In corporate governance, Independent Directors play an important role in protecting shareholder interests. One of their core responsibilities is to oversee risks that may adversely affect the financial position and sustainability of the company.
Traditionally, this responsibility has been interpreted in the context of financial reporting, internal controls, statutory compliance, and operational risks. However, in today’s data-driven economy, such an interpretation is no longer sufficient.
Now, Data has emerged as one of the most valuable assets of modern enterprises. In many organizations, data is accumulated, processed, analyzed, and monetized long before its value is reflected in the financial statements. Consequently, Independent Directors can no longer limit their oversight to the integrity of financial reports. They must also understand the value, ownership, control, and governance of the organization’s data assets.
An unscrupulous management may undervalue, transfer, misuse, or otherwise compromise data assets in a manner that may not immediately appear as a financial irregularity. Yet the impact on shareholder value can be as significant as fraud, asset stripping, or money laundering. Unfortunately, many boards and Independent Directors are yet to recognize this dimension of governance.
The history of CIBIL provides an example worthy of study. The transfer of control over a valuable national data asset through changes in shareholding raised questions regarding the valuation and stewardship of data that had been contributed by Indian financial institutions. At the time, concerns were raised regarding the long-term implications for the banking sector and the country. However, the governance implications of transferring control over a strategic data asset did not receive the attention that a comparable transfer of tangible assets or financial resources might have attracted.
This raises a broader question: Are Independent Directors adequately equipped to oversee data governance risks?
The question assumes greater significance after the enactment of the Digital Personal Data Protection Act, 2023. Non-compliance with DPDPA can result in substantial financial penalties, reputational damage, regulatory action, and loss of stakeholder trust. DPDPA risk is therefore not merely a compliance issue; it is a board-level governance risk.
Schedule IV of the Companies Act, 2013 prescribes a Code for Independent Directors and specifies their roles, functions, and duties. These include safeguarding stakeholder interests, scrutinizing management performance, satisfying themselves regarding the integrity of financial information and risk management systems, and bringing an independent judgment to board deliberations.
Viewed in this context, oversight of DPDPA compliance naturally falls within the governance responsibilities of Independent Directors. They should be asking questions such as:
- Has the organization identified and classified its personal data assets?
- Has a DPDPA risk assessment been undertaken?
- What is the potential financial exposure arising from non-compliance?
- Are adequate governance mechanisms in place for consent management, data principal rights, breach response, and vendor oversight?
- Is the Board receiving periodic reports on privacy and data protection risks?
These questions are now as important as questions relating to financial controls or statutory audits.
Having recently renewed my registration in the Independent Directors’ databank, I found 
myself reflecting on whether the objectives behind the institution of Independent Directors are being fully realized in the emerging data economy. It is also pertinent to ask whether sufficient emphasis is being placed on DPDPA governance in the training and continuing education programmes conducted for Independent Directors.
Over the last few years, we at FDPPIÂ have attempted to engage with board members and governance professionals through conferences, symposiums, and awareness programmes. We have consistently emphasized that DPDPA compliance should be viewed as a board responsibility and that Independent Directors should play a leadership role in assessing and monitoring DPDPA-related risks.
If the Independent Directors’ framework administered by the Indian Institute of Corporate Affairs is to remain relevant in the coming decade, it must incorporate data governance, privacy governance, AI governance, and DPDPA risk management as core elements of board oversight.
The institution of Independent Directorship was created to provide objective and independent supervision of management. In the digital economy, independence must extend beyond financial scrutiny to include stewardship of data assets and protection of stakeholder rights.
As someone associated with the Independent Directors’ databank, I consider it my duty to raise these concerns. I hope that the Indian Institute of Corporate Affairs will confirm that adequate steps have been taken to sensitise Independent Directors to DPDPA-related risks and to equip them with the knowledge necessary to discharge their responsibilities effectively in their respective organizations.
Naavi
