The DGPSI System which started as a model DPDPA Compliance system in 2023 has come a long way in the last 3 years.

What started with DGPSI-Full Version later was modified as DGPSI-Lite version which we are now calling as DGPSI-SME. Subsequently DGPSI has developed in multiple directions. DGPSI-AI was an extension on the technology front. DGPSI HR was an attempt to address the DPDPA Compliance requirements on a functional basis. DGPSI-Hospital and DGPSI-Banks was an attempt to address the requirements of DPDPA Compliance in specific sectors. DGPSI-DP was another attempt to extend the Compliance framework to a category of activity and DGPSI-GDPR was an attempt to extend the framework to other legal frameworks. Together DGPSI has made FDPPI a “Standards Organization”.

DPDPA is a single law for all sectors and all sizes of companies. This was inevitable for the creation of the data protection law. But from the perspective of implementation in the industry this was a challenge which needed to be addressed. The “Framework” with different flavours for different purposes was therefore an attempt to make it possible for the industry to work on Compliance with appropriate modifications tailored to different industries.

In this journey it is now being explored if “Start UPs” can be considered as a “Class of Data Fiduciaries” for whom a simplified DGPSI Frameworks can be designed.

FDPPI has therefore started a project under the Title “Project May 13” to develop an exclusive framework of DPDPA Compliance that would address the “StartUP sector”. “Start Up sector” like the “SME Sector” can represent multiple industry sectors. There can be a Fintech Start up as well as a Health Care start up. But if there is a commonality between them as a “Start Up” it may be possible to create a Version of DGPSI like DGPSI-Lite which is a sector agnostic framework that is applicable to Start Ups.

Until now, DGPSI variants have broadly emerged around questions such as:

Which sector does it belong to?, What function is being addressed?, What technology is involved?, What activity is being performed? or Which law or regulatory framework applies?

Now DGPSI-Start Ups will start addressing the question:

Where is the organisation in its lifecycle? That could make lifecycle-based compliance an important future dimension of DGPSI.

A start-up could therefore move progressively from a basic DGPSI-Startup profile into DGPSI-SME or DGPSI-Full as its organisation matures, while adopting specialised profiles such as DGPSI-AI, DGPSI-HR or sector-specific frameworks wherever necessary.

The frameworks would not necessarily be competing products. They could become building blocks of a larger DGPSI architecture.

At this stage, there are more questions to be answered.

For example:

• • What exactly constitutes a “start-up” for the purpose of a compliance framework?
  • Should recognition be based on age, funding, turnover, employee strength, government recognition or some combination?
  • Should a start-up processing very sensitive or large volumes of personal data receive the same treatment as a low-risk start-up?
  • How should AI-native start-ups be treated?
  • How should start-ups that rapidly become Significant Data Fiduciaries transition into a more mature framework?
  • What should be the minimum compliance baseline?
  • Which DGPSI controls can be simplified?
  • Which controls should never be compromised?
  • Can compliance be embedded into product development and engineering processes?
  • Can investors and customers use the framework as a measure of data-protection maturity?

These questions deserve discussion. This thought is at a very preliminary stage and we can explore this as we go ahead. Your thoughts are welcome.

Project May 13 — the beginning of a conversation

To explore this thought further, FDPPI proposes to conduct a survey titled “Project May 13” to find out from professionals on how a DGPSI framework can be constructed for Start Ups for DPDPA Compliance without Pain.

The objective is to determine whether the underlying proposition is valid.

Can “Start-up” be considered a meaningful class of Data Fiduciary from the perspective of DPDPA implementation?

If the answer is yes, the next question will be:

What should a start-up-specific DGPSI framework look like?

And perhaps the most important question will be:

Can India develop a model in which data protection becomes part of the DNA of a start-up from its earliest days, rather than becoming a compliance burden imposed after the organisation has already grown?

That is the question with which Project May 13 begins.

The thought is at a very preliminary stage. Views, suggestions, criticism and alternative approaches from start-ups, founders, privacy professionals, lawyers, technology professionals, investors, auditors and regulators will be valuable in shaping the next stage of the project.

Project May 13 starts with a question. The framework, if justified, will emerge from the answers.

(To Be continued)

Naavi