DPI Deep Dive — Sunday | August 02, 2026

Layer L7: Security, Privacy & Trust — covering CERT-In, DPDP Act, TRAI, and the institutions that hold India’s digital ecosystem together.

1. CERT-In Deploys AI-Driven Cyber Defence at Scale

The single biggest story this week in India’s security layer is the government’s comprehensive disclosure of its AI-era cybersecurity posture. Minister of State for Electronics & IT Jitin Prasada told the Lok Sabha on July 30 that CERT-In has deployed AI-driven situational awareness systems to detect malicious domains and phishing, and now conducts AI-enabled vulnerability assessments of public-facing digital assets in sandbox environments. ¹

Between June and July 2026 alone, CERT-In ran 10 customised cybersecurity exercises on the theme “Building Resilience against Frontier AI-driven Cyber Threats,” involving 1,470 participants from 345 organisations across power, telecom, BFSI, transport, education, health, and space sectors. These are not tabletop drills — they’re sector-specific stress tests designed to probe how India’s critical infrastructure would hold up against AI-automated reconnaissance, rapid vulnerability exploitation, credential compromise, and multilingual social engineering at scale.

Two specific policy instruments stood out:

• June 2026 OEM Directive: All Original Equipment Manufacturers and technology providers must now implement AI-accelerated vulnerability protection — including AI-assisted security testing, continuous monitoring, patch management, and incident response frameworks specifically designed to counter AI-driven threats. This is a binding direction, not guidance. It effectively mandates that every technology vendor selling into India must harden their products against the same class of AI tools that attackers are using.

• May 2026 Blueprint: CERT-In issued a “Blueprint for Reducing Exposure and Defending against AI-Assisted Vulnerabilities Exploitation in Digital Infrastructure” — a framework document for protecting government digital infrastructure from evolving AI-driven attack vectors.

What this means for the DPI stack: India’s entire digital public infrastructure — from UPI and Aadhaar to DigiLocker and ONDC — rests on a foundation of private-sector technology providers. The OEM directive creates a compliance chain: if you sell software or hardware to any entity connected to India’s DPI stack, you now have a regulatory obligation to bake in AI-aware security. This is structural, not reactive.

CERT-In also runs an automated cyber threat intelligence exchange platform that pushes tailored alerts to organisations across sectors — essentially a national-scale threat feed. Combined with the Certified Security Professional in AI (CSPAI) programme launched with SISA in 2024 (ANSI-ANAB accredited), India is building both the institutional and human-capital infrastructure for AI-era defence. ¹

2. India Digital Payment Intelligence Corporation (IDPIC) — A New Institutional Layer Against Cyber Fraud

On July 28, the government announced the establishment of the India Digital Payment Intelligence Corporation (IDPIC), a dedicated entity to share real-time fraud intelligence and alerts with banks and financial institutions. ^{2 3}

This is significant because India’s digital payment ecosystem — processing over 14 billion UPI transactions monthly — has been a magnet for cyber-financial crime. Until now, fraud intelligence has been fragmented across NPCI, individual banks, RBI’s fraud monitoring systems, and law enforcement. IDPIC attempts to create a single pane of glass for payment fraud intelligence.

Cross-layer impact

IDPIC sits at the intersection of L2 (Payments) and L7 (Security). UPI’s architecture depends on trust: consumers must believe their transactions are safe, banks must be able to detect and block fraudulent patterns in real time, and the regulator needs visibility into systemic risks. IDPIC’s real-time intelligence feed could meaningfully reduce the “time-to-detect” gap for financial fraud — the window between when a fraud pattern emerges and when it’s identified and blocked.

The entity was announced alongside details about CSIRT-Fin (Computer Security Incident Response Team for the Financial Sector), a nodal incident response team operating under CERT-In’s supervision. CSIRT-Fin’s mandate includes collecting and analysing cyber incident data, issuing sector-specific advisories, coordinating response activities, and monitoring the financial sector’s cybersecurity posture. ²

The government also disclosed that CERT-In operates the National Cyber Coordination Centre (NCCC), which monitors cyberspace at the metadata level and shares real-time threat information with organisations, regulators, and stakeholders. ²

The consumer angle: The effectiveness of IDPIC will depend entirely on data sharing norms and latency. If intelligence reaches banks fast enough to block fraudulent transactions before settlement, it could materially reduce digital payment fraud losses. If it becomes another bureaucratic reporting layer with delayed intelligence, it will add cost without commensurate protection. The structure and governance of IDPIC — particularly its independence from the entities it monitors — will determine which outcome prevails.

3. Bank of Baroda Breach: 1 TB of Aadhaar + Financial Data Dumped on the Dark Web

On July 27, India’s second-largest public-sector bank confirmed that approximately 1 terabyte of customer and internal data had been placed on the dark web by the TripleX ransomware group — available for free download, no ransom demanded. The leaked data included savings and current account records, loan files, and up to 300,000 customer account-opening forms containing photographs and Aadhaar numbers. ⁴

This is one of the most significant DPI-layer breaches in recent memory because it sits at the junction of L1 (Identity — Aadhaar) and L2 (Payments — banking). The combination of Aadhaar numbers with photographs and financial records creates near-complete identity profiles — the exact type of data that enables synthetic identity fraud, account takeover, and targeted social engineering.

The DPDP Act gap

The Digital Personal Data Protection Act 2023 was cited as India’s primary data protection framework, but its breach notification requirements and penalty provisions (up to ₹250 crore for inadequate safeguards) will not be enforceable until May 13, 2027. ⁴ Until then, the enforcement tools are:

• RBI’s Cyber Security Framework for Banks (monetary penalties under the Banking Regulation Act)
• CERT-In’s binding directions (which require banks to report specified cyber incidents within 6 hours)

The breach reportedly originated from a single compromised employee email account — a remarkably low-barrier entry point for an attack that exposed data on potentially hundreds of thousands of customers. This raises serious questions about:

• Access controls and privilege management at public-sector banks
• Whether multi-factor authentication was enforced for employee accounts
• The adequacy of network segmentation (why did a compromised email account have access to a terabyte of customer data?)
• Whether the data was encrypted at rest

For the DPI ecosystem, this breach is a stress test of the security assumptions underlying India’s stack. Aadhaar data in the hands of a bank is only as secure as the bank’s weakest access control. If India’s data protection regime won’t be fully operational for another nine months, the question is what enforceable obligations exist right now to prevent the next BoB-scale breach.

4. TRAI Moves to Bolster Its Privacy & Cyber Security Capacity

TRAI, the Telecom Regulatory Authority of India, has opened applications for a Consultant specialising in Data Privacy and Cyber Security — signalling that the regulator is building internal capacity to address the growing intersection of telecom regulation, data protection, and cybersecurity. ⁵

TRAI also released its telecom subscription report for June 2026, showing overall tele-density at 94.31%, with rural wireless subscribers growing across Airtel, Vi, and Jio (BSNL continued to lose rural subscribers). ⁶

Why this matters for the security layer

Telecom operators are the gatekeepers of India’s digital identity infrastructure. Every OTP-based Aadhaar authentication, every UPI transaction notification, every DigiLocker verification flows through telecom networks. If TRAI is staffing up on privacy and cybersecurity expertise, it suggests the regulator anticipates a heavier role in:

• Data protection compliance by telecom operators under the DPDP Act
• Securing communication channels against interception and SIM-swap fraud
• Overseeing how telecom data is shared with government agencies and private entities

The timing — with the DPDP Act’s enforcement provisions approaching — suggests TRAI wants its regulatory house in order before the compliance burden ramps up.

5. Census 2027 Self-Enumeration Goes Live — With Cyber Fraud Warnings

On August 2, India’s Census 2027 self-enumeration portal (se.census.gov.in) went live in Assam, allowing citizens to submit household and individual information online for 15 days. ⁷

Simultaneously, The 420 reported on warnings about OTP and document fraud risks associated with the digital census process — with bad actors already circulating fraudulent links impersonating the official census portal. ⁸

The DPI connection

Census 2027 is the largest data collection exercise in Indian democracy. Self-enumeration moves this from door-to-door enumeration (where data protection is essentially physical security) to a digital pipeline that collects personal data, demographic information, and identity documents through web portals. This creates a new attack surface:

• Phishing portals: Fraudulent websites mimicking se.census.gov.in to harvest personal data
• OTP interception: If census verification uses SMS OTPs, the same SIM-swap and interception vectors that plague banking apply
• Document upload risks: Citizens uploading identity documents to self-enumeration portals need assurance that these are securely stored and not accessible to unauthorised persons

The Office of the Registrar General of India needs to ensure that the self-enumeration pipeline has the same security rigour that RBI demands of payment systems — particularly given the volume and sensitivity of data involved.

Cross-Layer Connections

This week’s developments reveal how tightly India’s security layer (L7) is coupled to every other layer:

• L1 ↔ L7: The Bank of Baroda breach exposed Aadhaar data, demonstrating that identity infrastructure security depends on downstream data custodians — not just UIDAI’s own systems.
• L2 ↔ L7: IDPIC and CSIRT-Fin are direct security responses to the scale and velocity of digital payment fraud in the UPI ecosystem.
• L3 ↔ L7: Census 2027’s self-enumeration creates new document/data exchange pathways that need the same security posture as DigiLocker or eSign.
• L7 institutional capacity: CERT-In’s AI exercises, TRAI’s privacy hiring, and the FutureCrime Summit (August 6–7 at Bharat Mandapam, featuring CERT-In DG Dr. Sanjay Bahl and former NCSC Dr. Gulshan Rai) all point to an ecosystem that’s rapidly building institutional muscle for AI-era threats. ⁹

The question for consumers is whether this institutional build-out is keeping pace with the threat surface. A terabyte of bank data on the dark web, no DPDP enforcement for nine months, and phishing census portals suggest there’s still a significant gap between policy ambition and operational security.

Covering developments from July 26 – August 2, 2026. Published as part of the DPI Watch daily deep dive series.