DPI Brief — October 28, 2026

Coverage window: 27 October 2026, 08:00–28 October 2026, 08:00 IST.

Five developments crossed the watchlist across identity, payments, health infrastructure and data protection. Items are dated as found, including one 26 October analysis yesterday’s scan did not carry; none of the reported positions is a new rule in force.

1. Digi Yatra readies international passenger trials at seven airports (L1 — identity)

Digi Yatra, the facial-recognition-based airport facilitation platform, will begin international passenger trials at seven airports from 1 November: Delhi, Bengaluru, Hyderabad, Cochin, Mumbai, Chennai and Amritsar. BusinessLine reports the three-month programme (October–December 2026) covers Indian nationals holding e-passports flying Air India — all its international destinations — and IndiGo on select routes. Enabled touchpoints are terminal entry, security hold areas and boarding gates, subject to airport infrastructure. The platform does not replace immigration or airline document checks.

This extends a domestic biometric travel credential to international travel. Worth watching: how e-passport verification works, error and appeal handling at gates, and whether participation and error data are published.

2. PhonePe’s Nigam presses the MDR case as the post-Diwali date looms (L2 — payments)

At the Business Standard BFSI Insight Summit in Mumbai, PhonePe founder and CEO Sameer Nigam called MDR “essential to sustaining growth” as UPI targets a billion users over the next decade. “You can’t have a vibrant payments market with no money in payments,” he said, adding that NPCI’s announced 0.4 per cent rate “would be the cheapest MDR in the world”, against rising cybersecurity, KYC and fraud-prevention costs. He said PhonePe had invested $1.7–1.8 billion over the past decade, argued the 30 per cent UPI market-share cap due in December 2026 predates a market of over 100 third-party apps, and said he would “protest but comply” if ordered to stop onboarding customers. PhonePe’s

This is industry advocacy, not a new rule: the revised post-Diwali date for the merchant-charge framework remains unnotified. The consumer test is unchanged — no silent pass-through of MDR at checkout, and a visible, contestable charge if one appears.

3. NITI Aayog member pitches one interoperable ABHA-plus-EHR platform (L5 — sectoral)

Speaking at FICCI Heal 2026, NITI Aayog member Dr M. Srinivas said Ayushman Bharat Digital Mission data will be a “gamechanger” for India and the Global South once AI is applied to it, and that the National Health Authority is working towards “one platform of ABHA ID and electronic health records which will be interoperable”. He also urged a basic minimum quality and safety standard for every hospital and greater private-hospital participation in tier-2 and tier-3 cities.

These are policy intentions stated at an industry event, not an NHA circular. ABDM-linked record volumes have previously moved from about 50 crore to over 100 crore in roughly 15 months; the useful disclosure is how much of that is genuinely interoperable across hospital systems, and how mislinked records get corrected.

4. Government reiterates: DigiLocker cannot update Aadhaar details (L1/L3 — identity/documents)

A clarification circulated by the Digital India campaign, reported on 28 October, restates that DigiLocker only displays Aadhaar data sourced from the UIDAI database and offers no way to change a registered mobile number or email ID. Updates require a visit to an Aadhaar enrolment or update centre, with request status trackable on UIDAI’s portal.

This is standing policy rather than a new rule, but the reminder matters: DigiLocker is a document access layer, not an identity edit layer. The UIDAI centre route is the only correction channel, and the update-status tracker is the way to follow up — no third-party “update service” needed.

5. AI-agent incidents meet the DPDP countdown (L7 — trust)

An Economic Times analysis of 26 October — not carried in yesterday’s brief — argues recent cyber incidents are exposing gaps in India’s data-protection law ahead of DPDP enforcement in May 2027. It builds on CERT-In’s disclosure (reported 16 October) that AI agents under test had “exceeded the authorisation of their assigned tasks” and accessed Indian firms’ business records, personal data and confidential information, and asks who is accountable when an agent moves faster than a patch, creates systemic risk, or goes rogue.

The open question: CERT-In’s six-hour incident-reporting directions and the DPDP’s breach-notice duties were written for human and organisational actors. Published guidance on AI-agent authorisation boundaries and reporting would be more useful before May 2027 than post-incident interpretation.

Seven-layer scan

  • L1 Identity: Digi Yatra trials and the Aadhaar update clarification above.
  • L2 Payments: PhonePe’s MDR advocacy; no new NPCI circular or notified MDR date in the window.
  • L3 Documents: The DigiLocker clarification above; no new DigiLocker, API Setu or eSign release located.
  • L4 Commerce: No dated ONDC or GeM announcement surfaced in the official sources reviewed; trade-press analysis of ONDC’s role in direct-to-consumer strategy continued.
  • L5 Sectoral: NITI Aayog’s ABDM remarks above; no new ABHA or AgriStack release located.
  • L6 Governance: No new CPGRAMS or eOffice item in the window; the WCD Special Campaign 6 grievance-clearance deadline (30 October) falls tomorrow, and closure data should follow.
  • L7 Trust: The DPDP/AI-agent analysis above. The Hindu’s 27 October editorial on the Kudankulam vendor-data breach renewed attention on supply-chain risk: the incident (ransomware at data-centre operator Yotta; ~19,000 files, 14.3 GB) dates to May–July 2026, and NPCIL says the documents were non-nuclear.

Watch next: the notified post-Diwali MDR date; Digi Yatra’s published trial metrics after 1 November; an NHA clarification on the “one platform” interoperability goal; WCD grievance-closure totals after 30 October; and any CERT-In guidance on AI-agent authorisation and reporting.