What are the implications of the DPDPA for businesses collecting your data in India?

In a time where data is as valuable as currency, businesses across India have thrived by collecting, analyzing, and monetizing personal data. But with the enactment of the Digital Personal Data Protection Act (DPDPA), 2023, a seismic shift is occurring in how companies handle this responsibility.

Gone are the days when companies could bury their data practices in unreadable terms and conditions. The DPDPA introduces a clear legal framework that prioritizes user consent, transparency, accountability, and protection, while forcing businesses to rethink their entire data strategy.

Let’s explore what the DPDPA means for businesses and, more importantly, how it empowers you—the user—to control how your personal data is collected and used.

Understanding DPDPA: A Quick Primer

The Digital Personal Data Protection Act (DPDPA), 2023 is India’s first comprehensive law designed to regulate the use of personal data. It aligns with global best practices like the EU’s GDPR and represents a milestone in India’s journey toward a more privacy-centric digital economy.

Key Concepts:

  • Data Fiduciary: The business or organization that collects and processes personal data.

  • Data Principal: The individual (you) to whom the data belongs.

  • Consent: Must be informed, specific, clear, and revocable.

  • Data Protection Board: The central authority overseeing compliance and addressing grievances.

Implications of DPDPA for Businesses

1. Mandatory Informed Consent

Before a business collects your data, it must provide a clear, accessible, and language-friendly notice explaining:

  • What data is being collected.

  • Why it’s needed (purpose).

  • Who it will be shared with.

  • How long it will be retained.

🟢 Public Example: When you install a mobile wallet app, it can no longer request access to your contacts, location, and messages by default. It must first ask your permission—clearly and transparently.

👉 Impact on Business: Companies must redesign user journeys, app flows, and web forms to include legally compliant consent notices. Consent cannot be bundled or ambiguous anymore.

2. Data Minimization and Purpose Limitation

Businesses can only collect data necessary for the declared purpose—nothing more. This restricts unnecessary, excessive, or vague data collection.

🟢 Public Example: A clothing website asking for your gender and address for delivery is acceptable. But if it asks for your date of birth, Aadhaar number, and income without justification, that’s a red flag.

👉 Impact on Business: Companies will need to audit existing data practices, discard irrelevant or excess data, and limit future data collection accordingly. It’s a shift from “collect everything, analyze later” to “collect what’s justified.”

3. User Rights and Grievance Redressal

Under DPDPA, every user has clear rights:

  • Right to access data.

  • Right to correct inaccurate data.

  • Right to erase data.

  • Right to withdraw consent.

  • Right to grievance redressal through a Data Protection Officer or the Data Protection Board.

🟢 Public Example: If you unsubscribe from a shopping app, you can request the deletion of all your past orders and profile data. If the company refuses, you can escalate it to the Data Protection Board of India.

👉 Impact on Business: Companies must set up proper customer-facing systems and internal workflows to respond to data access, correction, or deletion requests within a reasonable time. Non-compliance can lead to penalties.

4. Data Breach Notification Obligations

If there is a data breach—like a cyberattack that leaks your personal data—the company must inform both the affected individuals and the Data Protection Board as soon as possible.

🟢 Public Example: If a ride-hailing app suffers a data leak, exposing users’ location histories and phone numbers, it must disclose the breach, list the affected data, and provide guidance to users on how to stay safe.

👉 Impact on Business: Companies will need robust cybersecurity infrastructure, data incident response plans, and reporting mechanisms to comply. This also includes conducting regular security audits and risk assessments.

5. Obligations for Significant Data Fiduciaries

Businesses that handle large volumes of personal data or process sensitive personal data (like health, finance, biometrics) may be classified as Significant Data Fiduciaries (SDFs). These businesses have extra responsibilities:

  • Appoint a Data Protection Officer (DPO).

  • Conduct Data Protection Impact Assessments (DPIAs).

  • Perform regular audits and compliance reporting.

🟢 Public Example: A leading hospital chain or large fintech app processing lakhs of user health and financial records would likely be classified as an SDF.

👉 Impact on Business: These businesses will need to invest in dedicated privacy teams, legal advisors, secure cloud storage, and strong authentication protocols to meet elevated compliance standards.

6. Cross-Border Data Transfer Regulations

DPDPA allows businesses to transfer personal data outside India, but only to countries notified by the government as compliant with India’s data protection standards.

👉 Impact on Business: Companies using foreign cloud service providers or analytics tools must ensure their data transfer contracts are updated and follow government-approved country lists. Otherwise, they risk violating the law.

7. Severe Financial Penalties for Non-Compliance

The DPDPA imposes hefty penalties—up to ₹250 crore—for:

  • Failing to protect data from breaches.

  • Collecting or processing data without consent.

  • Ignoring grievance redressal obligations.

👉 Impact on Business: Data protection is now a compliance risk, just like tax or labor law. Non-compliance not only invites legal action but also damages public trust and brand reputation.

How Can the Public Use This Law?

The DPDPA empowers every Indian internet user with tools to hold companies accountable:

✅ Ask Questions Before Sharing Data

“Why do you need my Aadhaar card?”
“Who else can access my information?”

You have a legal right to know.

✅ Request Data Erasure

If you’ve stopped using an app or website, you can email their grievance officer to delete your personal data.

✅ Report Violations

If you believe a company has:

  • Misused your data,

  • Failed to respond to your access/erasure request,

  • Not disclosed a data breach—

You can file a complaint with the Data Protection Board of India (soon to be functional under the Act).

Practical Example: A Shopping App Before and After DPDPA

🔴 Before DPDPA:

  • App requests access to contacts, photos, location—even when not needed.

  • Vague terms and conditions—users have no idea how data is used.

  • No option to delete profile or request data access.

🟢 After DPDPA:

  • App shows a clear privacy notice: what data is collected and why.

  • Users can opt out of personalized ads and request data deletion.

  • Contact info of grievance officer is available.

  • Data shared only with authorized partners, and securely stored.

Conclusion

The DPDPA represents a transformational moment for digital privacy in India. For businesses, it’s a wake-up call to put users first, build ethical data practices, and prioritize transparency. For individuals, it’s a powerful shield to take back control over personal information that was too often taken for granted.

Businesses that fail to adapt will not just face penalties—they will lose consumer trust in an era where privacy is becoming a competitive advantage.

As a citizen and internet user, you are no longer powerless. You have the legal right to ask, know, deny, and protect. Because in the world of data, your consent is your signature, and your awareness is your armor.

How often should individuals update their software and operating systems for security?

In 2025, our daily lives run on software. From the smartphones in our pockets to the smart TVs on our walls, from our work laptops to smart watches — every device runs on millions of lines of code. And every line of code is a potential doorway for cyber attackers if it isn’t maintained properly.

That’s why, as a cybersecurity expert, I always tell people: one of the simplest yet most powerful defenses against cyber threats is to keep your software and operating systems updated — consistently and promptly.

But how often is “often enough”? Is auto-update safe? What happens if you skip updates for months? In this blog, we’ll unpack:
✅ Why regular updates matter more than ever.
✅ The real risks of outdated software.
✅ How often you should update different devices.
✅ How hackers exploit delays.
✅ How to manage updates for yourself and your family.
✅ How staying updated aligns with India’s DPDPA 2025 compliance mindset.
✅ And clear, practical steps you can take — with a strong conclusion.

Why Software Updates Matter So Much

When you get a notification to update your phone, laptop, or app, it’s not just about new emojis or cool features. The most important reason for updates is security.

Software updates:
✔️ Patch vulnerabilities that hackers know how to exploit.
✔️ Fix bugs that could accidentally expose your data.
✔️ Improve compatibility with other apps and security tools.
✔️ Enhance performance and stability — reducing the risk of crashes that might leave devices open to attack.

Real Example: The Cost of Delayed Updates

A well-known global ransomware attack, WannaCry, spread in 2017 because thousands of computers were still running outdated Windows operating systems without a patch Microsoft had released two months earlier. Hospitals, banks, and small businesses were locked out of their data overnight. The same lesson still applies today.

In India, small businesses and individual users sometimes skip updates because they fear downtime or think they don’t matter to hackers. The reality is, hackers love easy targets — and unpatched software is their easiest entry point.

How Hackers Exploit Unpatched Systems

Every year, security researchers and companies discover thousands of vulnerabilities — from simple bugs to dangerous zero-day flaws. Once these are made public, hackers race to exploit systems that haven’t been patched.

Attackers scan the internet 24/7 looking for:
✔️ Outdated operating systems.
✔️ Old app versions with known flaws.
✔️ Misconfigured software left unchanged for years.

Even big companies can fall victim if they delay updates. Individuals are an even easier target.

How Often Should You Update?

The golden rule: Update as soon as an update is available.

Most people wait days, weeks, or months. That’s risky. Here’s a breakdown by category:

📱 Smartphones & Tablets

  • How often: Check for system updates weekly if not set to auto-update.

  • Apps: Enable automatic updates for all apps from your app store.

  • Why: Mobile operating systems regularly release patches for new threats — especially for Android, which has a wider range of device makers and versions.

💻 Laptops & Desktops

  • How often:
    ✔️ For Windows, macOS, Linux: Enable automatic OS updates.
    ✔️ Restart devices regularly so patches apply fully.
    ✔️ Update software (browsers, productivity tools, antivirus) at least weekly.

🌐 Browsers

  • Browsers are common attack targets because they connect to the internet daily.

  • How often: Use the latest version — most modern browsers auto-update, but check manually weekly to be sure.

📦 IoT Devices & Smart Home Gadgets

  • Smart TVs, cameras, routers, voice assistants — these are often overlooked.

  • How often:
    ✔️ Check the manufacturer’s app or website for firmware updates every month.
    ✔️ Replace devices that no longer receive updates — old routers are common weak spots.

🛠️ Work Software & Business Tools

  • Companies should schedule patching windows — at least monthly for systems that can’t auto-update.

  • Critical vulnerabilities should be patched immediately — even outside normal cycles.

What If Updates Break Things?

A common fear is that updates will cause bugs or break device compatibility. While this can happen occasionally, the risk of staying outdated is far worse. Major companies test updates rigorously. Critical security patches are rarely optional — they protect you from attacks happening right now.

Public Example: How Families Can Stay Updated

Consider a family in Delhi:
✅ Parents enable automatic updates for their laptops and phones.
✅ Kids’ gaming consoles get firmware updates to fix security flaws in online play.
✅ The family’s Wi-Fi router gets a regular check — new firmware blocks hackers from hijacking the home network.
✅ Smart speakers and cameras get updated through their apps.

How Updates Tie Into India’s DPDPA 2025

Under the Digital Personal Data Protection Act 2025, companies are expected to show “reasonable safeguards” to protect personal data. Using outdated software or ignoring known vulnerabilities could be seen as negligence.

For individuals, this means that if you handle customer or employee data on your personal device, failing to update it can expose you — and your company — to legal trouble if a breach occurs.

Common Myths About Updates

Myth: “Hackers don’t care about my small device.”

Truth: Hackers use automated tools to scan millions of devices for the same flaw — they don’t care who you are.

Myth: “Updates are too big and slow my device.”

Truth: New updates usually fix performance bugs too. If your device is too old, consider an upgrade — unsupported devices are prime targets.

Myth: “I’ll do it later.”

Truth: Later is too late. Once a vulnerability is public, attackers exploit it immediately.

Practical Steps to Make Updates a Habit

✔️ Turn on auto-updates for your operating system and all apps.
✔️ Set a calendar reminder to check your smart devices monthly.
✔️ Restart devices regularly — patches don’t always apply until you do.
✔️ Use trusted sources — only update from official app stores or manufacturer sites.
✔️ For work devices, follow company policies — raise a flag if you see delays.

Example of a Good Practice: Small Businesses

Small businesses often skip updates out of fear of downtime. A better approach is:

  • Schedule regular maintenance windows.

  • Test updates in a small batch first, then deploy.

  • Use managed services or hire an IT provider to handle updates proactively.

Small Habit, Big Payoff

A single unpatched vulnerability can open the door to ransomware, stolen data, or massive fines. Yet closing that door takes minutes — not months.

Conclusion

In the world of 2025, every device update is like locking your digital doors at night. Cyber attackers are relentless — but they usually go for the easiest target. Outdated systems make you that target.

Updating your software and operating systems promptly is one of the simplest, cheapest, and most powerful cybersecurity actions you can take. It works hand in hand with strong passwords and multifactor authentication to create a secure foundation.

Don’t wait until an attack or data leak reminds you why updates matter. Turn on auto-update today. Check your devices weekly. Teach your family and colleagues to do the same.

Because in cybersecurity, prevention beats cure — every single time.

By

How can you request correction or erasure of your personal data under the DPDPA?

In today’s hyper-connected world, our personal data is constantly being collected, stored, and processed—often in ways we don’t even realize. From signing up on e-commerce platforms and downloading mobile apps to filling out digital forms for government services, your digital footprint is everywhere.

But what happens when the information a company or platform has about you is inaccurate, outdated, or no longer needed? Under India’s Digital Personal Data Protection Act (DPDPA) 2023, you now have a legal right to request correction or erasure (deletion) of such data.

This blog post explores your rights under the DPDPA regarding the correction and erasure of personal data, explains how you can exercise these rights, and offers practical examples to help you take control of your digital identity.

📜 The Legal Framework: What is the DPDPA?

The Digital Personal Data Protection Act, 2023 (DPDPA) is India’s first comprehensive legislation that governs how personal data is collected, stored, and processed by both private entities (Data Fiduciaries) and government bodies.

Under this law, you (the Data Principal) are granted fundamental rights to protect your digital privacy, including the right to:

  • Access your data.

  • Correct any inaccuracies.

  • Erase data that is no longer necessary or was collected without valid consent.

These rights shift control from the corporations back to the citizens—you own your data, and you have the authority to demand accuracy and fairness in how it’s handled.

🔍 What is Correction and Erasure of Personal Data?

Let’s break it down:

🛠 Correction of Personal Data:

This is your right to ask a platform to fix inaccurate or misleading information they have about you.

Example:
You notice that your age is incorrectly mentioned as 52 instead of 25 on a financial platform. This error could affect your loan eligibility. Under the DPDPA, you can request the platform to correct this inaccuracy.

🧹 Erasure of Personal Data:

This refers to your right to ask for the deletion of personal data when:

  • The data is no longer needed for the purpose it was collected.

  • You withdraw consent.

  • The data was collected unlawfully.

Example:
You had once signed up for a job portal, but now you’ve found employment and no longer want your resume and personal details available online. You can request the platform to erase your personal data from their systems.

⚖ Legal Clauses Supporting Your Rights

Section 12(3) of the DPDPA specifically states:

“The Data Principal shall have the right to correction, completion, updating, and erasure of their personal data for the purpose for which such personal data was furnished by the Data Principal.”

Further, Data Fiduciaries are legally obligated to respond to such requests within a reasonable time and provide proof of action.

🧾 What Kind of Data Can You Correct or Erase?

Here are some examples of data types you can request changes for:

Type of Data Correction Example Erasure Example
Contact Information Update old phone number or email Delete outdated emergency contact
Financial Details Correct incorrect income or bank info Erase old bank account details no longer in use
Educational Records Fix name misspellings or wrong grade entries Delete data after course completion
Location Information Update current address Remove stored GPS data from a delivery app
User Profiles on Websites Update profile picture or name Completely delete your account

✉️ How to Request Correction or Erasure: Step-by-Step Guide

Here’s how you can use your right as a Data Principal:

✅ Step 1: Identify the Data Fiduciary

This is the organization or entity that has collected your data—such as a bank, mobile app, educational platform, or government portal.

✅ Step 2: Draft a Request

You can submit your request via:

  • Email

  • App or website portal

  • Customer service form

  • Data Protection Officer’s (DPO) contact, if available

Your request should include:

  • Your full name and registered email/phone number

  • Description of the data to be corrected/erased

  • Reason for correction/erasure

  • Proof of identity (if required)

✅ Step 3: Wait for Acknowledgment

Under the DPDPA, the company must acknowledge and respond to your request within a reasonable period, typically within 7 to 15 working days.

✅ Step 4: Follow Up

If you do not receive a response or the company refuses without valid reason, you can escalate the matter to the Data Protection Board of India (DPBI).

📌 Real-World Example: Social Media Profile

Let’s say you changed your legal name and now want your new name to reflect on your social media accounts, blogs, and forums.

Action Steps:

  1. Log into your social media account settings.

  2. Submit a request to correct your profile name.

  3. If the option isn’t available or the change is denied, send an email to their Data Protection Officer citing your DPDPA rights.

  4. Attach a legal name change certificate as proof.

If you no longer want your account online, you can request full erasure of all associated data.

🔒 What Happens After Erasure?

Once your data is erased:

  • It must be deleted from all primary and backup servers.

  • It should not be used, processed, or sold further.

  • The Data Fiduciary must confirm in writing that the data has been erased (unless they’re legally required to retain it).

⚠️ When Can a Company Refuse Your Request?

While the DPDPA empowers you, it also provides reasonable exceptions. A company may decline to correct or erase your data if:

  • It’s required to retain it for legal or regulatory reasons (e.g., tax records, legal proceedings).

  • The data was not provided by you directly and is needed for public interest.

  • It’s anonymized and no longer linked to your identity.

Example:
A government portal may retain your Aadhaar-linked transaction history if needed for auditing or compliance—even if you request erasure.

📣 Tips for Using Your Rights Effectively

  • Always read privacy policies and understand what data is collected.

  • Use platforms that provide in-app options to modify or delete your data.

  • Take screenshots or records of the requests you send for future reference.

  • Be polite but firm in citing your legal rights under the DPDPA.

  • Report repeated violations to the Data Protection Board of India (DPBI) once operational.

🛡 Tools That Can Help

Tool/Platform Purpose
In-app Privacy Settings Manage consent, correction, and deletion
Data Protection Officer (DPO) Official contact for correction/erasure requests
Government Grievance Portals For public service data issues
Privacy Browser Extensions Identify tracking data and request deletion

🏛 Role of the Data Protection Board of India (DPBI)

Expected to begin full operations in 2025, the DPBI will:

  • Act as a mediator between citizens and Data Fiduciaries.

  • Investigate complaints related to data misuse.

  • Impose penalties (up to ₹250 crore for violations).

  • Encourage public awareness of data rights.

Until then, you can still file complaints via consumer helplines or data grievance platforms.

✅ Conclusion

India’s Digital Personal Data Protection Act (DPDPA) 2023 marks a transformative step in empowering individuals to control their digital identity. The ability to request correction or erasure of your personal data is no longer just a privilege—it’s a legal right.

Whether you want to:

  • Fix incorrect info on a banking app,

  • Delete your old student profile from an educational platform,

  • Or erase sensitive data from a website you no longer use—

You have the power to do it.

Take charge of your data.
Ask questions.
Make requests.
Hold organizations accountable.

Because in the digital age, your data is your dignity—and the law is now firmly on your side.

What information must data fiduciaries provide you before collecting your personal data?

In the digital age, data is a currency—and you are the bank. Every time you log in to a website, sign up for a service, or download an app, you’re often unknowingly handing over personal information—your name, mobile number, location, shopping habits, and sometimes even more sensitive data like your Aadhaar number or health records.

But here’s the catch: before anyone can collect your personal data, they’re legally required to tell you exactly what they plan to do with it. This is not just ethical—it’s now the law under India’s Digital Personal Data Protection Act (DPDPA), 2023.

As a cybersecurity expert, let me walk you through what information every data fiduciary (like apps, websites, service providers) must provide to you before collecting your personal data, and how you can hold them accountable.

Understanding the Key Players

Before we dive in, here’s a quick breakdown:

  • Data Fiduciary: Any organization (like a tech company, hospital, bank, or social media platform) that determines the purpose and means of processing your personal data.

  • Data Principal: That’s you—the person whose data is being collected.

  • Personal Data: Any data that can identify you—name, phone number, IP address, biometrics, email, location, etc.

Under DPDPA, data fiduciaries must provide clear, specific, and accessible information before they collect your data. This ensures you give informed consent—not blind approval.

What Must Data Fiduciaries Tell You?

According to Section 5 and Section 6 of the DPDPA, data fiduciaries are required to provide you with a “notice” before or at the time of requesting your personal data. This notice must include the following critical details:

1. Purpose of Data Collection

They must clearly explain why they are collecting your data—whether it’s to provide a service, analyze your behavior, send updates, or personalize content.

🟢 Example: If you download a travel booking app, the notice should say:

“We collect your location and contact information to suggest nearby travel deals and send you booking confirmations.”

📌 Why it matters: You should know if your data is used only for booking—or also for advertising, analytics, or third-party sharing.

2. Type of Data Collected

They must list the categories of personal data they plan to collect—basic data (name, email), sensitive data (financial, health), or behavioral data (browsing history, preferences).

🟢 Example: A fitness app should disclose:

“We collect your name, age, gender, daily activity data, sleep patterns, and heart rate from wearable devices.”

📌 Why it matters: Knowing what data is collected helps you assess the privacy risk.

3. How the Data Will Be Used

The notice must specify how your data will be processed—will it be stored, shared, analyzed, or sold? And for how long will they retain your data?

🟢 Example:

“We use your data to generate fitness recommendations. Data is stored for 12 months and deleted afterward.”

📌 Why it matters: Without this, your data could be kept indefinitely or used for profiling.

4. Third-Party Sharing

If your data will be shared with other companies, vendors, advertisers, or government bodies, this must be disclosed clearly.

🟢 Example:

“We share your contact information with our delivery partners for order fulfillment. We do not sell your data to third parties.”

📌 Why it matters: Many data leaks and privacy violations happen due to third-party mishandling.

5. Your Rights as a Data Principal

You must be informed about your rights under DPDPA, such as:

  • The right to access your data,

  • The right to correction,

  • The right to erasure,

  • The right to grievance redressal,

  • The right to withdraw consent at any time.

🟢 Example:

“You have the right to request access, correction, or deletion of your data by emailing privacy@company.com.”

📌 Why it matters: Most users don’t know they can demand data erasure after deleting an app—this law makes it mandatory for the company to tell you.

6. Method to Contact for Grievances

They must provide a grievance redressal mechanism—a phone number, email, or portal to raise complaints or concerns.

🟢 Example:

“For any privacy concerns, contact our Data Protection Officer at dpo@xyz.in or call +91-9876543210.”

📌 Why it matters: You shouldn’t have to go through complicated processes to raise a data-related issue.

7. Identity of the Data Fiduciary

The notice must also include the name and contact information of the organization collecting your data—you have a right to know who is using your data.

🟢 Example:

“This data is being collected by ABC Travel Pvt. Ltd., registered in Mumbai, India. Contact: support@abctravel.in.”

📌 Why it matters: It gives you transparency and a legal path for escalation if needed.

8. Consent Withdrawal Process

You should be informed how to withdraw your consent and what impact it will have on the services provided.

🟢 Example:

“You may withdraw consent anytime through our app settings. This may limit access to personalized recommendations.”

📌 Why it matters: Consent is not a one-time approval—it’s revocable.

Real-World Scenario: Informed Consent in Action

Let’s say you install a loan comparison app. It asks for your:

  • PAN number

  • Aadhaar card

  • Bank account access

  • Location

Before giving this information, the app must show a notice explaining:

  • Why each piece of data is needed (e.g., identity verification, fraud checks),

  • Who else may access this data (like lending partners),

  • What will happen if you don’t provide it,

  • And how to delete the data after uninstalling the app.

If it doesn’t do this, it’s violating the law—and you can take action.

What Happens If Data Fiduciaries Don’t Comply?

Under the DPDPA, if a company fails to give you this mandatory information, it can face hefty penalties—up to ₹200 crore per violation.

And if your data is mishandled due to improper or hidden practices, you can:

  • File a grievance with the company,

  • Escalate to the Data Protection Board of India,

  • Demand erasure or compensation.

Practical Tips for You (The Data Principal)

✅ Always Read the Privacy Notice

Even if it seems boring, take a moment to read the permissions an app requests and why.

✅ Ask for Clarification

Use customer care or grievance contacts to ask:

  • “Why do you need this data?”

  • “How long will you store it?”

  • “Can I delete it later?”

✅ Use Consent Managers (when available)

DPDPA allows you to manage consents centrally through authorized Consent Managers—tools that help you view, approve, or revoke permissions easily.

✅ Avoid Apps That Don’t Provide Transparency

If a site or app skips explaining their data usage, don’t use it. Trustworthy services are upfront and DPDPA-compliant.

Conclusion

The Digital Personal Data Protection Act, 2023 is not just a policy—it’s a shield that empowers every Indian citizen to take control of their personal data. The requirement for data fiduciaries to provide clear and full information before collecting your data ensures that you are no longer in the dark about what happens to your digital identity.

Whether you’re booking tickets, ordering groceries, or uploading documents—you deserve to know how your data is being used. The next time an app or website asks for your details, pause and ask: “What will you do with my data?” If they can’t answer, they don’t deserve your trust.

Because in the digital world, informed consent is your superpower.

What is the importance of enabling multifactor authentication (MFA) on all online accounts?

In 2025, we’re surrounded by smart devices, cloud services, and online accounts that hold pieces of our personal and professional lives. From banking apps and email inboxes to social media profiles and work portals — your entire digital identity is only as secure as your weakest login.

This is where multifactor authentication (MFA) makes the difference between being an easy target and being far more resilient to modern cyberattacks.

As a cybersecurity expert, I often say: a strong password is good; a strong password plus MFA is far better. Why? Because even the strongest passwords can be stolen, guessed, or leaked — but MFA can stop an attacker cold.

This blog explains:
✅ What MFA really means in plain terms.
✅ Why relying on just a password is no longer safe in 2025.
✅ Real examples showing how MFA blocks attacks.
✅ Different MFA methods — and which are most secure.
✅ How to enable MFA for your critical accounts.
✅ Practical tips for individuals and families.
✅ How MFA aligns with India’s growing cybersecurity posture under the DPDPA 2025.
✅ And a clear action plan and conclusion to help you get started.

The Problem: Passwords Aren’t Enough

In today’s digital world, billions of passwords have been leaked in past data breaches. Hackers buy and sell these credentials on the dark web, run them through automated tools, and attempt to log into as many accounts as possible.

This technique — known as credential stuffing — works because people often reuse passwords across multiple sites. Even a strong password is useless if it’s been exposed somewhere else.

What is MFA — and How Does It Work?

MFA adds an extra layer of security by requiring you to prove your identity in more than one way.

At its simplest, MFA means:
✔️ Something you know: your password.
✔️ Something you have: a one-time code from an app, a hardware key, or a push notification.
✔️ Or something you are: a fingerprint, facial recognition, or voice.

Even if hackers steal your password, they won’t have your second factor — blocking them from accessing your account.

Real Example: How MFA Stops Hackers

In 2024, an employee at a Bengaluru fintech company had their work email password stolen in a phishing attack. The attacker tried to log in remotely. But because the company required an authenticator app code for all logins, the hacker failed — the employee got an unexpected push notification and immediately alerted IT. Breach averted.

Why MFA Matters More Than Ever

✅ Phishing is smarter. AI tools craft more convincing fake emails, texts, and calls.
✅ Passwords get leaked daily. Even strong ones, when reused, can be stolen.
✅ Remote work expands attack surfaces. With employees logging in from home, hotels, and public Wi-Fi, MFA is an essential backstop.
✅ More devices = more risk. One weak point can expose your entire digital life.

Common MFA Methods

✔️ Authenticator apps (Google Authenticator, Microsoft Authenticator): Generate time-based one-time passcodes (TOTP). More secure than SMS.
✔️ Push notifications: A trusted app on your phone asks you to approve or deny a login attempt.
✔️ Hardware security keys (YubiKey, Titan Key): Physical USB or NFC devices that must be plugged in or tapped to confirm identity.
✔️ SMS codes: Better than nothing but vulnerable to SIM-swapping and interception.

Which MFA Is Best?

For most people:
1️⃣ Authenticator app or push notification is more secure than SMS.
2️⃣ Hardware security keys are the gold standard for highly sensitive accounts.
3️⃣ Use biometrics where possible — like your device’s fingerprint or face unlock for banking apps.

Where to Enable MFA First

✅ Email: This is your digital backbone — if hackers get in, they can reset passwords for banking, shopping, social media.
✅ Banking and finance apps: Protect your money and sensitive transactions.
✅ Cloud storage: Google Drive, OneDrive, Dropbox — all hold private data.
✅ Work logins: Remote desktop, VPNs, company tools.
✅ Social media: Prevent account hijacking, fake posts, or identity theft.

How to Set Up MFA

Most platforms make it simple:
1️⃣ Log in to your account settings.
2️⃣ Find “Security” or “Account Protection.”
3️⃣ Look for “Two-Factor Authentication” or “Multifactor Authentication.”
4️⃣ Follow the instructions — download an authenticator app, scan a QR code, and save backup codes.

What If You Lose Access?

Always:
✔️ Save backup codes in a safe place (not your inbox!).
✔️ Register a backup phone number or email if available.
✔️ Consider a backup hardware key for mission-critical accounts.

Public Example: Families Can Use MFA Too

Imagine a family in Pune:
✔️ Parents enable MFA on banking, income tax portals, shopping accounts.
✔️ Teens use MFA for social media and gaming — stopping hackers from hijacking their online identity.
✔️ Elders using net banking can get help setting up MFA with trusted family support.

How MFA Supports India’s DPDPA 2025

Under the Digital Personal Data Protection Act 2025, companies must show they use “reasonable safeguards” to protect personal data. If a breach happens because an account was accessed without MFA, regulators can question if the company really did enough.

Requiring MFA for employee logins, admin panels, and sensitive apps shows due diligence — and can reduce financial and legal risk.

How to Make MFA Stick in Your Daily Life

✔️ Turn it on once, then make it part of your routine.
✔️ Approve or deny login requests carefully — attackers sometimes trick victims into approving a fake push.
✔️ Stay vigilant for phishing — some scams ask for your MFA code too.
✔️ Never share your MFA codes with anyone — not even “support staff.”
✔️ Update your MFA methods if you get a new phone.

Small Habit, Massive Protection

Enabling MFA takes five minutes but can stop 99% of account hacks. It’s a small step that dramatically lowers your risk.

A single stolen password can lead to identity theft, drained bank accounts, or company-wide breaches. MFA shuts that door tight.

Final Tips for Individuals

✔️ Make MFA your new default — don’t skip it because it feels inconvenient.
✔️ Use the strongest method you can — authenticator apps or hardware keys beat SMS.
✔️ Teach your family — kids, parents, grandparents — to turn it on too.
✔️ Help friends set it up — protect your community.
✔️ Combine it with strong, unique passwords for every account.

Conclusion

In the world of 2025, the question isn’t whether hackers will try to get your credentials — they already are. The real question is whether you’ll make it easy for them or block them at the gate.

Multifactor authentication is one of the simplest, cheapest, and most effective ways to secure your digital life. It closes the door on stolen passwords, phishing attacks, and credential leaks — protecting your money, your identity, and your peace of mind.

So today, take five minutes. Pick your top three critical accounts — email, banking, cloud storage — and enable MFA right now. You’ll thank yourself tomorrow.

By

How can individuals implement stronger password practices and use password managers effectively?

In the digital-first world of 2025, passwords remain one of the simplest — yet most critical — lines of defense for protecting personal and professional data. Yet despite endless warnings, surveys still show that many people reuse passwords, choose weak ones, or store them unsafely.

Hackers know this. In fact, stolen or guessed passwords are behind a huge share of today’s data breaches, fraud cases, and identity theft incidents. From social media hijacks to banking fraud, a single weak password can open the door to devastating consequences.

As a cybersecurity expert, I can’t stress this enough: building stronger password habits and using a trusted password manager is one of the easiest and most effective ways anyone — whether an individual, parent, employee, or small business owner — can protect themselves.

This blog will help you:
✅ Understand why old password habits no longer work.
✅ See how attackers exploit bad passwords.
✅ Learn exactly how to create stronger, unique passwords.
✅ Pick and use a good password manager safely.
✅ Share smart practices with family members.
✅ Understand how these habits align with India’s broader data protection push under DPDPA 2025.
✅ Walk away with clear, practical steps you can start today.

The Problem with Weak Passwords

Let’s start with a simple truth: most people have far too many passwords to remember — dozens, if not hundreds, for social media, banking, shopping, work systems, and more.

Faced with this overload, people take shortcuts:
❌ Reusing the same password everywhere.
❌ Choosing simple ones like 123456, qwerty, or password@123.
❌ Adding predictable patterns like Name@2025.
❌ Writing passwords on sticky notes or storing them in plain text files.

For a hacker, these shortcuts are a goldmine. Attackers use stolen credentials from old breaches, try obvious variations, or buy giant password lists on the dark web. They run these lists through automated tools to see which accounts they unlock — and more often than not, they succeed.

Real Example: The Domino Effect

In 2024, an Indian e-commerce consultant reused the same password for a shopping website and his email. When the shopping site was breached, attackers used that password to hijack his email, then reset his bank account and social media passwords. Within hours, he lost lakhs to unauthorized transfers — all from one reused password.

The Solution: Strong, Unique, Managed Passwords

So, what works instead? Three simple principles:
1️⃣ Long and complex passwords.
2️⃣ Unique passwords for every account.
3️⃣ A secure place to store and manage them.

How to Create Stronger Passwords

A good password:
✅ Is at least 12–16 characters long.
✅ Includes a mix of upper and lowercase letters, numbers, and symbols.
✅ Avoids obvious phrases like names, birthdays, or common words.
✅ Is unique — never reused for multiple accounts.

Example of a strong password:
u6$W!dLz2@qR#8Nv

Impossible to guess — but also impossible to remember without help!

Enter the Password Manager

A password manager is a secure vault that:
✔️ Generates strong passwords for you.
✔️ Stores all your credentials in one encrypted place.
✔️ Fills them automatically when you log in.
✔️ Syncs across your devices — phone, laptop, tablet.

You only need to remember one master password to unlock the manager — and make sure that master password is strong!

Choosing a Good Password Manager

There are many reliable options: 1Password, Bitwarden, LastPass, Dashlane, Keeper — to name a few.

When choosing:
✅ Pick one with a strong reputation and solid reviews.
✅ Make sure it uses strong encryption (AES-256).
✅ Enable multifactor authentication (MFA) for the vault.
✅ Back up your master password securely — not on your desktop or email.

How to Use a Password Manager Safely

✔️ Use your manager to generate random, strong passwords for each site.
✔️ Organize logins into folders — work, banking, shopping, etc.
✔️ Turn on automatic breach alerts — many managers notify you if a site is hacked.
✔️ Don’t store your master password in the manager itself!
✔️ Log out of your vault when not in use — especially on shared devices.

Example: How Families Can Use It

A parent can create a family plan. Each family member gets their own secure vault.
✔️ Teens can store social logins and school passwords.
✔️ Parents can securely share Wi-Fi or streaming passwords without WhatsApp or sticky notes.
✔️ Elderly family members get help with safe logins instead of using simple, guessable phrases.

Combining Passwords with MFA

Strong passwords are better with a second layer: multifactor authentication (MFA).
Always enable MFA wherever possible — for email, banking, social media, cloud storage, or your password manager itself.

Even if a hacker guesses your password, they still need your one-time code or biometric check.

How This Ties Into India’s DPDPA 2025

Under the Digital Personal Data Protection Act 2025, companies must demonstrate that they protect personal data with “reasonable safeguards.”

Weak passwords are a huge risk — for individuals and companies alike. Strong password practices and secure management show regulators you’re taking real steps to prevent breaches.

For employees, using a password manager can help comply with company rules and avoid accidental data leaks.

What the Public Can Do Today

Here’s a simple checklist:
✔️ Pick a trusted password manager and install it on your devices.
✔️ Create a unique, strong master password.
✔️ Update old reused passwords for critical accounts like email and banking.
✔️ Enable MFA wherever you can.
✔️ Teach family members — kids and elders alike — to use the vault instead of weak, repeated passwords.

Common Myths About Password Managers

Myth: “If a hacker breaches my manager, they’ll get everything!”

Truth: Reputable managers use zero-knowledge encryption — even the company can’t see your passwords. Data is scrambled and unlocked only with your master password, which only you know.

Myth: “Writing passwords in a notebook is safer.”

Truth: If someone finds that notebook, your accounts are wide open — no encryption, no lock.

Small Habits, Big Impact

One strong, unique password won’t save you if the next 20 are all the same old Password123. But once you build the habit — and let your manager handle the hard work — you’ve removed one of the easiest ways hackers break in.

It’s the digital equivalent of locking your door and using a smart key instead of leaving it under the doormat.

Conclusion

Strong password habits, backed by a trusted password manager, are your first line of defense in 2025’s digital world. It’s not about memorizing dozens of impossible strings — it’s about using the right tools and small daily actions to protect what matters most.

A single reused password can cost you your bank balance, your identity, or your company’s reputation. But strong, unique passwords — properly managed and combined with MFA — slam that door shut.

Start today. Pick a manager. Secure your accounts. Teach your family. Strong passwords don’t just protect you — they help secure our world.

By

Understanding “consent by design” and your right to withdraw consent for data processing.

In today’s digital world, your personal data is a valuable asset—collected, analyzed, and monetized by businesses, platforms, and governments. Every time you tap “I Agree” on a website, install an app, or sign up for an online service, you’re granting consent for your data to be processed. But is that consent always truly informed? Is it easy to withdraw once given?

This is where the principle of “Consent by Design” comes into play. Enshrined in modern data protection laws like India’s Digital Personal Data Protection Act (DPDPA) 2023/2025, this concept ensures that consent isn’t just a legal checkbox—it must be meaningful, clear, and easy to revoke.

In this blog post, we’ll break down the idea of Consent by Design, explain how it impacts your digital rights, and provide real-life examples of how you can take charge of your data, especially your right to withdraw consent.

What is “Consent by Design”?

Consent by Design is a privacy-first principle that requires apps, websites, and platforms to integrate consent as a core element of their systems—not as an afterthought.

This means:

  • Consent must be obtained explicitly and clearly before collecting personal data.

  • Consent should be granular (you can allow or deny specific types of data processing).

  • Consent must be revocable at any time, just as easily as it was given.

  • No coercion, manipulation, or deception in obtaining consent.

The idea is to empower users—not confuse them into compliance.

The Legal Backbone: DPDPA 2023/2025

Under India’s Digital Personal Data Protection Act, Consent by Design is not just a best practice—it’s a legal requirement. According to the Act:

“A Data Fiduciary shall seek consent from the Data Principal in a manner that is clear, specific, informed, and capable of being withdrawn.”

Key takeaways:

  • You must know exactly what data is being collected and why.

  • You can refuse consent without being denied essential services.

  • You can withdraw your consent anytime—and the company must delete or stop using your data immediately (unless required by law to retain it).

Why Consent by Design Matters

Many platforms have long used dark patterns—designs that push you to accept data collection without fully understanding what you’re agreeing to.

For instance:

  • Pre-ticked checkboxes on signup forms.

  • Pop-ups that hide the “Decline” option.

  • “Accept All” buttons that don’t explain what you’re accepting.

Consent by Design combats these practices by forcing companies to:

  • Make opt-outs as easy as opt-ins.

  • Let you control what parts of your data can be shared.

  • Be honest and transparent about how your data will be used.

Real-Life Example: Health App

Imagine you download a fitness app that asks for:

  • Your name and age ✅

  • Access to your GPS to track walking routes ❌

  • Permission to share your data with marketing partners ❌

Thanks to Consent by Design:

  • You can grant access to just your name and age.

  • Deny location tracking and data sharing.

  • Continue using the core features of the app.

  • Later, if you change your mind, you can withdraw consent for any of the permissions via the app’s settings.

This kind of control is now your legal right.

How Consent by Design Benefits You

Traditional Consent Consent by Design
Buried in terms and conditions Clear, specific, and user-friendly
One-time opt-in, hard to reverse You can withdraw anytime
Pre-checked boxes Requires active, informed action
Consent = full access Granular options (choose what to share)

Your Right to Withdraw Consent

Under DPDPA and global best practices (like GDPR), you have the right to withdraw consent at any time.

Once you withdraw:

  • The Data Fiduciary (the company) must stop using your data.

  • They must delete the data if there’s no legal reason to retain it.

  • They cannot deny you core services (unless data is essential for that service).

Example:
You gave consent to a shopping app to send you promotional messages. A week later, you’re flooded with marketing emails and SMS. You decide to withdraw consent.

What you can do:

  • Go to the app’s “Privacy Settings.”

  • Disable “Promotional Messaging.”

  • Alternatively, email their Data Protection Officer (DPO) requesting withdrawal.

If they fail to comply, you can escalate the issue to the Data Protection Board of India.

Common Areas Where Consent Matters

Here are some areas where Consent by Design and the right to withdraw should be enforced:

Platform Type Data Typically Collected What You Can Control
E-commerce apps Shopping habits, payment info Consent for ads, tracking
Social media Photos, friend list, location Consent for facial recognition
Health/wellness apps Body metrics, health history Consent to share with 3rd parties
Fintech & banking PAN, Aadhaar, income data Consent for KYC data use
EdTech platforms Learning patterns, student ID Consent to share data with schools or partners

Red Flags: When Consent by Design Is Being Violated

Watch out for:

  • No option to refuse consent without losing access.

  • Inability to modify or revoke consent later.

  • Confusing or overly long privacy policies.

  • Not being told how your data is used or who it’s shared with.

In these cases, you can report the service to the Data Protection Board or seek support from digital rights organizations.

Best Practices for the Public

As a responsible user and Data Principal under the DPDPA, here’s how you can practice good consent hygiene:

  1. Read before you tap “Agree” – Especially on new apps or services.

  2. Use privacy settings – Most platforms now offer granular controls.

  3. Avoid one-click logins using Facebook/Google unless necessary—they often come with broad data-sharing permissions.

  4. Withdraw consent regularly – Review app permissions monthly.

  5. Ask questions – Companies must answer your queries on what data they hold and why.

Tools You Can Use

  • Permission Managers (on Android/iOS) – See and revoke app permissions.

  • Privacy Labels (on Google Play and App Store) – Understand how your data will be used before installing apps.

  • Privacy Browser Extensions – Block hidden trackers that collect data without consent.

  • Email Unsubscribe Tools – Revoke consent for marketing emails.

Government and Regulatory Role

The Data Protection Board of India (DPBI) is being set up to:

  • Handle citizen complaints.

  • Penalize violators (up to ₹250 crore).

  • Enforce the “Consent by Design” principle.

  • Promote public awareness on data rights.

The board is expected to launch full operations by late 2025, giving users a centralized platform to report non-compliance.

Conclusion

Consent by Design isn’t just a legal concept—it’s a new way of thinking about privacy, putting you in charge of your personal data. With the DPDPA 2023/2025, Indian citizens now have the right to be informed, to say “no,” and to take back control through consent withdrawal.

Whether you’re a student signing up for an online course, a senior citizen managing health records, or a professional using dozens of apps daily—your data is yours. Make sure your consent is active, informed, and reversible.

Start today:

  • Check the apps you use.

  • Review what data you’ve consented to share.

  • Withdraw what’s not essential.

  • Educate your family and peers.

Remember: Privacy isn’t a privilege. It’s your legal right.

How does the DPDPA empower you to control your personal data online in India?

In an increasingly digitized world, our personal data is our digital identity—be it names, mobile numbers, Aadhaar details, browsing habits, or medical records. With businesses and governments relying heavily on data to provide services, data protection has become a fundamental right, not just a technical issue. Recognizing this, the Indian government enacted the Digital Personal Data Protection Act (DPDPA), 2023, ushering in a new era of data privacy, accountability, and empowerment for Indian citizens.

As a cybersecurity expert, I consider the DPDPA a landmark legislation that not only safeguards your data but also gives you direct control over who uses it, how it’s used, and for what purpose. In this blog post, we’ll explore how the DPDPA empowers you to control your personal data online in India, what rights you now hold, and how you can practically exercise them.

What is the DPDPA, 2023?

The Digital Personal Data Protection Act (DPDPA) was passed in August 2023 by the Parliament of India. Its primary objective is to protect digital personal data and regulate how organizations collect, store, process, and share your data—while respecting individuals’ right to privacy.

It applies to:

  • All personal data collected in digital form, whether online or offline (if digitized).

  • All data processing activities that involve Indian citizens, even if done outside India.

It introduces clear responsibilities for companies (called “Data Fiduciaries”) and strong rights for you—the “Data Principal”.

Key Rights You Have Under DPDPA

1. Right to Consent

One of the most powerful features of DPDPA is that no one can collect or process your personal data without your clear and informed consent. This consent must be:

  • Free (not forced),

  • Specific (for a particular purpose),

  • Informed (you must know what data is collected and why),

  • Unambiguous (clear and affirmative),

  • Revocable at any time.

🟢 Example: When you download a food delivery app, it must explicitly ask you for consent to access your location or contacts. You can say “No” to access beyond what is necessary.

2. Right to Access Your Data

You have the right to know:

  • What personal data a company holds about you,

  • Why and how it was collected,

  • Whether it has been shared with third parties,

  • For how long it will be stored.

This gives you transparency into the digital footprint you leave behind.

🟢 Example: If you use an online shopping platform, you can request details about your saved addresses, payment history, preferences, and browsing activity.

3. Right to Correction and Erasure

You can now request corrections to inaccurate data and even ask companies to erase data that is no longer necessary or was obtained without valid consent.

🟢 Example: If a digital health app still stores your outdated contact details or wrong medical history, you can demand corrections—or erasure—under the law.

4. Right to Grievance Redressal

If a company refuses to correct or delete your data, or if your consent was ignored, you have the right to file a grievance. The data fiduciary must respond within a stipulated time.

If unresolved, you can escalate the issue to the Data Protection Board of India (DPBI), an independent body created under the Act.

🟢 Example: A mobile app you deleted months ago continues to send you promotional emails. You can complain to the company and then to the DPBI if they don’t act.

5. Right to Nominate

In the event of your death or incapacitation, you can nominate someone to exercise your rights under DPDPA on your behalf.

🟢 Example: Suppose you become critically ill and cannot manage your digital accounts. Your nominated person can request erasure of your sensitive data or deactivate your accounts.

What Organizations (Data Fiduciaries) Must Do

DPDPA doesn’t just give rights to users—it places strict responsibilities on companies that handle your data. These include:

  • Data minimization: Only collect data necessary for the stated purpose.

  • Storage limitation: Don’t store your data forever. Delete it once the purpose is over.

  • Security safeguards: Implement encryption, access control, and other cybersecurity measures.

  • Breach notifications: Inform affected users and the Board in case of data leaks.

  • Consent managers: Make it easy for users to give or withdraw consent via independent platforms.

Failure to comply with these duties can lead to heavy fines—up to ₹250 crore per violation.

Practical Steps: How to Exercise Your Rights

1. Read the Privacy Policy Carefully

Whenever you install an app or use a new website, go through the privacy policy. Check:

  • What data is collected

  • For what purpose

  • If data is shared with third parties

  • Your rights as a user

🔒 Pro Tip: If the app doesn’t provide a clear privacy policy or asks for unnecessary permissions (like a flashlight app asking for location), avoid it.

2. Use “Privacy Settings” in Apps

Most apps and websites now offer privacy dashboards. Use them to:

  • Limit data collection

  • Revoke previously given consent

  • Opt out of targeted ads

🛡️ Example: In Facebook or Instagram, go to Settings > Privacy to control who sees your data and manage ad preferences.

3. Submit a Data Request

Under DPDPA, companies must provide a mechanism (usually via email or web form) to:

  • Access your data

  • Correct or delete it

  • Lodge complaints

Sample request:

“As per the Digital Personal Data Protection Act, 2023, I request access to all personal data your company holds about me. Kindly also provide details about the purpose of processing and any third parties with whom my data has been shared.”

4. Escalate to the Data Protection Board

If a company ignores your requests or violates your rights:

  • File a formal complaint with the Data Protection Board of India once it is operational.

  • Provide supporting documentation like screenshots, previous emails, or proofs of consent denial.

Real-Life Scenario: How the DPDPA Helped Ramesh

Ramesh, a college student from Pune, used a free resume-builder app. He later found his resume posted on a job portal without his knowledge. The app had collected and misused his personal data without proper consent.

Under DPDPA, Ramesh contacted the app developer and demanded deletion of his data and proof of action taken. When they ignored his requests, he lodged a complaint with the Data Protection Board (once active), which penalized the company and enforced data erasure.

This case highlights how DPDPA shifts power back to the individual.

Challenges Ahead

While DPDPA is a great step forward, its success depends on:

  • Public awareness: Citizens must know and exercise their rights.

  • Efficient enforcement: The Data Protection Board must act swiftly and transparently.

  • Corporate compliance: Businesses need to prioritize privacy, not just treat it as legal formality.

Conclusion

The Digital Personal Data Protection Act, 2023, marks a historic shift in how India treats data privacy. For the first time, it places you—the citizen—at the center of control over your personal data.

From giving explicit consent to accessing and deleting your data, to holding companies accountable for violations, DPDPA empowers you like never before. It lays the foundation for a safer digital India where privacy is not a luxury, but a legal right.

In an age where “data is the new oil”, this law ensures you’re not just a product—but an empowered individual.

So the next time an app asks for access to your gallery or contacts, think twice—and remember, you have the right to say no.

What are the core messages of Cybersecurity Awareness Month 2025’s “Secure Our World” theme?

Every October, Cybersecurity Awareness Month reminds us of a crucial truth: in a hyper-connected world, cybersecurity is everyone’s responsibility — not just IT teams and tech companies.

For 2025, the global theme — “Secure Our World” — is more relevant than ever. It’s a call to action for individuals, families, businesses, and governments to work together to protect our shared digital lives.

As a cybersecurity expert, I see firsthand how the smallest habits — a strong password, a quick software update, a skeptical click — can stop major breaches. This year’s theme breaks it down into four practical messages that anyone can adopt.

In this post, we’ll unpack:
✅ The four core messages behind “Secure Our World”.
✅ Why they matter in today’s threat landscape.
✅ Real examples of how they protect us.
✅ Simple actions the public can start today.
✅ How these habits align with India’s growing cybersecurity focus.
✅ And a clear takeaway for individuals and organizations alike.

Why Cybersecurity Awareness Month Matters

Hackers thrive when we get lazy — when we reuse passwords, skip updates, or ignore red flags in emails.

Cybersecurity Awareness Month — driven by campaigns like “Secure Our World” — brings fresh urgency and practical reminders. It helps people see that small actions, when done consistently, close big security gaps.

The Four Core Messages of “Secure Our World”

The 2025 theme focuses on four core pillars that, together, build a stronger digital foundation for everyone:

1️⃣ Use Strong Passwords and a Password Manager

Passwords remain the first line of defense for most online accounts — from banking to social media to healthcare. Yet millions of people still use weak, reused passwords like 123456 or password.

Example:
A 2024 report found that reused passwords contributed to over 60% of data breaches. One leaked password can unlock multiple accounts — personal and work.

What to do:
✅ Create long, unique passwords for every account.
✅ Use a trusted password manager to store them securely — no more sticky notes or spreadsheets.
✅ Change passwords immediately if you suspect they’re compromised.

2️⃣ Enable Multifactor Authentication (MFA)

A strong password alone is good — but not enough. Hackers can steal or guess it. MFA adds an extra layer: something you know (your password) + something you have (like a one-time code or biometric scan).

Example:
In 2025, many phishing attacks steal login credentials — but fail when the hacker doesn’t have access to your one-time code or fingerprint.

What to do:
✅ Enable MFA wherever available — especially on email, banking, and social media.
✅ Use authenticator apps over SMS for added security.

3️⃣ Recognize and Report Phishing

Phishing remains the most common way attackers trick people into handing over sensitive information. Scams are getting more sophisticated — using AI, deepfakes, and stolen branding.

Example:
In early 2025, an Indian logistics company nearly lost crores when an employee clicked a phishing link posing as a vendor’s invoice. A quick-thinking IT team spotted it just in time.

What to do:
✅ Double-check suspicious emails and messages — look for misspellings, unexpected requests, and fake urgency.
✅ Never click unknown links or download unverified attachments.
✅ Report suspected phishing to your company’s IT or CERT-In (India’s national cyber response team).

4️⃣ Update Software and Devices Promptly

Outdated software is like an unlocked door. Patches fix known vulnerabilities. When you delay updates, you leave the door open for attackers.

Example:
Many high-profile ransomware attacks start by exploiting old, unpatched software — sometimes years out of date.

What to do:
✅ Turn on automatic updates for operating systems, apps, browsers, and antivirus tools.
✅ Restart devices regularly to ensure updates apply.

Why These Messages Matter in 2025

India’s digital footprint is massive: over 900 million internet users, growing smart cities, mobile banking, and a push for cloud adoption. This means more opportunities — and more targets.

Cyber criminals follow the money — and weak security habits make their job easy.

The “Secure Our World” theme is a reminder that while we can’t control what hackers do, we can control how we protect ourselves.

How Businesses Should Amplify This Theme

Companies should turn these four pillars into everyday practice:
✔️ Run awareness sessions during October — and beyond.
✔️ Use real phishing simulations to test employees.
✔️ Provide clear guides for MFA setup and password managers.
✔️ Enforce mandatory updates for company devices.
✔️ Celebrate employees who spot and report suspicious activity.

How the Public Can Apply This at Home

It’s not just for offices. Families can “Secure Our World” together:
✅ Use a family password manager — teach kids never to reuse passwords.
✅ Enable MFA on social accounts — kids’ accounts are frequent targets.
✅ Talk about phishing — show examples so everyone recognizes red flags.
✅ Keep all devices — phones, tablets, smart TVs — updated.

Aligning with India’s National Push

India’s Cyber Swachhta Kendra, CERT-In advisories, and the DPDPA 2025 all emphasize individual responsibility for data protection. Simple habits like these can help you stay on the right side of the law — and keep your data safe from prying eyes.

Small Habits, Big Protection

One employee enabling MFA on their work email could stop a business email compromise scam. One teen learning not to click random links could prevent identity theft. One update could close a vulnerability that ransomware gangs love to exploit.

“Secure Our World” means every click, every password, every update counts.

Conclusion

Cybersecurity Awareness Month 2025’s “Secure Our World” isn’t just a slogan — it’s a blueprint for everyday defense.

Use strong passwords and store them safely. Always enable multifactor authentication. Stay alert for phishing. Keep your devices updated. Repeat these habits daily — and share them with your family, friends, and colleagues.

Because in the end, cybersecurity isn’t just about protecting your data — it’s about protecting our world.

By

What are your fundamental rights as a data principal under India’s DPDPA 2023/2025?

With the explosion of digital services, our personal data is constantly being collected, shared, and processed—often without our full awareness or consent. Recognizing the urgency to safeguard citizens’ privacy in this digital era, the Indian government enacted the Digital Personal Data Protection Act (DPDPA), 2023, which is expected to be implemented in phases during 2024–2025.

This landmark legislation puts the power back into the hands of you—the Data Principal (i.e., the person to whom the data relates). For the first time, Indian citizens have clearly defined data protection rights enforceable under law.

In this blog post, we will explore your fundamental rights under the DPDPA as a Data Principal, explain how you can exercise these rights, and provide examples that show how this law will empower everyday Indians to take control of their digital identities.

Who is a Data Principal?

Under the DPDPA, Data Principal refers to the individual whose personal data is being collected and processed. If you’re using a smartphone, browsing online, using apps, or signing up for digital services, you are a Data Principal.

For example:

  • A teenager uploading selfies to Instagram.

  • A homemaker ordering groceries online.

  • A professional using a fintech app for investing.

  • A farmer using an agri-tech platform.

Each of these individuals has personal data that is being processed and is protected under the Act.

Overview of the DPDPA 2023/2025

The Digital Personal Data Protection Act, 2023 applies to:

  • All digital personal data collected within India.

  • Data processed outside India if it involves Indian citizens.

  • Government and private entities (called Data Fiduciaries) who collect/process personal data.

The Act lays down duties for data handlers (Fiduciaries) and empowers individuals (Principals) with a Bill of Rights for their personal data.

Let’s now explore your fundamental rights.

1. Right to Access Information

What it means:
You have the right to know what personal data a Data Fiduciary holds about you, why it is being used, and who it is shared with.

Real-life example:
If an e-commerce platform stores your name, address, shopping history, and payment preferences, you can formally ask them:

  • What data do you have about me?

  • For what purpose was it collected?

  • Did you share it with third parties like advertisers or delivery companies?

How this helps you:
It promotes transparency. You’ll be aware if your personal data is being used ethically and lawfully.

2. Right to Correction and Erasure

What it means:
You can request correction of inaccurate data and deletion of data that is no longer required or was collected without valid reason.

Example:
Suppose a health app has your old, incorrect blood type or stores past health data that you no longer want in their system. You can ask for this to be updated or deleted.

Impact:
This prevents misuse of incorrect or outdated information that could harm your creditworthiness, health decisions, or online reputation.

3. Right to Data Portability (anticipated through delegated legislation)

What it means:
Though not directly stated in the core Act, upcoming rules may enable data portability—i.e., the ability to transfer your personal data from one service provider to another in a machine-readable format.

Example:
You may be able to move your entire user history and preferences from one fintech app to another without re-entering everything.

Why it matters:
You won’t be locked into a service provider just because they hold your data. It also encourages competition and innovation.

4. Right to Grievance Redressal

What it means:
You can raise a complaint with the Data Fiduciary (company) if your rights are violated. If not resolved within 7 days, you can escalate it to the Data Protection Board of India (DPBI).

Example:
Let’s say a food delivery app keeps sending you promotional emails even after you opt-out. You can file a grievance and, if unresolved, escalate to the DPBI.

Why this empowers you:
You are no longer helpless against digital harassment or misuse. There’s a formal system that holds companies accountable.

5. Right to Consent and Withdrawal

What it means:
No personal data can be processed without your free, informed, specific, and unambiguous consent. You can also withdraw your consent at any time.

Example:
An app asks for your permission to access your contacts, location, and microphone. You can refuse or grant selective consent. Later, you can revoke that consent.

Practical Use:

  • Only allow apps access to what’s truly necessary.

  • Withdraw access when not using a service.

  • Prevent companies from using your data for marketing without consent.

6. Right to Nominate (Digital Succession Right)

What it means:
You can nominate another individual to exercise your data rights in case of death or incapacity.

Example:
If you manage investments or health records through mobile apps, your nominee (spouse, child, or trusted friend) can access or delete this data if something happens to you.

Why it’s important:
Your digital legacy is protected and can be managed responsibly even in your absence.

Your Duties as a Data Principal

The DPDPA not only gives rights but also outlines duties you must follow:

  • Do not impersonate someone else.

  • Do not file false grievances or requests.

  • Provide authentic data when needed.

Example:
Creating fake identities on social media or making false claims against companies may lead to penalties under the Act.

How to Exercise These Rights

  1. Contact the Data Fiduciary (Company):
    Use the privacy/contact section of the company’s website or app. Mention which right you want to exercise (e.g., deletion, correction).

  2. Wait for Response (Within 7 days):
    As per the Act, they must respond within a reasonable time frame.

  3. Escalate to the Data Protection Board:
    If not satisfied, lodge a complaint with the Data Protection Board of India, expected to be active by mid-2025.

  4. Monitor Your Digital Footprint:
    Regularly check which apps and services you’ve given data access to. Revoke unnecessary permissions.

Real-Life Applications of DPDPA Rights

  • Parents: Can now control and monitor apps targeting their children, and demand deletion of sensitive information.

  • Employees: Can request that old HR records, especially post-employment, be erased if not required.

  • Women: Can withdraw data shared on dating apps or social platforms and ask for its complete deletion.

  • Senior Citizens: Can nominate trusted people to manage their digital data and privacy.

  • Rural Users: Can get clarity on how government schemes collect and process Aadhaar or mobile number information.

Penalties and Enforcement

The DPDPA prescribes heavy penalties for violations:

  • ₹250 crore for failure to protect personal data.

  • ₹200 crore for processing children’s data without safeguards.

  • ₹10,000 fine for filing false complaints.

The Data Protection Board of India (DPBI) will have powers to investigate, issue summons, and penalize entities.

Conclusion

The Digital Personal Data Protection Act, 2023/2025 is a landmark moment for Indian citizens, giving them robust digital rights to protect their personal data. As a Data Principal, you now have the legal power to access, correct, delete, and control your personal information.

These rights are not just for tech-savvy individuals—they apply to every Indian using digital services, from students and entrepreneurs to farmers and homemakers.

Start today:

  • Review your app permissions.

  • Ask companies what data they hold on you.

  • Use your rights to opt-out or correct data.

  • Nominate someone you trust.

Data is the new gold—and now you own the mine. Use your rights wisely, stay informed, and protect your digital self in the connected future.