Crossword Grid
Select a cell to begin
Privacy Enhancing Technologies — PET Reference
Federated Learning
FL · Machine Learning PET
Trains AI and ML models across multiple decentralised devices or servers holding local data samples — without ever exchanging the raw data itself. Each device trains a local model and shares only parameter updates.
DPDP Use Case
Banks and NBFCs can train fraud-detection models on customer transaction data across branches without centralising personal data. Directly satisfies DPDP §5 data minimisation and §8 security obligations. RBI's Model Risk framework also rewards decentralised training architectures.
Data Masking
Masking · Substitution PET
Replaces sensitive fields (PAN, Aadhaar, mobile numbers) with fictitious but realistic values — preserving data format and referential integrity for analytics and testing without exposing real identifiers.
DPDP Use Case
Development and UAT environments for core banking systems must not contain real personal data. Masking + Tokenisation Coverage is tracked in CreativeCyber's DPDP platform (dedicated module). Also satisfies DPDP §8 and RBI DPSC Control 5.3.
Synthetic Data Generation
SDG · Generative PET
AI-generated datasets that statistically mirror real personal data distributions but contain no real individuals. Structurally privacy-safe: no data principal can be re-identified from synthetic records.
DPDP Use Case
BFSI firms conducting research, backtesting credit models, or building AI training datasets can use synthetic data under DPDP's research exemption without triggering consent obligations. Dramatically reduces regulatory exposure for data science teams.
Encryption
AES-256 · TLS · At-Rest & In-Transit
The foundational cryptographic PET. Converts personal data into ciphertext that is computationally infeasible to read without the corresponding key. Applies at rest (databases, backups) and in transit (APIs, network channels).
DPDP Use Case
DPDP §8 mandates "reasonable security safeguards" — encryption is the baseline. RBI DPSC and SEBI CSCRF both specify AES-256 at rest and TLS 1.2+ in transit. CreativeCyber's Masking & Tokenisation Coverage module tracks encryption posture across all data stores.
Tokenisation
Token Vault · Format-Preserving
Replaces a sensitive value (card number, Aadhaar) with a non-sensitive token that maps back to the original only through a secure token vault. Unlike masking, tokenisation is reversible — only by authorised systems with vault access.
DPDP Use Case
RBI's card-on-file tokenisation mandate directly embeds this PET in payment infrastructure. Under DPDP, tokenisation helps data fiduciaries minimise the volume of identifiable data in their environments, reducing liability in the event of a breach.
Pseudonymisation
ISO 29101 · Reversible Anonymisation
Replaces direct identifiers with artificial aliases. The mapping between alias and real identity is stored separately and access-controlled. Unlike anonymisation, pseudonymisation is reversible — personal data rules still apply to pseudonymised datasets.
DPDP Use Case
DPDP §2(t) excludes "anonymised data" from the Act's scope, but pseudonymised data remains in scope. Fiduciaries using pseudonymisation for analytics must still maintain ROPA entries and honour DSAR requests. Pseudonymisation reduces breach impact but does not eliminate DPDP obligations.
PET × DPDP Use Case Mapping
| PET | DPDP Obligation Addressed | BFSI Use Case | Sector Badge |
|---|---|---|---|
| Federated Learning | §5 Data Minimisation · §8 Security · AI Risk Posture | Cross-branch fraud detection model training without centralising transaction data | BankingNBFC |
| Masking | §8 Reasonable Security Safeguards · ROPA accuracy | Sanitising core-banking test environments; UAT data for neo-banks | All BFSI |
| Synthetic Data | §3 Research Exemption · §5 Minimisation | Credit-scoring model training without real borrower PII; GenAI BFSI app development | LendingInsurTech |
| Encryption | §8 Baseline Security · Breach Notification §9 | AES-256 at rest for customer data warehouses; TLS 1.3 for API-based data sharing under DPDP | All BFSI |
| Tokenisation | §8 Security · §5 Minimisation · Breach Impact Reduction | RBI CoFT mandate; Aadhaar tokenisation in onboarding flows; payment data de-scoping | PaymentsBanking |
| Consent Management | §6 Consent · §7 Legitimate Uses · §12 Grievance | Granular, purpose-specific consent capture at customer onboarding; audit trail for regulators | All BFSI |
| ROPA (Record-Keeping) | §8 Accountability · SDF obligations · DPA audit readiness | Documenting all 160+ processing activities across BFSI operations; CSITe filing preparation | SDFAll Fiduciaries |
| DSAR Process | §11 Right to Access · §12 Grievance · §14 Erasure | Automated DSAR fulfillment within 30-day statutory window; integrated grievance officer workflow | All BFSI |