How Employee Data Gets Sold and Why Deleting It Takes 21 Emails

A cyber threat researcher asked one company to delete his team's data. It took 14 days and 21 emails. In this BSides Mumbai 2025 panel, he puts that experience to three CISOs and asks the obvious question: if the right to erasure exists, why is it almost impossible to use? The result is a practitioner's view of data privacy in India - not a reading of the statute, but the people who actually run consent and deletion processes explaining why your request stalls, and what India's DPDP Act has to enforce before that changes. The panel also traces a path most privacy discussions miss: contact-aggregation sites expose an organisation's structure and employee details, threat actors harvest them, and the result is targeted phishing - the "your CEO needs you to buy a gift card" message. Employee data sitting in a broker's database is an attack surface, not just a marketing nuisance. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ WHAT YOU'LL LEARN • Why data deletion requests stall in practice and how long they really take • What the DPDP Act changes compared to GDPR, from teams implementing both • Why GDPR consent became a tick-box exercise, and what DPDP does differently • Why consent today is effectively compulsory (the airline web check-in problem) • Why plain-language and vernacular consent matters in a country with 22+ languages • How aggregated employee data turns into targeted phishing campaigns • Why deleting data means deleting logs too & not just the application database • What enforcement actually needs: turnaround times by data category, and penalties ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ KEY TOPICS DPDP Act (India) | GDPR comparison | Right to erasure | Consent management | Data fiduciary obligations | Third-party and vendor risk | Data retention policies | Vernacular-language consent | Data brokers and phishing | Dark-web sale of PII ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ PANEL Sumit Kumar - CISO, IDBI Intech Limited https://www.linkedin.com/in/sumit-kumar-cissp-ccsp-cisa-cciso-iso-la-90427b53/ Aditya Thontakudi - CISO & Director, Prisma.ai https://www.linkedin.com/in/aditya-thontakudi-b24314108/ Prakash Salunkhe - CISO (Indian Operations), Prisma.ai https://www.linkedin.com/in/prakash-salunkhe-59686720a/ Moderated by Mudit Bansal - Threat Researcher, CloudSEK https://www.linkedin.com/in/heymudit/ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ABOUT THE SESSION "Data Privacy in the Digital Age: Balancing Rights, Risks and Responsibility" CxO Panel Discussion | BSides Mumbai 2025 BSides Mumbai is a community-driven cybersecurity conference bringing together practitioners, researchers and security leaders for open technical discussion. 🔗 Website: https://bsidesmumbai.in/ 🔗 LinkedIn: https://www.linkedin.com/company/bsidesmumbai 🔗 Instagram: https://www.instagram.com/bsidesmumbai/ 🔗 More talks from BSides Mumbai 2025: https://www.youtube.com/playlist?list=PLHVEFAazJLBU ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ If you work in security, privacy or GRC in India, subscribe for more sessions from BSides Mumbai and tell us in the comments how long your last data deletion request actually took. #dpdpact #dataprivacy #cybersecurity #bsides #mumbai #bsidesmumbai #infosec