The growing importance of privacy governance and responsible data management took centre stage at the FutureCrime Summit 2026, where industry experts discussed how Indian organizations can strengthen accountability for personal information.

A panel titled “Data Fiduciary Accountability: Governance, Audits and the Role of Data Protection Officers in India” examined the changing responsibilities of businesses as India’s digital ecosystem and privacy framework continue to evolve.

The discussion featured Suditi Tandon, Senior Officer, Global Data Privacy Office Specialist, Corporate Legal & Compliance at Hella India Automotive Private Limited; Krishan Kumar, Vice President at SPECTRA; Dipanshu Parashar; and Nirmal Raj M, Principal Officer & Risk Compliance Lead at Onmeta.

Data Governance Is Becoming a Business Responsibility

A key message from the discussion was that data protection can no longer be viewed solely as a legal or compliance exercise.

Organizations handling personal information need to establish clear oversight over the entire data lifecycle. This includes understanding what information is collected, the purpose for collecting it, where it is stored, who has access to it and when it should be deleted or retained.

The challenge becomes more complex as businesses increasingly depend on cloud infrastructure, digital platforms and external technology providers. Maintaining visibility over personal information across these interconnected systems requires stronger internal governance and clearly defined accountability.

Privacy policies and consent mechanisms remain important, but they are only part of an effective data protection framework. Organizations also need operational controls that translate privacy principles into everyday business practices.

Data Audits Can Reveal Hidden Governance Gaps

The panel also highlighted the role of audits in determining whether privacy policies are working in practice.

A well-designed data audit can assess areas such as information inventories, access permissions, retention procedures, third-party relationships and internal controls. Such reviews can identify weaknesses that may not be apparent from written policies alone.

Third-party data processing was another important consideration. When organizations rely on outside vendors or technology platforms, they need adequate oversight of how information is processed throughout its lifecycle. Simply transferring data to a service provider does not remove the need for effective accountability.

Regular audits can therefore serve as an important mechanism for identifying operational shortcomings before they become larger compliance, privacy or security concerns.

DPOs Moving Beyond Traditional Compliance

The evolving role of Data Protection Officers was another major theme of the session.

DPOs increasingly operate across several areas, including privacy law, technology, risk management and corporate governance. Their responsibilities can extend beyond maintaining documentation to advising senior leadership, assessing privacy risks and helping organizations build stronger data-handling processes.

The professional backgrounds of the panelists also reflected the multidisciplinary nature of modern privacy governance, bringing together corporate privacy, legal technology, artificial intelligence, compliance, risk management and cybercrime-related perspectives.

This broader role positions DPOs as an important part of an organization’s internal accountability structure rather than simply as administrative compliance personnel.

Building Trust Through Stronger Accountability

The FutureCrime Summit discussion underlined a broader shift in the way organizations approach personal data.

Effective data protection requires cooperation between management, legal and compliance teams, technology professionals, security functions and other business units. Clearly assigned responsibilities, regular audits and appropriate technical safeguards all contribute to a stronger governance framework.

As businesses become increasingly dependent on personal information and digital services, responsible data management is also becoming closely linked to consumer confidence and digital trust.

The panel’s central takeaway was clear: accountability for personal data must be embedded across an organization rather than left to a single department or compliance function.

NEW DELHI: Twitter faces a major security scare as a hacker claims to have accessed personal data of over 400 million users, including high-profile names like Sundar Pichai, CEO of Google, Bollywood actor Salman Khan, Donald Trump Jr., Steve Wozniak, and singer Charlie Puth. The hacker, known online as Ryushi, shared sample data to substantiate the claim.

The alleged breach reportedly includes emails and phone numbers, with the hacker demanding that Twitter or CEO Elon Musk purchase the data to avoid potential fines under the European Union’s General Data Protection Regulation (GDPR). Such fines could reportedly reach up to USD 276 million, similar to penalties faced by other tech companies for large-scale data leaks.

In a message posted online, Ryushi stated:
“Twitter or Elon Musk, if you are reading this, you are already risking a GDPR fine over the 5.4 million user breach. Imagine the fine for a 400 million user breach. Your best option to avoid paying $276 million is to buy this data exclusively.”

Cybersecurity experts have verified portions of the leaked data. Alon Gal, co-founder and chief technology officer at Israel-based cybercrime intelligence firm Hudson Rock, confirmed that the data checked by third parties appears genuine. According to Gal, the breach likely exploited a flaw in Twitter’s API, enabling the hacker to query any email or phone number and retrieve associated Twitter profiles.

This revelation comes in the wake of an ongoing investigation by the Irish Data Protection Commission (DPC) into a previous Twitter data leak affecting 5.4 million users. That earlier incident exposed email addresses, phone numbers, and Twitter handles, highlighting ongoing vulnerabilities in the platform’s data protection measures.

Twitter has yet to issue an official statement on the 400-million-user breach. The incident raises fresh concerns over the social media platform’s ability to safeguard sensitive user information and maintain compliance with global privacy regulations.

New Delhi: India’s gaming industry is entering a pivotal phase as the updated Digital Personal Data Protection (DPDP) Act comes into effect, reshaping how studios collect, store, and use player information. The law imposes stricter limits on data collection, emphasizing purpose limitation, transparency, and user consent.

From Growth at All Costs to Trust-Based Play

The DPDP Act, inspired by global frameworks like the EU GDPR, strengthens user rights by mandating:

• Clear disclosure of data collection purposes
• Limitations on data retention periods
• Special protections for minors
• Breach notification to users and the Data Protection Board of India

Executives say the law encourages a shift from rapid, unregulated growth toward a trust-driven gaming ecosystem. Nitish Mittersain, CEO of Nazara Technologies, remarked, “We’ve moved from growth at all costs to growth built on trust, safety and accountability.”

Compliance Challenges—and a Level Playing Field

While most large studios already comply with global privacy standards, smaller developers may face operational challenges due to limited legal and compliance resources. Sridhar Muppidi, president of the Game Developer Association of India, welcomed the law but urged awareness campaigns to help smaller studios avoid severe penalties.

The law’s requirement to collect only necessary data is prompting companies to rethink long-standing practices, including telemetry, ad targeting, and third-party integrations.

Asking Hard Questions About Player Data

Privacy advocates argue the framework encourages healthier norms. Vinayak Godse of the Data Security Council of India said the Act establishes clear expectations for purpose-driven data processing.

For Felicity Games, CEO Anurag Choudhary said the shift has meant integrating privacy by design, including clear consent flows, player dashboards, and safeguards for minors.

Parents, Kids, and the Trust Equation

Executives highlight that strong privacy practices could increase parental confidence, especially after previous regulatory actions, such as bans on real-money gaming. Kashyap Reddy, CEO of Hitwicket, noted that such measures may help parents allow their children to engage safely with compliant games.

A Reset After Regulatory Whiplash

The DPDP Act arrives after a turbulent period in India’s gaming ecosystem, during which valuations dropped sharply due to restrictions on real-money gaming. Industry leaders see the law less as a regulatory burden and more as a framework to rebuild credibility with both players and policymakers in one of the world’s fastest-growing gaming markets.