DPI Deep Dive — Sunday | August 09, 2026

Layer L7: Security, Privacy & Trust — CERT-In, DPDP Act, TRAI, I4C, and the institutional framework safeguarding India’s digital public infrastructure.

1. e-Zero FIR Goes National: PRAGATI 52 Orders All-State Rollout After Digital Arrest Scams

The 52nd PRAGATI (Pro-Active Governance and Timely Implementation) meeting, chaired by the Prime Minister on June 24, delivered the most consequential cybersecurity-governance directive of 2026: all state governments must immediately implement the e-Zero FIR system developed by the Indian Cybercrime Coordination Centre (I4C).

The system automatically converts verified cyber financial fraud complaints exceeding ₹10 lakh — filed on cybercrime.gov.in or via the 1930 helpline — into actionable Zero FIRs routed instantly to the territorially competent cyber police station, bypassing the jurisdictional friction that has historically stalled cross-state cyber crime investigations. Assam went live on June 23, a day before the PRAGATI meeting, making it the first state to deploy the system.

The directive comes amid mounting losses from “digital arrest” scams — where fraudsters impersonate law enforcement agencies via video calls, confine victims digitally, and extort money. The PRAGATI meeting reviewed four major infrastructure projects worth approximately ₹30,000 crore alongside the TB Mukt Bharat Abhiyan, but it was the e-Zero FIR mandate that signals a fundamental shift: cyber fraud complaints are now treated as interstate crimes by default, not exceptions requiring manual coordination.

Cross-layer impact: This sits at the intersection of L6 (Governance & Grievance — PRAGATI’s institutional monitoring mechanism) and L7 (Security — I4C’s technical infrastructure). The e-Zero FIR system essentially weaponises the grievance redressal pipeline for cybersecurity, converting citizen complaints into law enforcement actions without human intermediation. It also touches L2 (Payments — UPI transaction fraud being a major complaint category) and L1 (Identity — Aadhaar-linked KYC fraud being a vector for digital arrest scams).

Consumer angle: The system directly addresses the jurisdiction shopping that police stations have historically engaged in — “that happened in another state, file there” — which has been the single biggest barrier to cyber fraud recovery for ordinary citizens.

2. DPDP Act Enforcement Tightens: AI Research Tools Face New Liability Framework

The Digital Personal Data Protection (DPDP) Act, 2023 continued its slow but decisive operationalisation through July-August 2026, with the July 2026 DPDP Intelligence Briefing from DPDPIndia.in flagging critical new liability vectors for legal professionals and AI tool vendors.

The briefing highlighted that advocates and law firms using AI research or drafting tools must now institute internal verification protocols, as the disclosure duty under the DPDP framework — combined with non-delegable accuracy liability — makes “the tool got it wrong” a career risk, not a defence. Legal-tech vendors targeting courts must design for explainability and sandbox testing from day one.

This development has significant implications for India’s AI governance stack. The DPDP Act’s unique approach — placing obligations on “Data Fiduciaries” without explicitly naming AI systems — creates a regulatory ambiguity where existing DPI layers (particularly Aadhaar-authenticated services under L1) must navigate compliance without clear AI-specific guidance from the Data Protection Board.

The Rajya Sabha was informed during the monsoon session that the government received over 15.2 lakh public grievances on CPGRAMS in 2026 (January to mid-July), with the Darpg-Bhashini AI-powered grievance registration system itself generating personal data that falls squarely under DPDP’s scope. The irony is unavoidable: the AI systems being deployed to improve governance are themselves creating new data protection obligations.

Cross-layer impact: Connects to L3 (Documents & Data Exchange — DigiLocker records as personal data), L1 (Aadhaar data as “sensitive personal data”), and L6 (CPGRAMS grievance data now subject to DPDP retention and processing norms).

Consumer angle: The DPDP Act’s Data Fiduciary obligations mean that when an AI chatbot on a government portal mishandles your personal information during a grievance filing, both the ministry operating the portal and potentially the AI vendor could face Board-level accountability — a level of protection that didn’t exist under the IT Act 2000.

3. TRAI’s Expanding Mandate: Spam, AI-Generated Calls, and the Telecom-Cybersecurity Nexus

The Telecom Regulatory Authority of India (TRAI) continued tightening the screws on unsolicited commercial communication through July and August 2026, with increasing attention on AI-generated voice calls and synthetic media used for phishing and social engineering.

While specific regulatory orders from the past week require deeper excavation, TRAI’s trajectory over the last 7 days is clear: the Do Not Call registry is being augmented with AI-detection capabilities for synthetic voice cloning, and telecom operators are being pushed toward real-time call authentication frameworks. The PRAGATI 52 discussion on cybercrime included specific references to the telecom sector’s role in enabling — and now combating — digital arrest scams, where spoofed caller IDs and VoIP infrastructure are primary vectors.

The 1st State-Level Digital Governance, AI, Cybersecurity & Skilling Workshop held in Manipur during this period — featuring a Bhashini Hackathon focused on voice and text interfaces for governance services — underscores how India’s DPI layers are converging around the cybersecurity challenge. Bhashini, originally an L3 language AI tool, is now being deployed for voice-based grievance registration (Samadhan Didi on CPGRAMS), which requires telecom infrastructure to function securely.

Cross-layer impact: Bridges L4 (Commerce — spam calls targeting digital marketplace users), L7 (Security — AI voice cloning as attack vector), and the telecom regulatory framework that underpins all DPI layers.

4. ICMR Wins Gold at National e-Governance Awards 2026 — But Security Questions Linger

The National e-Governance Awards 2026, presented during the 29th National Conference on e-Governance (NCeG-2026) held on July 1-2 in Jaipur, Rajasthan, saw the Indian Council of Medical Research (ICMR) win gold for AI innovation in e-governance. The awards, organised jointly by DARPG and MeitY, are the premier recognition of digital governance excellence in India.

However, the awards raise a pertinent question for L7: are the AI systems being celebrated for governance innovation also being audited for security and privacy compliance? The DPDP Act’s requirements for Data Fiduciaries apply equally to health data systems, and ICMR’s AI tools processing health records sit at the intersection of the DPDP Act, the IT Act’s reasonable security practices, and the forthcoming Digital India Bill.

The NCeG conference itself, now in its 29th edition, has evolved from celebrating digitisation (scanning paper files) to recognising AI-driven governance — a trajectory that brings security considerations front and centre. V. Srinivas, former DARPG Secretary and now Chief Secretary of Rajasthan, noted in a recent interview that “digital governance is entering a new phase” shaped by AI, DPI, cybersecurity, and data governance.

Cross-layer impact: L5 (Sectoral Infrastructure — health systems like ABHA/ICMR) meets L7 (Security — health data protection), with the e-Governance awards as the institutional recognition layer.

5. The Bhashini Paradox: AI Accessibility Meets Data Sovereignty

Bhashini, India’s AI language translation platform, had a significant week. The platform powers the newly launched “Samadhan Didi” AI chatbot on CPGRAMS — enabling citizens to file grievances by voice in any of India’s 22 scheduled languages. The chatbot, launched on May 30, 2026, uses AI to identify the appropriate ministry and grievance category, routing complaints to the correct Grievance Redressal Officer automatically.

Bhashini was also integrated into the National Cooperative Database (NCD) portal 3.0, launched by the Home & Cooperation Minister on July 6, 2026, providing multilingual support through Bhashini integration — alongside features like OTP-based secure login, village-level GIS mapping, and an AI chatbot.

But Bhashini’s expanded deployment across government platforms raises a critical L7 question: where does the voice data go? When a citizen speaks their grievance in Odia or Tamil to Samadhan Didi, that voice data is processed, transcribed, translated, and routed — creating a chain of data processing that must comply with DPDP’s consent and purpose-limitation requirements. The government has not publicly disclosed Bhashini’s data retention policies, processing locations, or whether third-party AI vendors are involved in the transcription pipeline.

This is the Bhashini paradox: the same AI tool that makes governance accessible to 1.4 billion citizens in their own languages also creates one of the largest voice data repositories in Indian government history. For a layer (L7) defined by security, privacy, and trust, this tension deserves far more scrutiny than it currently receives.

Cross-layer impact: Bhashini touches every DPI layer — L3 (data exchange), L6 (grievance registration), L5 (cooperative databases), and L7 (the voice data itself). It may be the most cross-cutting DPI component after Aadhaar.

This Week’s Scorecard

Published by DPI Watch — tracking India’s Digital Public Infrastructure, one layer at a time.