Module 1: Introduction to Data Protection and Privacy Laws

 Overview of data protection and privacy concepts

 Key principles of data privacy laws

 Evolution of global data protection regulations (GDPR, CCPA, etc.)

 Indian data protection and privacy legal framework

Module 2: Organizational Compliance and Implementation

 Determining applicability of laws to an organization

 Creating a data protection compliance roadmap

 Drafting data privacy policies, notices and agreements

 Conducting Data Protection Impact Assessments (DPIAs)

 Implementing grievance redressal mechanisms

Module 3: Data Transfers and Third-Party Management

 Requirements for domestic third-party data sharing

 Cross-border data transfer rules and mechanisms

 Managing data transfers in outsourcing and cloud computing

 Auditing and monitoring third-party data practices

Module 4: Individual Rights and Data Principal Obligations

 Data principal rights (access, rectification, erasure, etc.)

 Lawful bases for data processing

 Obtaining valid consent for data usage

 Age restrictions and children’s data privacy

Module 5: Data Breach Prevention and Incident Response

 Identifying and mitigating data breach risks

 Developing an incident response plan

 Data breach notification requirements

  Post-breach mitigation and remediation steps

Module 6: Regulatory Compliance and Investigations

 Powers of data protection authorities for audits and investigations

 Cooperation requirements with government agencies

 Penalties, fines and dispute resolution mechanisms

 Representing clients in litigation and regulatory proceedings

Module 7: Sector-Specific Privacy Considerations

 Data privacy in banking, healthcare and other regulated sectors

 Employee data privacy and workplace monitoring

 Privacy by design in product development

 Emerging areas like Internet of Things (IoT) and Artificial Intelligence (AI)

Module 8: International Data Protection Standards

 Comparative analysis of global data protection laws

 Data localization requirements across jurisdictions

 Managing conflicts of laws in cross-border transactions

 Future trends and developments in data privacy regulations

Abstract

The present article analyses how the contemporary problem of AI-generated deepfakes can be dealt
with through the application of the Digital Personal Data Protection Act, 2023. It identifies the
responsibility of data fiduciaries under the Act to protect personal data from being misused for such
purposes. The article also identifies certain gaps in the provisions of the Act and suggests a manner of
interpretation for them that can aid in developing a holistic framework to counter deepfakes.

Introduction
The threat of Artificial Intelligence (“AI”) tools becoming more sophisticated is less concerned with
replacing humanity and more with disconcerting it. A recent example of this issue, which sparked a row
among the celebrities and the common populace alike, was the widely circulated video of actress
Rashmika Mandanna entering an elevator. However, the issue with this viral video was that it was
consistently morphed. Rashmika’s face was edited on to the original video and it would be nearly
impossible for the average person to question its authenticity. This incident is not only extremely
concerning but also raises a larger question on the ability of Indian data protection laws to counter such
an occurrence.

The present article attempts to, firstly, decipher deepfake technology which is an application of
Generative Artificial Intelligence. Secondly, it applies the applicable provisions of the Digital Personal
Data Protection Act, 2023 (“DPDPA”) which can counter their presence on social media platforms. The
article elucidates the responsibility of Data Fiduciaries under the DPDPA to counter the breach of
personal ces certain shortcomings of the DPDPA’s provisions and suggests a manner of interpretation in
which a holistic framework to counter deepfakes can be created.