#FactCheck - Viral Image of AIMIM President Asaduddin Owaisi Holding Lord Rama Portrait Proven Fake

Modern international trade heavily relies on data transfers for the exchange of digital goods and services. User data travels across multiple jurisdictions and legal regimes, each with different rules for processing it. Since international treaties and standards for data protection are inadequate, states, in an effort to protect their citizens' data, have begun extending their domestic privacy laws beyond their borders. However, this opens a Pandora's box of legal and administrative complexities for both, the data protection authorities and data processors. The former must balance the harmonization of domestic data protection laws with their extraterritorial enforcement, without overreaching into the sovereignty of other states. The latter must comply with the data privacy laws in all states where it collects, stores, and processes data. While the international legal community continues to grapple with these challenges, India can draw valuable lessons to refine the Digital Personal Data Protection Act, 2023 (DPDP) in a way that effectively addresses these complexities.

Why Extraterritorial Application? 

Since data moves freely across borders and entities collecting such data from users in multiple states can misuse it or use it to gain an unfair competitive advantage in local markets, data privacy laws carry a clause on their extraterritorial application. Thus, this principle is utilized by states to frame laws that can ensure comprehensive data protection for their citizens, irrespective of the data’s location.  The foremost example of this is the European Union’s (EU) General Data Protection Regulation (GDPR), 2016,  which applies to any entity that processes the personal data of its citizens, regardless of its location. Recently, India has enacted the DPDP Act of 2023, which includes a clause on extraterritorial application.

The Extraterritorial Approach: GDPR and DPDP Act

The GDPR is considered the toughest data privacy law in the world and sets a global standard in data protection. According to Article 3, its provisions apply not only to data processors within the EU but also to those established outside its territory, if they offer goods and services to and conduct behavioural monitoring of data subjects within the EU. The enforcement of this regulation relies on heavy penalties for non-compliance in the form of fines up to €20 million or 4% of the company’s global turnover, whichever is higher, in case of severe violations. As a result, corporations based in the USA, like Meta and Clearview AI, have been fined over  €1.5 billion and €5.5 million respectively, under the GDPR. 

Like the GDPR, the DPDP Act extends its jurisdiction to foreign companies dealing with personal data of data principles within Indian territory under section 3(b). It has a similar extraterritorial reach and prescribes a penalty of up to Rs 250 crores in case of breaches. However, the Act or DPDP Rules, 2025, which are currently under deliberation, do not elaborate on an enforcement mechanism through which foreign companies can be held accountable. 

Lessons for India’s DPDP on Managing Extraterritorial Application 

1. Clarity in Definitions: GDPR clearly defines ‘personal data’, covering direct information such as name and identification number,  indirect identifiers like location data, and, online identifiers that can be used to identify the physical, physiological, genetic, mental, economic, cultural, or social identity of a natural person. It also prohibits revealing special categories of personal data like religious beliefs and biometric data to protect the fundamental rights and freedoms of the subjects. On the other hand, the DPDP Act/ Rules define ‘personal data’ vaguely, leaving a broad scope for Big Tech and ad-tech firms to bypass obligations. 
2. International Cooperation: Compliance is complex for companies due to varying data protection laws in different countries. The success of regulatory measures in such a scenario depends on international cooperation for governing cross-border data flows and enforcement. For DPDP to be effective, India will have to foster cooperation frameworks with other nations. 
3. Adequate Safeguards for Data Transfers: The GDPR regulates data transfers outside the EU via pre-approved legal mechanisms such as standard contractual clauses or binding corporate rules to ensure that the same level of protection applies to EU citizens’ data even when it is processed outside the EU. The DPDP should adopt similar safeguards to ensure that Indian citizens’ data is protected when processed abroad.
4. Revised Penalty Structure: The GDPR mandates a penalty structure that must be effective, proportionate, and dissuasive. The supervisory authority in each member state has the power to impose administrative fines as per these principles, up to an upper limit set by the GDPR. On the other hand, the DPDP’s penalty structure is simplistic and will disproportionately impact smaller businesses. It must take into regard factors such as nature, gravity, and duration of the infringement, its consequences, compliance measures taken, etc.
5. Governance Structure: The GDPR envisages a multi-tiered governance structure comprising of   

• National-level Data Protection Authorities (DPAs) for enforcing national data protection laws and the GDPR, 
• European Data Protection Supervisor (EDPS) for monitoring the processing of personal data by EU institutions and bodies,  
• European Commission (EC) for developing GDPR legislation
• European Data Protection Board (EDPB) for enabling coordination between the EC, EDPS, and DPAs

In contrast, the Data Protection Board (DPB) under DPDP will be a single, centralized body overseeing compliance and enforcement. Since its members are to be appointed by the Central Government, it raises questions about the Board’s autonomy and ability to apply regulations consistently. Further, its investigative and enforcement capabilities are not well defined.

Conclusion 

The protection of the human right to privacy ( under the International Covenant on Civil and Political Rights and the Universal Declaration of Human Rights) in today’s increasingly interconnected digital economy warrants international standard-setting on cross-border data protection. In the meantime, States relying on the extraterritorial application of domestic laws is unavoidable. While India’s DPDP takes measures towards this, they must be refined to ensure clarity regarding implementation mechanisms. They should push for alignment with data protection laws of other States, and account for the complexity of enforcement in cases involving extraterritorial jurisdiction. As India sets out to position itself as a global digital leader, a well-crafted extraterritorial framework under the DPDP Act will be essential to promote international trust in India’s data governance regime.

Sources

• https://gdpr-info.eu/art-83-gdpr/ 
• https://gdpr-info.eu/recitals/no-150/ 
• https://gdpr-info.eu/recitals/no-51/ 
• https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf 
• https://www.eqs.com/compliance-blog/biggest-gdpr-fines/#:~:text=ease%20the%20burden.-,At%20a%20glance,In%20summary 
• https://gdpr-info.eu/art-3-gdpr/ 
• https://www.legal500.com/developments/thought-leadership/gdpr-v-indias-dpdpa-key-differences-and-compliance-implications/#:~:text=Both%20laws%20cover%20'personal%20data,of%20personal%20data%20as%20sensitive. 

‍

Along with the loss of important files and information, data loss can result in downtime and lost revenue. Unexpected occurrences, including natural catastrophes, cyber-attacks, hardware malfunctions, and human mistakes, can result in the loss of crucial data. Recovery from these without a backup plan may be difficult, if not impossible.

The fact is that the largest threat to the continuation of your organization today is cyberattacks. Because of this, disaster recovery planning should be approached from a data security standpoint. If not, you run the risk of leaving your vital systems exposed to a cyberattack. Cybercrime has been more frequent and violent over the past few years. In the past, major organizations and global businesses were the main targets of these attacks by criminals. But nowadays, businesses of all sizes need to be cautious of digital risks.

Many firms might suffer a financial hit even from a brief interruption to regular business operations. But imagine if a situation forced a company to close for a few days or perhaps weeks! The consequences would be disastrous.

One must have a comprehensive disaster recovery plan in place that is connected with the cybersecurity strategy, given the growing danger of cybercrime.

Let’s look at why having a solid data security plan and a dependable backup solution are essential for safeguarding a company from external digital threats.

1. Apply layered approaches

One must specifically use precautionary measures like antivirus software and firewalls. One must also implement strict access control procedures to restrict who may access the network.

One must also implement strict access control procedures to restrict who may access the network.

2. Understand the threat situation

If someone is unaware of the difficulties one should be prepared for, how can they possibly expect to develop a successful cybersecurity strategy? They can’t, is the simple response.

Without a solid understanding of the threat landscape, developing the plan will require a lot too much speculation. With this strategy, one can allocate resources poorly or perhaps completely miss a threat.

Because of this, one should educate themselves on the many cyber risks that businesses now must contend with.

3. Adopt a proactive security stance

Every effective cybersecurity plan includes a number of reactive processes that aren’t activated until an attack occurs. Although these reactive strategies will always be useful in cybersecurity, the main focus of your plan should be proactiveness.

There are several methods to be proactive, but the most crucial one is to analyze your network for possible threats regularly. your network securely. Having a SaaS Security Posture Management (SSPM) solution in place is beneficial for SaaS applications, in particular.

A preventive approach can lessen the effects of a data breach and aid in keeping data away from attackers.

4. Evaluate your ability to respond to incidents

Test your cybersecurity disaster recovery plan’s effectiveness by conducting exercises and evaluating the outcomes. Track pertinent data during the exercise to see if your plan is working as expected.

Meet with your team after each drill to evaluate what went well and what didn’t. This strategy enables you to continuously strengthen your plan and solve weaknesses. This procedure may be repeated endlessly and should be.

You must include cybersecurity protections in your entire disaster recovery plan if you want to make sure that your business is resilient in the face of cyber threats. You may strengthen data security and recover from data loss and corruption by putting in place a plan that focuses on both the essential components of proactive data protection and automated data backup and recovery.

For instance, Google distributes all data among several computers in various places while storing each user’s data on a single machine or collection of machines. To prevent a single point of failure, chunk the data and duplicate it across several platforms. As an additional security safeguard, they give these data chunks random names that are unreadable to the human eye.^[1]

The process of creating and storing copies of data that may be used to safeguard organizations against data loss is referred to as backup and recovery. In the case of a main data failure, the backup’s goal is to make a duplicate of the data that can be restored.

5. Take zero-trust principles

Don’t presume that anything or anybody can be trusted; zero trust is a new label for an old idea. Check each device, user, service, or other entity’s trustworthiness before providing it access, then periodically recheck trustworthiness while access is allowed to make sure the entity hasn’t been hacked. Reduce the consequences of any breach of confidence by granting each entity access to only the resources it requires. The number of events and the severity of those that do happen can both be decreased by using zero-trust principles.

6. Understand the dangers posed by supply networks

A nation-state can effectively penetrate a single business, and that business may provide thousands of other businesses with tainted technological goods or services. These businesses will then become compromised, which might disclose their own customers’ data to the original attackers or result in compromised services being offered to customers. Millions of businesses and people might be harmed as a result of what began with one infiltrating corporation.

In conclusion, a defense-in-depth approach to cybersecurity won’t vanish. Organizations may never be able to totally eliminate the danger of a cyberattack, but having a variety of technologies and procedures in place can assist in guaranteeing that the risks are kept to a minimum.

References:

• https://www.comparitech.com/vpn/cybersecurity-cyber-crime-statistics-facts-trends/
• https://www.google.com/about/datacenters/data-security/
• https://www.ibm.com/in-en/topics/cybersecurity
• https://www.cybersecurityforme.com/what-is-the-future-of-cybersecurity/

[1] https://www.google.com/about/datacenters/data-security/

Introduction

With the development of a digital economy in India, merchants in the country are often caught in a tough situation where their bank accounts have been placed under a debit freeze, due to a suspected link of the bank account with some form of cyber fraud. These merchants are left in a tough situation, as their funds, including their personal earnings, and money earned through the running of their business, have become frozen, regardless of whether or not the account holder had knowingly or intentionally engaged in any kind of illicit activity. The funds of legitimate businesses have become tied up due to this activity. 

This concern was recognized and was addressed by the Supreme Court of India in their order, which was issued in 2026, which prompted the RBI to issue their draft Directions, in 2026. The draft directions are aimed at balancing the need of the state to stop the rapid withdrawal of stolen funds, while also trying to balance the needs of law-abiding citizens to hold and access their own money and maintain some financial stability.

Understanding Money-Mule Accounts

A "money mule" account is used for depositing and/or layering/integrating illicit money. There is a broad range of culpability when a person uses their bank account as a money mule account. Some people knowingly give someone else control over their bank account and use that control to commit illegal acts to make some money. Others, however, are unsuspecting and fall victim to fraudulent activities such as online ads offering bogus jobs or romance scams.

The proliferation of these accounts introduces severe systemic friction into cybercrime investigations, as stolen assets are rapidly dispersed across multiple tranches and jurisdictions before law enforcement can trace the primary beneficiaries. Accordingly, banking institutions bear a rigorous compliance burden to deploy real-time transaction monitoring systems capable of identifying anomalous patterns to pre-emptively mitigate the dissipation of fraudulent proceeds.

However, having an account involved in a questionable money transfer does not make the person account holding automatically a money mule. There is the innocent account holder who is being used as a transferrer for money to a person who has something to trade in exchange, or perhaps an account holder whose account was taken over. There are also accounts who have unknowingly been victim to identity theft. Due process requires a framework that allows an account holder to contest their money hold while providing regulatory safeguards to protect consumers.

What Does the RBI’s Draft Propose?

1. Temporary debit holds on suspicious transactions

The Draft Directions mandate that banking institutions institute temporary debit holds upon detecting transactions or accounts exhibiting a suspected nexus with money mule activities or cyber-enabled financial fraud. Real-time transaction monitoring systems leveraging advanced Artificial Intelligence (AI) and Machine Learning (ML) architectures shall be deployed to identify anomalous or suspicious transactions capturing a threshold value of ₹1,000 or more.

2. Notice and an opportunity to explain

Procedural safeguards within the framework include notice being provided by the banking institution to the customer within a statutory time period following a debit hold. The notice must specify the reason(s) behind the hold, and the procedures for a customer to request for the hold to be vacated, as well as providing information and contact details of the officer handling the matter.

• Showing Cause: The account holder shall ordinarily be granted a statutory window of 20 days from the receipt of notice to show cause and establish the legitimacy of the transaction or account.
• Adjudication by Bank: Upon submission of the customer's explanation, the bank is mandated to adjudicate the matter within 10 days. If the explanation is deemed statutorily satisfactory, the institution must vacate the hold instanter.
• Law Enforcement Referral: In the event the response is found to be lacking in substance, the bank can make a referral to the concerned law enforcement authority through the Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS) portal of the National Cybercrime Reporting Portal (NCRP).
• Temporal Sunset Clauses: The framework includes stringent temporal provisions for law enforcement actions to ensure that administrative delays do not turn the temporary holds into perpetual financial incapacitation:
  
  • The 30-Day Directive Rule: In case the competent law enforcement authority does not issue a formal directive for the need to maintain the hold beyond the stipulated period within 30 days of the referral, then the bank is statutorily bound to remove the restriction after 30 days.
  • Absolute Maximum Ceiling: In the absence of an explicit overriding direction from a competent judicial or statutory authority, the absolute maximum tenure of any temporary hold shall remain 60 days from the date of initiation of the hold.

3. Greater accountability for banks

Beyond the mechanics of fraud detection, the proposed framework also imposes greater responsibilities on banks with respect to compliance and governance. This implies that the banks need to have an internal policy on detection, implementation and release of the hold order, standardized customer communication, coordination with the law enforcement authorities, and also grievances redressal.

Balancing Fraud Prevention with Customer Rights

The promise of a proportionate approach

The core efficacy of the proposed regulatory framework rests upon its adherence to the constitutional doctrine of proportionality, seeking to calibrate administrative restrictions strictly to the scope of the alleged wrongdoing. Historically, the imposition of indiscriminate, blanket account freezes by banking institutions has induced severe financial disenfranchisement. These overreaching actions effectively inhibit the citizen’s ability to ensure basic necessities for oneself, meet one’s tenancy responsibilities, meet one’s medical liabilities, and remain solvent within the commercial environment.

For proprietary firms, micro-traders, and small-to-medium enterprises (SMEs), an inaccessible bank account means instant cessation of business activity, inability to pay salaries, and inability to pay suppliers. A transaction-based debit block, contingent upon statutory justification and limited by time is considerably less disruptive to the economic consequences.

The risks that remain

While Draft Directions are innovative, their effectiveness still rests on the ability of algorithms to detect fraud. An anomaly detection machine learning model is good at finding variations and deviations in transactions and the order of transactions. However, there are many variations in legitimate transactions, such as a large transfer in an otherwise small transaction account. An automated transaction system cannot identify fraud alone.

An over-reliance on unverified automated alerts creates an acute risk of systemic recidivism, wherein innocent depositors face iterative, unwarranted financial restrictions. Without legal and procedural support, automated fraud detection systems should not be used in banking and legal systems.

From an evidentiary standpoint, informal workers, small-scale vendors, and consumers lacking advanced digital literacy face severe structural barriers when ordered to establish the legitimacy of a transaction within the statutory 20-day window. These demographics frequently operate without formal invoices, digital ledger entries, or direct access to professional legal and banking assistance.

To prevent the reversing of the burden of proof onto the vulnerable, banking institutions must be mandated to provide simplified, multilingual channels for showing cause, accept alternative forms of secondary evidence, and eschew overly burdensome compliance hurdles. Crucially, where a depositor submits credible exculpatory evidence, clear statutory escalation and appellate pathways must be available to counter institutional inertia.

Recommendations for Effective Implementation

First, banks need to implement explainable and risk-based detection mechanisms, if needed, accompanied by human review. Secondly, banks need to give customers timely notice regarding the blocked transaction with explanation on what amount it concerns, steps to be taken and how one can submit additional evidence.

Thirdly, the RBI should ensure that grievance redressal is effective in practice, with urgent review of cases concerning necessary expenses and business hardship. Finally, coordination between banks and law-enforcement agencies must improve so that referrals are acted upon within the prescribed timelines.

Conclusion

The RBI’s Draft Know Your Customer Amendment Directions, 2026, represents a significant regulatory effort to resolve the systemic friction between combating cyber-enabled financial fraud and protecting consumer property rights. By introducing transaction-specific holds, mandatory customer notification, a statutory right to be heard, and strict temporal ceilings, the framework introduces a much-needed ethos of accountability into the digital ecosystem.

The sustainability of India’s digital economy in the long run cannot be contingent on a structure that inhibits the flow of illegitimate money through imposing severe, extrajudicial monetary disabilities on innocent people because the true effectiveness of any system entails not only inhibiting the criminals behind cybercrime but also protecting the financial safety and liquidity of regular depositors.

‍

References

1. Reserve Bank of India, Draft Reserve Bank of India (Know Your Customer) Amendment Directions, 2026 (11 September 2026) RBI official website.
2. In Re: Victims of Digital Arrest Related to Forged Documents, Suo Motu Writ Petition (Criminal) No. 3 of 2025 (Supreme Court of India, Order dated August 4, 2026)
3. Reserve Bank of India, Reserve Bank of India (Know Your Customer) Directions, 2025
4. ‘RBI Proposes Temporary Debit Holds on Suspected Money Mule Accounts’, Business Standard (13 September 2026), https://www.business-standard.com/finance/news/rbi-proposes-temporary-debit-holds-on-suspected-money-mule-accounts-126091300603_1.html.
5. ‘RBI Proposes Framework to Freeze Only Disputed Transaction Amount in Suspected Cyber Fraud Cases’, News on AIR (14 September 2026), https://newsonair.gov.in/rbi-proposes-framework-to-freeze-only-disputed-transaction-amount-in-suspected-cyber-fraud-cases/.
6. Reserve Bank of India, Draft Reserve Bank of India (Know Your Customer) Amendment Directions, 2026 (11 September 2026).

‍