The MoU – What Was Signed and Who Is Involved

FDPPI‑MYRA MoU: Building India's Data Protection Workforce under New Privacy Law

The Foundation of Data Protection Professionals in India (FDPPI) and MYRA School of Business, Mysuru, signed a Memorandum of Understanding on 30 July 2026 in Mysuru. The pact aims to create co‑branded certification programmes and research collaborations that will feed the talent pipeline demanded by the Digital Personal Data Protection Act 2023. By linking industry expertise with academic rigour, the partnership seeks to operationalise the nation’s emerging data‑governance architecture.

The agreement was executed by FDPPI Chairman Na. Vijayashankar (known as “Naavi”) and MYRA Managing Trustee M.L. Kantharaja Urs, with Director Ramasastry Ambarish also signing on behalf of the business school.

• ▸The MoU was exchanged during a press meet at MYRA’s Mysuru campus on 30 July 2026.
• ▸FDPPI will contribute its Data Governance and Protection Standard of India (DGPSI) to the curriculum design.
• ▸MYRA will host executive‑education courses, faculty‑development workshops, and student‑internship programmes.
• ▸The first batch of jointly developed certification programmes is slated for launch in the next quarter.
• ▸Both parties will co‑organise seminars and conferences for regulators, industry, and academia.

Digital Personal Data Protection Act 2023 – The Legal Bedrock

Enacted in August 2023, the Digital Personal Data Protection Act 2023 establishes a comprehensive framework for the collection, processing, and transfer of personal data. It obliges every data fiduciary to appoint a Data Protection Officer and to conduct periodic data‑impact assessments. The law also creates the Data Protection Board of India, empowered to levy penalties up to ₹25 crore or 4 % of global turnover.

• ▸Section 4 mandates a written privacy policy for each data‑processing activity.
• ▸Section 7 requires a Data Protection Officer to be a resident Indian with at least 5 years of experience.
• ▸Section 12 empowers the Board to order data localisation for “critical personal data”.
• ▸The Act aligns with the Right to Information Act 2005 by allowing citizens to request disclosures of data‑handling practices.
• ▸Non‑compliance triggers a mandatory public notice within 30 days of a breach.

Capacity Building under Digital India: From Standards to Certification

The MoU dovetails with the broader Digital India initiative, which envisions a unified digital ecosystem anchored by interoperable standards. The DGPSI, developed by FDPPI, provides a technical baseline for data‑security controls, encryption protocols, and audit trails. By embedding these standards into MYRA’s curricula, the partnership creates a pipeline of professionals capable of implementing the Act’s provisions across sectors—from fintech to health‑tech.

• ▸DGPSI outlines 12 control families, including access management, incident response, and third‑party risk.
• ▸MYRA’s executive‑education modules will allocate 30 hours to hands‑on labs on privacy‑by‑design.
• ▸Certification will be assessed by an independent audit board comprising members from the Ministry of Electronics and Information Technology.
• ▸Graduates will be eligible for the “Certified Data Protection Officer” badge recognised by the Data Protection Board.
• ▸The programme will also cover Artificial Intelligence Governance to address algorithmic bias and explainability.

Implementation Gaps and Accountability Mechanisms

While the legal framework is robust, on‑ground delivery faces hurdles. Many organisations lack the internal audit capacity to verify compliance, and the Data Protection Board’s enforcement powers remain under‑utilised. The Right to Information Act 2005 offers a citizen‑driven oversight tool, yet filing RTI requests for data‑handling disclosures often meets bureaucratic delays. Strengthening the feedback loop between regulators and industry will require transparent reporting, periodic third‑party audits, and a clear grievance redressal pathway.

• ▸A 2024 audit by the Comptroller and Auditor General found that 68 % of large firms had not appointed a Data Protection Officer.
• ▸The Board’s annual report (2025) recorded only 12 penalty actions, suggesting low enforcement intensity.
• ▸RTI queries related to data‑privacy rose by 45 % between 2023 and 2025, indicating growing public awareness.
• ▸The MoU includes a clause for joint research on “privacy impact assessments” to inform policy refinements.
• ▸Stakeholder workshops will be convened quarterly to align academic outputs with regulatory expectations.

The FDPPI‑MYRA collaboration thus represents a strategic response to the twin challenges of skill scarcity and regulatory compliance. By institutionalising privacy education within the Digital India ecosystem, it promises to bridge the gap between legislative intent and practical implementation, reinforcing India’s credibility in the global data‑governance arena.