The Widening Circle: Data, Environment and Corruption

Personal Data as a Statutory Duty

No, I told him, it was not a filing, and that was the difficulty. A late FC-GPR can at least be found, dated and confessed. A shared drive holding six years of merchants' Aadhaar copies leaves no draft on any portal. It simply sits there, readable by whoever has the link, until someone asks who that is.

He had read the questionnaire correctly. Its Section 9 was headed 'Data Privacy and Protection'. By coincidence, Section 9 of the Prevention of Corruption Act, 1988 is the provision that makes a company liable for bribes paid on its behalf, and I have since watched two clients confuse the two in the same meeting. That Section 9 comes later.

The statute behind his question is the Digital Personal Data Protection Act, 2023, which received presidential assent on 11 August 2023 and then waited more than two years for its rules. The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025. Read together, they turn something most Indian companies treated as courtesy, or as an IT department's worry, into a duty owed to identifiable people and enforceable by a regulator.

The vocabulary matters. A data principal is the individual to whom personal data relates: here, each merchant whose Aadhaar card sat on the drive. A data fiduciary is whoever decides why and how that data is processed. A data processor handles it on the fiduciary's instructions. The payments firm was a fiduciary. The cloud company hosting its drive was a processor. The Act places the obligations on the fiduciary and does not let it pass them down by contract.

Those obligations are few in number and heavy in practice. Section 5 requires a notice to the data principal setting out what data is collected and for what purpose. Section 6 requires consent that is free, specific, informed, unconditional and unambiguous, given by clear affirmative action, and as easy to withdraw as it was to give. Section 8 requires the fiduciary to keep data accurate where it will be used to make decisions, to take reasonable security safeguards against breach, to tell the Data Protection Board of India and each affected person when a breach occurs, and to erase data once its purpose is served. The Rules add the detail. A breach must be reported to the Board without delay, with a fuller account within seventy-two hours, and access logs must be kept for at least a year.

The penalties are set out in the Schedule to the Act. Failure to take reasonable security safeguards can attract a penalty of up to ₹250 crore. Failure to notify a breach, or to meet the additional duties owed in respect of children, can attract up to ₹200 crore. These are ceilings. Section 33 directs the Board to weigh the nature, gravity and duration of the breach and whatever the fiduciary did to mitigate it.

The timing needs stating plainly, once. The Rules came in three stages. The provisions constituting the Data Protection Board took effect on notification in November 2025. Registration of consent managers follows twelve months later, in November 2026. The substantive duties on fiduciaries, including notice, consent, security, breach reporting and erasure, take effect eighteen months after notification, in May 2027. Until then, Section 43A of the Information Technology Act, 2000 and the 2011 rules on sensitive personal data continue to apply. The DPDP Act omits Section 43A, but that omission lands with the later phase. So at 1 January 2026 the floor is the old one, and the new floor has a date.

The CFO heard May 2027 and relaxed visibly.

'Then we have time.'

His Bengaluru investors' lawyers did not think so, and nor did I. A diligence questionnaire asks what a company will look like on the day the law bites, not on the day the form was sent. More practically, nobody can re-paper six years of consent in a fortnight before the deadline. The merchants had given their Aadhaar copies in 2019 for KYC under the firm's agreement with its bank. None of them had been told the copies would stay on a drive shared, as it turned out, with forty-one email addresses.

Eleven of those addresses belonged to people who no longer worked there.

Consent to Operate

The payments firm has no chimney and discharges nothing but email, so the next set of obligations did not concern its CFO. They concern most of my other clients. Pimpri-Chinchwad is a town of drains, stacks and effluent pits, and almost every unit in its MIDC estates holds, or ought to hold, a document from the Maharashtra Pollution Control Board without which it may not lawfully run a single shift.

In April 2022 an electroplating shop in Bhosari MIDC, two brothers and twenty-six workers chrome-plating handles for a scooter manufacturer, received a visit from a Board field officer. The officer wanted to see the consent to operate. The elder brother produced it from a plastic folder. It had expired on 31 March 2021. The renewal application, he explained, had been 'given to the consultant only', and the consultant had stopped answering his phone during the second lockdown. The officer photographed the folder, the effluent tank and the rinse line, and left. Nine weeks later a show-cause notice arrived, followed by a proposed direction for closure.

The law behind that visit is old by Indian regulatory standards. Section 25 of the Water (Prevention and Control of Pollution) Act, 1974 forbids anyone from establishing or operating an industry likely to discharge sewage or trade effluent into a stream, well, sewer or onto land without the previous consent of the State Board. Section 21 of the Air (Prevention and Control of Pollution) Act, 1981 does the same for industries in an air pollution control area, and in Maharashtra that means the whole state. The two Acts produce two consents at two stages. A consent to establish must be obtained before construction or installation begins. A consent to operate must be obtained before production starts, and renewed before it lapses. The Board in Maharashtra issues a combined consent under both Acts, with conditions on discharge quality, stack height, monitoring and waste disposal attached as a schedule that runs to several pages and is, in my experience, the least-read document in any factory office.

How hard the Board looks depends on category. Under the classification issued by the Central Pollution Control Board in March 2016, industries are graded red, orange, green or white by their pollution index. Electroplating is red. Red-category units receive shorter consent periods and closer inspection. White-category units, such as assembly of air coolers or manufacture of chalk, are exempt from consent altogether, though not from the general duty not to pollute. A unit that also generates hazardous waste, as every plating shop does, needs a separate authorisation under the Hazardous and Other Wastes (Management and Transboundary Movement) Rules, 2016. Many owners believe the consent covers it. It does not.

The penalties have changed recently. The Jan Vishwas (Amendment of Provisions) Act, 2023 replaced imprisonment for most contraventions of the Air Act with monetary penalties, and the Water (Prevention and Control of Pollution) Amendment Act, 2024 did the same for most of the Water Act, with penalties now running from ₹10,000 to ₹15 lakh, adjudicated by an officer rather than a magistrate. Prosecution remains for failing to pay. A plating shop owner reading that might conclude the risk has shrunk.

It has not, because the penalty was never the weapon that mattered. Section 33A of the Water Act and Section 31A of the Air Act empower the Board to direct the closure, prohibition or regulation of any industry, and expressly to direct the stoppage or regulation of electricity, water or any other service. No amendment touched those sections. The Board does not need to win a case. It writes to the Maharashtra State Electricity Distribution Company, and the supply is cut.

The brothers were luckier than some. I filed the renewal application with an affidavit explaining the gap, the backlog of consent fees, and fresh analysis reports from an accredited laboratory, and we attended the hearing at the regional office in Pimpri. The Board granted consent in October 2022 with a bank guarantee of ₹2 lakh against compliance with its effluent conditions. The scooter manufacturer's vendor-audit team had, in the meantime, asked for the consent certificate as part of its annual supplier review, and received a photocopy of the expired one with the renewal acknowledgement stapled behind it.

The younger brother still has the closure notice. He keeps it pinned above the rectifier, next to the electricity bill.

The Reporting Entity

The Prevention of Money Laundering Act, 2002 does not bind every company. It binds a defined class called reporting entities, and the first thing to establish for any client is whether it belongs to that class. Section 2(1)(wa) lists them: banking companies, financial institutions, intermediaries such as stockbrokers and depositories, payment system operators, and persons carrying on a 'designated business or profession'. That last category is the one that grows. The government extends it by notification, and has done so steadily: dealers in precious metals and stones in 2020, real estate agents the same year, virtual digital asset service providers in March 2023.

On 3 May 2023 a notification reached me personally. Practising chartered accountants, company secretaries and cost accountants became reporting entities when, on behalf of a client, they carry out specified financial transactions. These include buying and selling immovable property, managing client money or securities, organising contributions for the creation or operation of companies, and buying or selling business entities. Ordinary filing work falls outside it. The day I helped a Kothrud client purchase a going concern, I fell inside it. I registered on the portal of the Financial Intelligence Unit, India (FIU-IND) that June, and I now keep a register I had not kept in twenty-one years of practice.

What the Act requires of a reporting entity sits in Section 12 and in the Prevention of Money-laundering (Maintenance of Records) Rules, 2005. The entity must verify the identity of its clients and of their beneficial owners, meaning the natural persons who ultimately own or control them. Since a March 2023 amendment to Rule 9, the threshold for a company is ten per cent of shares, capital or profits, down from twenty-five. It must keep a record of every transaction. Section 12 then requires both the transaction records and the identity records to be preserved for five years after the transaction or, for identity documents, five years after the business relationship ends. It must also report. A cash transaction report goes to FIU-IND by the fifteenth of the following month for cash transactions above ₹10 lakh, or a series of connected ones that together cross it. A suspicious transaction report goes within seven working days of the entity concluding that a transaction is suspicious. Rule 7 requires a Principal Officer to make those reports, and the 2005 Rules require a Designated Director to answer for the whole system. The law asks for a named person twice over.

In August 2023 a jeweller on Laxmi Road telephoned to ask whether a customer who wanted to pay ₹14 lakh in notes for a wedding set should be refused. Refusal is not what the Act requires. It requires identification, a record, and a report. He had assumed, as many do, that the obligation was to police the customer's morals. It is narrower than that, and more tedious. He had no Principal Officer and no FIU-IND registration. His son was appointed to the role the following week, chiefly because he was the only one in the shop who could operate the portal.

Failures are dealt with by the Director of FIU-IND under Section 13, who may issue a warning, direct compliance, or impose a monetary penalty of between ₹10,000 and ₹1 lakh for each failure. Each unreported transaction counts as a separate failure, and banks have received orders running into crores on that arithmetic. Section 70 makes every person in charge of a company's business liable for its contraventions unless they prove they did not know and took all due diligence.

The payments firm's CFO asked whether any of this applied to him. I told him the honest position. His firm holds no authorisation from the Reserve Bank of India as a payment system operator, so in my reading the statutory duty falls on its partner bank, which passes it down by contract. The bank's agreement, which he had not read since 2019, ran to thirty-one pages. Clause 14.3 required the firm to retain merchant KYC 'in a secure manner, accessible only to authorised personnel'.

Section 9 and Adequate Procedures

Until July 2018 Indian anti-corruption law punished people. The Prevention of Corruption Act, 1988 was written around the public servant who took a bribe and, more faintly, the individual who gave one. A company could profit from a bribe paid by its liaison agent and remain, as a legal person, untouched. The Prevention of Corruption (Amendment) Act, 2018, in force from 26 July 2018, changed that with a new Section 9.

Section 9 makes a commercial organisation guilty of an offence if any person associated with it gives or promises an undue advantage to a public servant, intending to obtain or retain business or an advantage in the conduct of business for that organisation. The organisation need not have known. Its directors need not have approved. An associated person is anyone who performs services for or on its behalf, and the Explanation to the section says the question is settled by all the relevant circumstances, not by the label on the contract. Employees are presumed to be associated persons. Agents, consultants and the man who 'handles the department' are caught by function. The penalty is a fine, with no upper limit stated in the Act.

Section 10 then reaches upward. Where the offence is proved to have been committed with the consent or connivance of a director, manager, secretary or other officer, that individual faces imprisonment of three to seven years and a fine.

There is one defence. Section 9(1) allows the organisation to prove that it had in place adequate procedures, in compliance with guidelines to be prescribed, designed to prevent persons associated with it from undertaking such conduct. Note the burden: the organisation must prove it. Note also the gap. As at 1 January 2026 the Central Government has not notified those guidelines, more than seven years after the section came into force. Practitioners, myself included, borrow from the guidance issued under the United Kingdom's Bribery Act, 2010, on which Section 9 was plainly modelled. That is a recommendation drawn from analogy, not a statement of Indian law.

In 2023 a civil contractor in Ranjangaon asked me to look at a single ledger head. It was called 'Liaison Expenses', it ran to ₹6,40,000 for the year, and it was paid in round sums to a former municipal employee who arranged building completion certificates for the contractor's industrial sheds. Nobody in the office could say what the money bought. The proprietor's son, who ran the company day to day, said, 'Madam, everyone in MIDC uses him. Without him file does not move.'

I told him what I tell every client in that position. I could not say what the agent did with the money, and neither could he, and Section 9 does not require him to know. It requires him to be able to show what he did to find out. We terminated the arrangement. The company then wrote down what it should have had: a policy forbidding payments to public servants, a written contract for every agent with an anti-bribery clause and an audit right, a register of gifts and hospitality, a rule that no consultant's fee be paid without an invoice describing the work, and a short training session for the site engineers, signed for. None of it guarantees the defence. All of it is evidence, and evidence is the only form good intentions take in a courtroom.

For the calendar, this chapter adds less by date than by trigger. Consents to operate are renewed before expiry, on the Board's application timelines. FIU-IND cash transaction reports go by the fifteenth of the following month, suspicious transaction reports within seven working days of the conclusion that a transaction is suspicious. Data breaches go to the Data Protection Board as the DPDP Rules require, once those provisions take effect. The anti-bribery register and training are reviewed annually, on a date the company sets for itself, because the law has not set one.

The Ranjangaon policy ran to four pages. The son read it at my desk, turned to the last one, and found the line for a signature beneath the words 'Compliance Officer'.

'Madam,' he asked, 'whose name I should put here?'