge to the banking company of its liability in respect of the deposit
Provided that nothing contained in this sub-section shall affect the right or claim which any person may have against the person to whom any payment is made under this section.

Further, the Section 39 of the Insurance Act 1938 defines “Nomination by the Policy Holder” linking it to the event of the death of the policy holder. Rule 19 of the Companies (Share Capital and Debentures) Rules 2014 prescribes the procedure under the Companies Act.

Section 72 of the Companies Act states nomination in the context of shares as ” any person to whom his securities shall vest in the event of his death.”.

All the above regulations apply Nomination only in case of death and not in case of “Incapacity”. Also, in cases where the data principal is mentally incapacitated ab initio, the legal guardian is also called the “Data Principal” by definition. Hence the concept of nominee stepping into the shoes to exercise the rights of the now incapacitated data principal appears to contradict with the need for appointment of a legal guardian.

Further it is established that settlement of dues from a Bank to a nominee follows the “Trustee “Principle”.

The Trustee principle has been endorsed by the Supreme Court of India (in landmark judgments like Smt. Ram Chander Talwar v. Devender Kumar Talwar and Sarbati Devi v. Usha Devi)established that a nominee is merely a custodian or trustee. The Shakti Yezdani v. Jayanand Salgaonkar (SC, 2023) also upholds the same principle.

It is also clarified that the nominee has the legal right to receive the money from the bank, but they do not automatically inherit it. They are legally obligated to hand over those funds to the rightful legal heirs (as designated by a Will or by intestate succession laws)

The primary purpose of Section 45ZA(4) is to protect the banking institution.

  • Once the bank verifies the account holder’s death certificate and the nominee’s identity, it transfers the money to the nominee.
  • This payment gives the bank a full and valid discharge of its liability. It frees the bank from getting caught in bitter family disputes or waiting for time-consuming court orders like a Succession Certificate
  • Up to Four Nominees: Following updates implemented under the Banking Laws (Amendment) Act, 2025, depositors can nominate up to four individuals per account.
  • Simultaneous vs. Successive: Nominations can be made simultaneously (where you explicitly split percentages among up to 4 people, totaling exactly 100%) or successively (where Nominee B gets the funds only if Nominee A passes away before the account holder)
  • Joint Accounts: If an account is held jointly (e.g., “Either or Survivor”), the nomination event is contingent upon the death of all depositors. The surviving joint holder always retains control of the funds over the nominee while alive.
  • Minor Nominees: If a minor is chosen as a nominee, the account holder must appoint an adult guardian/appointee who is authorized to receive the funds on the minor’s behalf if the contingent event occurs during their minority

Sections 45ZC and ZE define the nomination related to safe custody articles and Safe Deposit lockers. Section 45ZG which was inserted after an amendment on November 1 2025 indicate the determination of the priority of nomniation when there are successive nominations. It states as follows:

Priority of successive nominations (Sec 45ZG)

(1) Where the nomination is made in favour of more than one person successively under sub-section (1) of section 45ZA or sub-section (1) of section 45ZC or sub-section (1) of section 45ZE, the nomination shall be effective only in favour of one person in the following order of priority, namely:––

(a) nomination of the first nominee shall be effective if that nominee survives the person or persons who made the nomination;

(b) nomination of the second nominee shall become effective only after the death of the first nominee;

(c) nomination of any nominee lower in the order of nomination shall become effective only after the death of all the nominees whose names are higher in the order of nomination.

(2) Where the order of nomination is not mentioned, persons shall be deemed to have been nominated in the order in which their names appear in the nomination.

(3) The provisions of this section shall not apply to the nominations made simultaneously in favour of more than one person under sub-section (1) of section 45ZA.]

RBI’s nomination may also apply to “Missing Persons” as declared under the BSA. According to Section 111 BSA a person is presumed dead if he has been missing for 7 years continuously.

RBI also permits statement of “Percentage of Nomination” as if nominations settle ownership. This is against the principle that “Nomination is only transfer of custody and not transfer of ownership”.

Hence it may be debated and can be held invalid.

The Gazette notification GSR 790(E) from Ministry of Finance dated 27th October 2025 prescribes the Nomination Rules for the Banks.

This Gazette notification provides the option of “E-Nomination” which is not in conformity with the ITA 2000.

This Gazette Notification is also not in conformity with ITA 2000 in terms of defining the methods of authentication of nomination to include OTP.

In all the above nominations systems, “Nomination becomes effective only in case of death”. The DPDPA however seems to follow the Mental Health Care Act 2017 (s 14) and states that Nomination becomes effective in the case of “Incapacity” of the data principal which is defined as

” inability to exercise the rights of the Data Principal under the provisions of this Act or the rules made thereunder due to unsoundness of mind or infirmity of body.”

This has a parallel in Section 14 of the Mental Healthcare Act, 2017, which allows a person to appoint a “nominated representative”. But unlike that Act, DPDPA provides no mechanism for certifying incapacity or for resolving conflicts with a guardian. Whether the provision works in practice needs examination.

The Considered view of the undersigned is that

  1. a) Nomination on “incapacity” needs additional safeguards, including how incapacity is to be certified to the Data Fiduciary and how the nominee’s role relates to that of a lawful guardian under Section 2(j).
  2. b) The Ministry of Finance Gazette Notification of 27th October 2025 needs revision in respect of electronic nomination.

Recently, RBI withdrew its notification in respect of opening of accounts by minors with “Independent” operation which was available after 10 years and was inconsistent with DPDPA definition of a “Child”.  Similarly, the above two anomalies may need to be corrected.

Under DPDPA, nomination should be treated as a transfer of custody of the data. On the death of the Data Principal, the purpose of processing generally comes to an end. Under Section 8(7), the Data Fiduciary must then erase the data unless retention is required by law, since continued storage only carries risk. Handing custody to the nominee, or erasing the data at the nominee’s request, discharges this obligation.

Multiple nominees create a practical problem. If they give conflicting instructions, for example one asking for custody and another for erasure, the Data Fiduciary has no way of knowing whom to follow..

The rights of the Data Principal are the rights of access, correction, erasure, grievance redressal and nomination. After death, only two of these remain meaningful: the right to take custody of the data and the right to have it erased. Once custody passes, the nominee holds the data as a trustee for the legal heirs and must deal with it only in that capacity. The other rights lose their purpose.

Also if the the nominee inherits all the rights of the data principal, he can nominate one or more persons as nominees to “exercise the rights of the Data Principal in accordance with the provisions of this Act and the rules “. This also appears inconsistent since the original purpose of collection and processing no longer exists and the continued processing cannot be considered feasible after the death of the data principal.

Hence there needs to be a further discussion on this and an amendment of rules if required.

Naavi

Posted in Privacy | Leave a comment

Certified DPDPA Trainers program from FDPPI

FDPPI, (www.fdppi.in) in association with Cyber Law College (www.cyberlawcollege.in) of Naavi (www.naavi.org) is launching a program for “Training the Trainers for DPDPA”.

Interested persons may contact Naavi.

The curriculum, the fees, mode of conduct etc will be announced as and when an initial critical number of interested persons express their interest.

Naavi

Posted in Privacy | Leave a comment

Free online DPIA offer for Corporate Members

We are now around 213 days from 13th May 2027 when DPDPA will be fully effective. Many organizations have already started implementation. Action has started on three fronts

  1. Engagement of consultants for implementation
  2. Conducting Awareness Training
  3. Create a Governance Structure for implementation
  4. Create Policy documents at all levels
  5. Software for Compliance management mainly for “Consent Management”

Some organizations have followed the above order of implementation. Some have also used the reverse order believing that software will do the trick and achieve the compliance.

While one can argue which is the correct order in which Compliance drive should be approached, everybody agrees that there has to be a synchronization of the elements.

Since many organizations have already jumped in with the impolementation in some fashion based on their current understanding of the requirements, they are now wondering if they are in the right track.

As the festival of Dussehra symbolizes the triumph of good over evil, righteousness over discord, and clarity over ignorance, it is the perfect time for organizations to strengthen their digital trust and overcome compliance hurdles.

In today’s evolving regulatory landscape, with the Digital Personal Data Protection Act (DPDPA) ensuring robust Data Protection Impact Assessments (DPIA) is no longer optional; it is essential.

To mark this auspicious season, FDPPI (Foundation of Data Protection Professionals in India) is excited to announce a special Dussehra Offer for businesses looking to elevate their data governance framework.

To assist companies re-visit their current approach to DPDPA implementation, FDPPI and Naavi are giving a special offer for the Dussera 2026 which commences from today.

For all the Corporate members who enrol on a 3 yearmembership  plan (Visit for details) we would provide a free online DPIA session to enable review of their current implementation plan. A suitable appointment may be fixed for mutual convenience to discuss the current implementation plan and identify key areas of course correction if any.

Irrespective of whom the company is already working with, a second opinion from FDPPI is a peer review opportunity before the commitments reach an irreversible state.

Interested entities may contact Naavi or FDPPI through email.

Naavi

 

Posted in Privacy | Leave a comment