Key change in the Data protection bill

Introduction

The United Nations (UN) has unveiled a set of principles, known as the 'Global Principles for Information Integrity', to combat the spread of online misinformation, disinformation, and hate speech. These guidelines aim to address the widespread harm caused by false information on digital platforms. The UN's Global Principles are based on five core principles: social trust and resilience, independent, free, and pluralistic media, healthy incentives, transparency and research, and public empowerment. The UN chief emphasized that the threats to information integrity are not new but are now spreading at unprecedented speeds due to digital platforms and artificial intelligence technologies.

These principles aim to enhance global cooperation in order to create a safer online environment. It was further highlighted that the spread of misinformation, disinformation, hate speech, and other risks in the information environment poses threats to democracy, human rights, climate action, and public health. This impact is intensified by the emergence of rapidly advancing Artificial Intelligence Technology (AI tech) that poses a growing threat to vulnerable groups in information environments.

The Highlights of Key Principles

1. Societal Trust and Resilience: Trust in information sources and the ability and resilience to handle disruptions are critical for maintaining information integrity. Both are at risk from state and non-state actors exploiting the information ecosystem.
2. Healthy Incentives: Current business models reliant on targeted advertising threaten information integrity. The complex, opaque nature of digital advertising benefits large tech companies and it requires reforms to ensure transparency and accountability.
3. Public Empowerment: People require the capability to manage their online interactions, the availability of varied and trustworthy information, and the capacity to make informed decisions. Media and digital literacy are crucial, particularly for marginalized populations.
4. Independent, Free, and Pluralistic Media: A free press supports democracy by fostering informed discourse, holding power accountable, and safeguarding human rights. Journalists must operate safely and freely, with access to diverse news sources.
5. Transparency and research: Technology companies must be transparent about how information is propagated and how personal data is used. Research and privacy-preserving data access should be encouraged to address information integrity gaps while protecting those investigating and reporting on these issues.

Stakeholders Called for Action

Stakeholders, including technology companies, AI actors, advertisers, media, researchers, civil society organizations, state and political actors, and the UN, have been called to take action under the UN Global Principles for Information Integrity. These principles should be used to build and participate in broad cross-sector coalitions that bring together diverse expertise from civil society, academia, media, government, and the international private sector, focussing on capacity-building and meaningful youth engagement through dedicated advisory groups. Additionally, collaboration is required to develop multi-stakeholder action plans at regional, national, and local levels, engaging communities in grassroots initiatives and ensuring that youth are fully and meaningfully involved in the process.

Implementation and Monitoring

To effectively implement the UN Global Principles at large requires developing a multi-stakeholder action plan at various levels such as at the regional, national, and local levels. These plans should be informed and created by advice and counsel from an extensive range of communities including any of the grassroots initiatives having a deep understanding of regional challenges and their specific needs. Monitoring and evaluation are also regarded as essential components of the implementation process. Regular assessments of the progress, combined with the flexibility to adapt strategies as needed, will help ensure that the principles are effectively translated into practice.

Challenges and Considerations

Implementing these Global Principles of the UN will have certain challenges. The complexities that the digital landscape faces with the rapid pace of technological revamp, and alterations in the diversity of cultural and political contexts all present significant hurdles. Furthermore, the efforts to combat misinformation must be balanced with protecting fundamental rights, including the right to freedom of expression and privacy. Addressing these challenges to counter informational integrity will require continuous and ongoing collaboration with constant dialogue among stakeholders towards a commitment to innovation and continuous learning. It is also important to recognise and address the power imbalance within the information ecosystem, ensuring that all voices are heard and that any person, specifically, the marginalised communities is not cast aside.

Conclusion

The UN Global Principles for Online Misinformation and Information Integrity provide a comprehensive framework for addressing the critical challenges that are present while facing information integrity today. Advocating and promoting societal trust, healthy incentives, public empowerment, independent media, and transparency, these principles offer a passage towards a more resilient and trustworthy digital environment. The future success of these principles depends upon the collaborative efforts of all stakeholders, working together to safeguard the integrity of information for everyone.

References

• https://www.business-standard.com/world-news/un-unveils-global-principles-to-combat-online-misinformation-hate-speech-124062500317_1.html
• https://www.un.org/sustainabledevelopment/blog/2024/06/global-principles-information-integrity-launch/ 
• https://www.un.org/sites/un2.un.org/files/un-global-principles-for-information-integrity-en.pdf
• https://www.un.org/en/content/common-agenda-report/assets/pdf/Common_Agenda_Report_English.pdf 

‍

Introduction

For years, Indian companies could get away with vague privacy promises. That window closed on 13 November 2025, when the government notified the Digital Personal Data Protection Rules, giving teeth to the broad principles Parliament had passed back in 2023 under the DPDP Act. The Rules turned soft commitments into specific, auditable duties, and a lot of organisations are only now realising how much that actually changes.

Start with Section 8(4). It requires every Data Fiduciary to put "appropriate technical and organisational measures" in place. Most readers skim past "organisational" and focus on the technical half, but that's a mistake, because the word is doing real work. It's asking for defined roles, written policies, staff training, and someone actually watching whether any of it holds up over time, not just firewalls and encryption keys. Section 8(5) goes further, demanding reasonable security safeguards against breaches, and Rule 6 spells out exactly what that phrase means in practice: encrypt data at rest and in transit, restrict access on a need to know basis, require multi factor authentication, log and monitor activity, run regular vulnerability checks, bind your data processors contractually to the same standard, and keep relevant logs for at least a year.

Then there's Rule 7, and this is where the clock starts running. Once a Data Fiduciary becomes aware of a breach, the Data Protection Board must be told without delay, and a full report has to follow within 72 hours covering what happened, when, why, what's being done about it, and confirmation that affected individuals were notified. Unlike GDPR, there's no minimum severity threshold here. A breach affecting ten people triggers the same obligation as one affecting ten million. And CERT-In's existing six hour reporting window under its 2022 Directions still applies separately, which means a serious incident can trigger two overlapping regulatory clocks running side by side.

Put all of this together and a pattern emerges. The law assumes an organisation already knows what it's protecting, has actually protected it, kept usable records the whole way through, and can explain clearly what happened the moment something breaks. That coordination job belongs to Governance, Risk and Compliance, or GRC for short. GRC decides who's accountable, which risks actually matter, which controls address them, and how anyone checks whether compliance is real rather than assumed. Skip that structure and security work tends to splinter into a pile of disconnected tasks nobody truly owns.

GRC gives a legal duty somewhere to live. Forensic readiness is what lets an organisation prove, months or years later, that the duty was actually being met.

The Role of Governance, Risk and Compliance

On paper, most cybersecurity programmes look fine. There's an incident response plan somewhere, access control rules exist, logging is "in place," and someone has a title that says they're responsible for security. None of that gets tested until something actually breaks. A phishing compromise, a ransomware infection, a leaked database, a hijacked admin account, whatever the trigger, the questions that follow are always the same, and they're not comfortable ones. What happened, exactly, and when did it start? Which systems, which data, were actually touched? Were the controls the organisation claims to run genuinely functioning at that moment, or just described in a slide deck somewhere? And can anyone produce records solid enough to answer those questions with confidence rather than a shrug?

This is the exact seam where GRC and digital forensics meet. GRC lays out what's expected, who's responsible, and what evidence a control should be generating in the background. Digital forensics is the craft of taking whatever technical traces actually exist and turning them into an account of events that will hold up to scrutiny. Passing an audit was never really the point. Being able to stand in front of a regulator, mid incident, and show that the processes described on paper were real, active, and generating trustworthy evidence, that's the actual bar.

Why Compliance Alone Falls Short

Compliance, in the narrow sense, just means meeting whatever legal, contractual, or internal requirement applies. But a policy sitting in a document repository proves nothing about what actually happens on a Tuesday afternoon when someone requests admin access. A written incident response plan says nothing about whether the team can actually execute it under real pressure, at 2am, with a ransomware note on every screen. A logging policy is close to worthless if the logs it promises were switched off somewhere along the way, or overwritten, or scattered across systems that were never synchronised to the same clock.

NIST's Cybersecurity Framework 2.0 essentially built this concern into its core structure, placing "Govern" alongside Identify, Protect, Detect, Respond, and Recover as one of five equal functions rather than background paperwork sitting off to the side. India's own regulatory posture pushes in the same direction. CERT-In's 2022 Directions require certain incidents to be reported within six hours of discovery, and its guidance for government entities leans heavily on documented incident handling and disciplined evidence practices. The underlying message from both is identical: figure out, before anything goes wrong, whether the evidence you'll eventually need is actually going to exist when someone asks for it.

Where GRC and Forensics Actually Connect

A good GRC programme spells out what's supposed to happen. Forensic readiness is what lets you later prove what actually did.

Access control is a useful example here. On the GRC side, an organisation might require least privilege access, multi factor authentication, periodic reviews of who holds privileged accounts, and prompt removal of access once someone leaves or changes roles. On the forensic side, none of that means anything without the underlying records that let investigators actually test it, authentication logs, MFA usage history, privilege change records, and account activity trails. The table below lines up a few common GRC controls against the specific evidence needed to show they were genuinely operating.

‍

A Practical Scenario: After a Ransomware Incident

Picture a mid-sized company waking up to find half its file servers encrypted. There's an incident response plan somewhere in the shared drive, technically, but nobody's actually run through it in over a year. The security team isolates the obviously compromised endpoint and starts escalating. Now the forensic side of the house has to reconstruct what happened, working backward through endpoint telemetry, authentication logs, firewall events, email traffic, and file activity, hunting for the original point of entry, how the attacker escalated privileges, how they moved sideways through the network, what data they actually touched, and finally how the ransomware got deployed.

This is where the quality of everything collected beforehand suddenly matters a great deal. If server clocks were never properly synchronised, the timeline investigators build might not line up cleanly enough to trust. If logs only ever lived locally on individual machines rather than being pulled centrally, some of them are probably gone by now. If nobody ever bothered logging administrator actions, there are going to be real, unexplained gaps in the story. And if whatever evidence does exist wasn't collected the right way, its integrity can be challenged later, sometimes fatally, in a legal or regulatory proceeding. CERT-In actually ran a programme on exactly this in July 2026, "Inside the Breach," covering system artefacts, investigative technique, and chain of custody requirements, precisely because this is where real investigations tend to succeed or quietly fall apart.

Building a Forensic Ready GRC Programme

For an organisation starting more or less from scratch, forensic readiness doesn't need to be bolted on as some separate initiative. It can be built straight into the GRC programme that already exists. Start by identifying the systems, applications, cloud services, and privileged accounts that actually matter. Map the real risks and regulatory requirements onto the controls meant to address them. Then get specific about what evidence each control should be generating, and how that evidence gets protected and kept over time. Time synchronisation, centralised logging, tightly controlled access to security records, and clear ownership of preservation, escalation, and investigation all need to exist well before an incident, not be improvised during one. And none of it means much until it's actually been tested, through tabletop exercises and simulated incidents rather than assumed to work because it's written down somewhere. NIST SP 800-61 Revision 3 frames incident response as one continuous loop of preparation, detection, response, recovery, and improvement, rather than a series of separate boxes to check.

There's one question worth asking of every important control an organisation runs: could you actually prove this was working at the moment an incident happened? If the honest answer is no, what you have is a compliance process on paper, and a forensic readiness gap sitting quietly underneath it.

Conclusion

Cyber readiness was never really about how many policies sit in a binder or how many boxes get ticked in an audit. It shows up, or doesn't, in the hours right after something breaks, when an organisation has to move fast, preserve evidence that can actually stand up to scrutiny, explain clearly what happened, and prove that governance and technical controls were genuinely working together rather than just coexisting on paper. GRC sets the direction, the accountability, the risk priorities, and the compliance expectations. Digital forensics does the work of preserving and interpreting the technical evidence once something actually happens. Forensic readiness sits in between the two, making sure they're actually talking to each other long before an incident forces the conversation. The practical task for most organisations comes down to something simple to say, if not always simple to build: design controls that hold up under real incident response, not just an auditor's checklist. The strongest compliance posture was never the one with the thickest binder. It's the one that can back every document up with evidence, on the day it actually matters.

References

1. Digital Personal Data Protection Act, 2023, Sections 8(4), 8(5), 8(6). https://www.meity.gov.in/writereaddata/files/Digital%20Personal%20Data%20Protection%20Act%202023.pdf
2. Digital Personal Data Protection Rules, 2025, Rules 6 and 7, notified 13 November 2025. https://www.meity.gov.in
3. National Institute of Standards and Technology, The NIST Cybersecurity Framework (CSF) 2.0, CSWP 29, 2024. https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-csf-20/final
4. Indian Computer Emergency Response Team (CERT-In), Directions under Section 70B of the Information Technology Act, 2000, dated 28 April 2022. https://www.cert-in.org.in/Directions70B.jsp
5. Indian Computer Emergency Response Team (CERT-In), Guidelines on Information Security Practices for Government Entities. https://www.cert-in.org.in/Downloader?fileName=CIPS-2026-0014.pdf&pageid=5&type=2
6. National Institute of Standards and Technology, SP 800-86: Guide to Integrating Forensic Techniques into Incident Response, 2006. https://csrc.nist.gov/pubs/sp/800/86/final
7. International Organization for Standardization, ISO/IEC 27037:2012, Guidelines for identification, collection, acquisition and preservation of digital evidence. CERT-In, "Inside the Breach: Advanced Cyber Forensics & Incident Investigation," 31 July 2026. https://www.cert-in.org.in/s2cMainServlet?pageid=PRSTNVIEW03&reCode=CIWS-2026-3569
8. National Institute of Standards and Technology, SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management, 2025. https://csrc.nist.gov/pubs/sp/800/61/r3/final
9. Matters.ai, "DPDP Breach Notification: 72-Hour Rule & ₹200 Cr Penalty." https://www.matters.ai/article/dpdp-breach-notification MediaNama, "Data Breach Reporting Timeline of DPDP Rules 2025 Explained." https://www.medianama.com/2025/11/223-data-breach-reporting-timeline-of-dpdp-rules-2025-explained/

‍

Introduction

‍

On August 8, 2026, Hyderabad Police Commissioner V.C. Sajjanar posted an unusual warning on X: colourful posters offering a "handsome guy" to join you for coffee or a movie  at 50% off: it was not a quirky dating startup but a calculated cyber fraud. Within hours, the "Rent Boyfriend" alert had gone viral, pulling back the curtain on a scam that blends India's growing loneliness economy, classic confidence tricks, and AI-generated imagery. Here is what's actually happening, why it works, and how to protect yourself.

‍

A Trend Growing Fast: In India and Worldwide

‍

Paid-companionship culture itself isn't new. "Rent a friend" services began in Japan and later China, where apps let people hire a company for a movie, a walk, or a family event without romantic or sexual expectations. The idea reached India as early as 2018, when Mumbai's "Rent A Guy" app began recruiting men for casual outings; by 2022, similar pages like "Toy Boy" and "Hire a Friend" had spread to Bengaluru, and Valentine's Day 2025 saw ₹389 "rent a boyfriend" posters plastered across the city. Fraudsters have now hijacked this recognisable, socially normalised idea and weaponised it: the Hyderabad ads promised specific packages,  ₹499 for a coffee date, ₹1,249 for a movie, ₹1,999 for a wedding, and ₹4,499 for ten hours collected via QR codes and wallets, then vanished. The underlying numbers show why this template is so attractive to criminals. Complaints filed on India's National Cyber Crime Reporting Portal jumped from roughly 4.5 lakh in 2021 to about 2.3 million by 2026, and the country now logs an estimated 4,000-plus cybercrime complaints a day. Globally, romance and "confidence fraud" are some of the costliest online crimes: the FBI's Internet Crime Complaint Center recorded 23,159 romance-fraud complaints in 2025 worth $929.3 million, which is a 38% jump over 2024,  while the UK logged over £102 million in losses and Australia and Canada reported tens of millions more. Crucially, IC3's 2025 report flagged AI as an accelerant for the first time, attributing roughly $19 million in romance-scam losses directly to AI-generated profiles, images and chat exactly the "AI-generated photographs" Hyderabad Police say the Rent Boyfriend network used.

‍

Case Studies

‍

The Rent Boyfriend network is one data point in a wider, well-documented pattern in India:

‍

1. Hyderabad, August 2026: Fraudsters ran Instagram, Telegram and Facebook pages using stock or AI-generated photos of "attractive men", collected advance payments and security deposits, and then blocked victims,  the case that prompted this advisory.
2. Jaipur, 2026: A honey-trap and extortion ring allegedly used AI-manipulated videos and images to blackmail a businessman out of nearly ₹90 lakh, with police examining how far synthetic media was used to fabricate compromising content.
3. Mumbai: A gang was arrested for cheating a woman out of ₹16.18 lakh in gold and cash after promising to "reunite" her with a lost partner, a variant that exploits the same emotional vulnerability through a different pretext.
4. Gujarat, 2025: A social media influencer with over 10 lakh followers was arrested for allegedly honey-trapping and blackmailing a builder, illustrating how organised such rackets have become.

‍

These sit alongside a global backdrop where FBI data shows confidence and romance fraud disproportionately drains people over 60 (63% of US losses in 2025) even as India's version increasingly targets young women and students, a sign the tactic is being localised for different demographics rather than disappearing.

‍

Why It Works: The Psychology of Loneliness and Grooming

‍

Researchers who study romance-fraud victims consistently find that loneliness, a tendency toward idealised romantic beliefs, and a need for social connection are the strongest predictors of victimisation. Scammers exploit this through a well-rehearsed grooming arc: rapid, excessive flattery ("love bombing") to create instant intimacy; mirroring the target's interests and values to seem like a perfect match; gently discouraging outside opinions so doubts don't surface; and only then introducing a financial ask, framed as something small and reasonable — a booking fee or a security deposit precisely because it feels low-stakes compared to a direct cash demand. The "package" pricing in the Rent Boyfriend ads (₹499 for coffee, scaling up to ₹4,499) mimics legitimate e-commerce, which lowers a target's guard further. Once payment is made and blocked, many victims feel too embarrassed to report it — a shame response researchers and police repeatedly flag as the biggest reason such scams are under-reported.

‍

Red Flags and What To Do?

‍

Red flags to watch for:

‍

1. Companionship or dating offers with attractive stock/AI-style photos and steep "discounts"
2. Contact only through DMs, with no verifiable business identity, address or reviews.
3. Requests for advance payment, "security deposits", or booking fees via UPI/QR code before any service is delivered.
4. Reluctance to do a video call or a video call that looks slightly off (a common AI/deepfake tell).
5. Pressure to move fast, share personal photos, or keep the interaction secret from friends and family.

‍

Precautions:

‍

1. Never send money to confirm a booking with an unverified individual or page.
2. Avoid sharing personal photographs, phone numbers, addresses or financial details with strangers online.
3. Don't meet anyone in person whom you've only interacted with through such ads.
4. Parents should stay engaged with what their children see and who they talk to on social media.

‍

If you suspect a scam or have lost money: Don't panic and don't pay more to "fix" it. Stop all contact, save screenshots and payment records, and call the 1930 cybercrime helpline or file a complaint at cybercrime.gov.in immediately — reporting within the first "golden hour" significantly improves the chance of freezing transferred funds before they're withdrawn.

‍

The Government, Platform and Legal Angle

‍

India already has legal tools for this, though enforcement lags the pace of the fraud. Cheating by personation online is punishable under Section 66D of the IT Act, 2000 (up to three years' imprisonment plus fine), often paired with Section 66C on identity theft; the Bharatiya Nyaya Sanhita's cheating provisions (replacing IPC Sections 420/419) apply where money is dishonestly induced. Under the IT (Intermediary Guidelines) Rules, 2021, platforms like Instagram, Facebook and Telegram must appoint a grievance officer, acknowledge complaints within 24 hours, and take down unlawful content within 36 hours of a court or government notification  obligation. Hyderabad's cybercrime wing can invoke to force the removal of these ad networks. Larger "significant social media intermediaries" carry added duties around traceability and proactive monitoring.

The gap is upstream: platforms currently do little to verify who is running a commercial-sounding page before it reaches thousands of users, and AI-generated "profile" images are not systematically flagged. A stronger response would combine faster platform-side KYC for pages soliciting payment, proactive detection of AI-generated advertising imagery, and continued expansion of the 1930 golden-hour fund-freezing mechanism paired with public advisories like Hyderabad's, which remain one of the fastest ways to blunt a scam before it scales.

‍

Conclusion

‍

Loneliness is not something anyone should be ashamed of, but it is exactly what these networks are built to exploit. No genuine companionship service needs an advance QR payment before you've even met the person.

‍

Sources

‍

• Deccan Herald — Hyderabad Police Commissioner cautions young women over 'rent boyfriend' offers
• Republic World — 'Rent Boyfriend' Offers On Social Media?
• Newsdrum — What is 'Rent Boyfriend' trap?
• IndiaSpend — How India's Cyber Crime Incidence Is Rising
• FBI IC3 2025 Annual Report Brochure

‍