In the digital age, personal data has become a valuable asset, driving innovation and economic growth across industries. However, the misuse of personal data has also raised concerns about privacy and security. To address these issues, the Indian government has introduced the Digital Personal Data Protection Act, which aims to regulate the collection, storage, and processing of personal data. In this blog, we will explore how this legislation will impact various industries in India, including healthcare, pharmaceuticals, financial services, telecommunications, and e-commerce.

1. Healthcare and Pharmaceuticals:

The healthcare industry is one of the most data-intensive sectors, as it deals with sensitive patient information. The Digital Personal Data Protection Act will have several significant impacts on healthcare:

a) Data Security: Healthcare providers and organizations will need to implement robust data security measures to protect patient data from breaches. This includes encryption, access controls, and regular audits.

b) Consent Management: Obtaining patient consent for data processing and sharing will become more critical. Healthcare providers will need to establish clear procedures for obtaining and managing consent.

c) Research and Development: The Act may make it more challenging for pharmaceutical companies to access patient data for research purposes. This could impact drug development and medical research.

d) Marketing Practices: The Act will impose restrictions on targeted advertising and profiling based on personal data. Pharmaceutical companies may need to revise their marketing strategies.

e) Clinical Trials: Access to patient data for clinical trials and post-marketing surveillance may become more cumbersome due to stringent data protection requirements.

f) Drug Safety: Ensuring the safety of pharmaceutical products will require comprehensive data management practices to track adverse events and conduct pharmacovigilance.

• Financial Services:

The financial services sector deals with vast amounts of personal and financial data. The Digital Personal Data Protection Act will impact this industry as follows:

a) Enhanced Security: Banks and financial institutions will need to enhance their cybersecurity measures to protect customer data. Non-compliance could result in hefty fines.

b) Customer Consent: Obtaining explicit consent for data processing and sharing will be crucial in financial services. Customers will have more control over their data.

c) Compliance Costs: Implementing the necessary data protection measures and compliance procedures will incur significant costs for the industry.

• Telecommunications:

Telecom companies are major custodians of personal data, including call records, location data, and customer profiles. The Act will influence this industry in several ways:

a) Data Localization: Telecom companies may need to store data locally to comply with the Act’s provisions. This could lead to infrastructure investments.

b) Transparency: Telecom providers will need to be transparent about data collection practices and obtain customer consent for data usage.

c) Regulatory Compliance: Ensuring compliance with data protection regulations will be a priority, and companies will need to invest in compliance efforts.

• E-Commerce:

E-commerce platforms rely heavily on user data for personalized shopping experiences and marketing. The Digital Personal Data Protection Act will impact this industry in the following ways:

a) Data Monetization: E-commerce companies will need to re-evaluate their data monetization strategies and potentially seek alternative revenue sources.

b) User Consent: Obtaining clear and informed consent for data collection and usage will be essential for e-commerce platforms.

c) Customer Trust: Building and maintaining trust with customers by safeguarding their data will become a competitive advantage.

The Digital Personal Data Protection Act in India represents a significant step towards protecting individuals’ privacy and personal data. While it introduces much-needed safeguards for consumers, it also poses challenges for various industries. Healthcare, pharmaceuticals, financial services, telecommunications, and e-commerce will need to adapt to the new data protection landscape by investing in robust data security, consent management, and compliance measures. Ultimately, those who can navigate these changes while maintaining customer trust will thrive in the evolving digital economy.

In today’s fast-changing online world, keeping personal information safe is really important. More and more, people’s private data is being exposed due to hacks and breaches. Because of this, governments worldwide are making strict laws to protect people’s sensitive information. India is also doing this with the Digital Personal Data Protection Act. What’s special about this law is that it applies to foreign companies that give services to people in India as well. In this blog, we will talk about the main parts of the Digital Personal Data Protection Act and how it makes sure that foreign companies follow the rules.

The Digital Personal Data Protection Act, often referred to as the DPDPA, is India’s comprehensive framework for regulating the processing, storage, and sharing of personal data. Its primary objective is to establish robust data protection practices, promote transparency, and grant individuals greater control over their personal information. The act draws inspiration from global standards, such as the European Union’s General Data Protection Regulation (GDPR), while catering to India’s unique socio-economic and technological landscape.

Extraterritorial Application

The term “extraterritorial application” refers to the legal principle that a particular law can be enforced beyond the borders of a specific country or territory. In the context of the Digital Personal Data Protection Act (DPDPA) in India, extraterritorial application means that the provisions and regulations outlined in the DPDPA apply not only to entities and individuals within India but also to foreign entities that offer their services to individuals within India.

One of the most noteworthy aspects of the DPDPA is its applicability to foreign entities. The act extends its reach beyond Indian borders, encompassing foreign companies that offer their services to individuals within India. This provision ensures that individuals’ data is protected, irrespective of where the service provider is located. This means that foreign social media platforms, e-commerce websites, and digital service providers that interact with Indian users must comply with the DPDPA’s regulations.

In simpler terms, even if a company is based outside of India, if it provides services to people within India and collects or processes their personal data, it is still subject to the regulations and requirements of the DPDPA. This is a significant step taken by the Indian government to ensure the protection of individuals’ personal data, regardless of where the company operating the service is located.

Key Provisions Affecting Foreign Entities:

• Data Localization: The DPDPA mandates the storage of critical personal data within Indian servers. This requirement aims to have better control over data access, enhance security, and prevent unauthorized cross-border data transfers.

• Consent Mechanism: Foreign entities must obtain explicit and informed consent from individuals before collecting or processing their personal data. This empowers users with the right to decide how their data is used.

• Data Processing Guidelines: The act lays down specific guidelines for the lawful processing of personal data, including principles related to purpose limitation, data minimization, and accuracy.

• Data Transfer: If foreign entities wish to transfer personal data outside India, they must adhere to the DPDPA’s cross-border data transfer provisions. Adequate safeguards and mechanisms to ensure data protection during transfers are mandatory.

• Data Protection Officer (DPO): Foreign entities falling under the act’s purview must appoint a Data Protection Officer in India. This individual serves as a point of contact for data-related matters and compliance.

Ensuring Compliance from Foreign Entities:

The DPDPA employs a multi-tiered approach to ensure compliance from foreign entities:

• Penalties and Fines: Non-compliance can lead to significant financial penalties, which incentivizes foreign companies to adhere to the regulations.

• Regular Audits: Regulatory authorities conduct periodic audits to assess compliance levels and rectify any deviations.

• Individual Rights: The act grants Indian individuals the right to seek legal recourse if their data privacy rights are violated, even by foreign entities.

The Digital Personal Data Protection Act signifies India’s commitment to safeguarding individuals’ personal data in an increasingly interconnected digital world. Its extraterritorial application ensures that foreign entities providing services to Indian users are held accountable for data protection. As the act’s provisions are rolled out, it’s imperative for both domestic and foreign entities to understand and implement the necessary measures to comply with this groundbreaking legislation, ultimately fostering a more secure and privacy-respecting online environment.

Comply with India’s Data Protection Act While Serving Your Indian Customers. Contact us now

In today’s digital world, keeping personal information safe is really important. Countries all over the world are making laws to protect people’s private information and make sure they stay safe online. India is also doing this by bringing in the Digital Personal Data Protection Act. Now, let’s take a closer look at this topic and see what these definitions mean for the law.

The Digital Personal Data Protection Act recognizes the diverse range of entities that handle personal data. The definition of “person” is expansive, it includes not only individuals but also various legal entities. This inclusive definition ensures that all entities that process personal data, irrespective of their nature, are accountable under this act.

The definition of “person” in the act is comprehensive and includes the following entities:

• Individuals: The simplest part to understand is that people have always been considered as data subjects, and they should have their privacy rights respected.

• Hindu Undivided Family: This understanding shows that India has many different cultures and families, and the law wants to keep their data safe too.

• Companies and Firms: Modern businesses rely heavily on personal data for various purposes. Recognizing them as “persons” emphasizes the importance of responsible data handling within the corporate world.

• Associations and Bodies of Individuals: These entities, whether incorporated or not, often deal with personal data for various activities like clubs and organizations. By including them in the definition, the act ensures their compliance with data protection standards.

• The State: This important addition acknowledges that even the government deals with people’s private information. It emphasizes that the government needs to keep this data safe and make sure people trust them.

• Artificial Juristic Persons: Entities that don’t fall under the previous categories, such as non-profit organizations or trusts, are covered by this sub-clause. This ensures that all possible entities that handle personal data are within the act’s purview.

The inclusion of “State” within the definition of “person” has noteworthy implications for the act. It signifies that government bodies and institutions are subject to the same data protection obligations as private entities. This inclusion aligns with the principle that “data protection is a fundamental right, irrespective of who processes the data”.

Furthermore, by clearly including different types of individuals within the meaning of the word “person,” this law aims to include a wide range of people who handle data. This shows that the law is meant to apply to many different kinds of organizations that deal with data, including both the traditional and emerging players.

The Digital Personal Data Protection Act is a strong law that defines terms like “State” and “person” very carefully. This law creates a strong base to protect people’s personal information in the digital era. It’s important because it recognizes many different kinds of groups that work with personal data. This shows that keeping data safe is important for everyone in society, no matter what they do. This way of thinking helps keep people’s privacy safe and makes sure that everyone who uses data does it responsibly. As India moves ahead with its digital changes, this law’s clear definitions will be very important in making sure that digital spaces are safe and respect people’s privacy.

In today’s hyper-connected world, where digital interactions have become an integral part of our lives, the protection of personal data has emerged as a critical concern. As India undergoes a digital transformation, the need to ensure the security and privacy of personal data has led to the formulation of comprehensive data protection regulations. In December 2019, India introduced the Personal Data Protection Bill (“PDPB 2019”), following the example of many other significant data privacy laws being introduced worldwide.

The cornerstone of personal data protection in India is the Digital Personal Data Protection Bill (DPDP). This bill aims to establish a robust framework for the protection of digital personal data and governs how organizations collect, process, store, and share personal information. Drawing inspiration from global best practices such as the European Union’s General Data Protection Regulation (GDPR), the PDPB is designed to empower individuals and person (Dive into our blog for a deeper understanding of the inclusive scope defined under ‘Person’) to ensure their data privacy rights are respected.

The Data Protection Bill of 2021 & 2022

The Data Protection Bill of 2021 (DPB 2021) introduced substantial revisions to its predecessor. Notably, it expanded its scope to cover both personal and non-personal data and imposed stringent guidelines for reporting data breaches. DPB 2021 was poised to become the Data Protection Act of 2021.

However, in August 2022, the Indian government withdrew the bill after three years of discussion and 90 sittings. The decision was based on its failure to meet international standards and emerging challenges.

On November 18, 2022, the Indian Government released a draft of the Digital Personal Data Protection Bill of 2022 (DPDP 2022) for public comments and consultations until January 2, 2023. After extensive deliberations, this revised bill, now known as the Digital Personal Data Protection Act of 2023 (DPDP Act), was presented in the Indian Parliament on August 3, 2023. It was passed by the Parliament on August 9 and officially gazetted on August 12, 2023.

The primary objective of the DPDP Act is to establish standards for the responsible handling of digital personal data, ensuring the protection of individuals’ privacy rights while allowing for lawful data processing. The Act delineates the duties of data fiduciaries, the rights of data principals, and the consequences of non-compliance.

To whom this act applies

The DPDP Act is a set of rules that apply when dealing with personal information, whether it was first collected digitally or in other ways and then turned into digital data. In simple terms, this act applies to digital personal data and not on physical personal data. However, these rules don’t cover using data for personal or domestic purpose nor does it cover personal data made publicly available by the data subject or under legal authority.

For example  (from the act) : X, an individual, while blogging her views, has publicly made available her personal data on social media. In such case, the provisions of this Act shall not apply.

Key Definitions: –

Board

Board means the Data Protection Board of India established by the Central Government for the purposes of this Act.

Child

DPDP Act defines a child as an individual who has not yet completed 18 years of age.

Consent Manager

Any individual that is registered with the Data Protection Board of India who acts as a single point of contact to enable the data subject to give, manage, review, and withdraw consent through an accessible, transparent, and interoperable platform.

Data Fiduciary

DPDP Act refers to data controllers as “Data Fiduciaries.” A data fiduciary is any person or group of persons who determine the purposes and means of processing the personal data of individuals.

Data Principal

“Data Principals” are essentially data subjects to whom the personal data relates or belongs. If a data principal is a child (an individual under the age of 18 years) or a person with a disability, then the parents or lawful guardian of such a child/individual becomes the data principal.

Person

According to DPDP Act, person means any of the following entities:

• an individual;
• a Hindu undivided family;
• a company;
• a firm;
• an association of persons or a body of individuals, whether incorporated or not;
• the State; and
• every artificial juristic person.

Personal Data

Personal data means any data about an individual who is identifiable by or in relation to such data.

Personal Data Breach

Any unauthorized processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction of or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data.

Significant Data Fiduciary

Any data fiduciary or class of data fiduciaries may be designated by the Central Government as a “Significant Data Fiduciary” after taking into account the volume and sensitivity of personal data processed, risk of harm to the data principal or electoral democracy, impact on national sovereignty and security, and public order.

Impact on Foreign Companies (Another blog link)

The DPDP Act applies extraterritorially when the processing of digital personal data is related to offering goods or services to data principals within India. It allows the Central Government to exempt certain data fiduciaries or classes based on the volume and nature of personal data processing from specific provisions.

Penalties for Non-compliance

Non-compliance with data protection safeguards, breach notification, and children’s data processing obligations may result in substantial fines for data fiduciaries and data processors. Data principals who fail to fulfil their duties under the Act may face fines as well. (link to penalties blog)

Key Provisions of the DPDP Act

• Data Principal Rights: The bill grants data principals (individuals whose data is being collected) various rights, including the right to access their data, the right to correction, the right to be forgotten, and the right to data portability. This places the control of personal data back into the hands of individuals.

• Data Fiduciary Responsibilities: Organizations handling personal data, known as data fiduciaries, are required to follow stringent data protection measures. They must obtain explicit consent before collecting and processing personal data, and they are obligated to implement data protection safeguards.
• Sensitive Personal Data: The bill categorizes certain types of data (such as financial data, health data, etc.) as sensitive personal data. The processing of such data comes with additional obligations and safeguards to prevent misuse.

• Data Protection Authority (DPA): The bill proposes the establishment of a Data Protection Authority to oversee and enforce data protection laws. The DPA will have the authority to investigate breaches, issue penalties, and provide guidance on data protection practices.

As India moves towards a more digitized society, the protection of personal data must remain a top priority. To ensure the success of the PDPB and the overall data protection regime, several steps can be taken:

• Conduct Data Mapping and Assessment:  Analyse data inventories and categorize where digital personal data about person is stored.

• Awareness and Education: The government, private sector, and civil society should collaborate to raise awareness about data protection rights and best practices.

• Capacity Building: Organizations should invest in building data protection capabilities, including robust cybersecurity measures, to safeguard sensitive information.

• International Cooperation: Collaborating with international stakeholders can help India learn from global data protection experiences and harmonize its regulations with international standards.

• Manage Cross-Border Data Transfers: Identify instances of cross-border data transfer and fulfil the necessary data transfer requirements as mandated by the DPDP Act.

• Employee Training: Educate your employees and workforce on proper data processing methods and their roles in ensuring data protection.

• Transparent Privacy Policy: Develop a user-friendly privacy policy that clearly communicates the rights of data subjects without any ambiguity.

• Breach Response Plan: Prepare a comprehensive breach response plan, including breach notification procedures, to report any data breaches.

In our data-focused world, keeping personal info safe is super important. India’s Digital Personal Data Protection Bill is a big step in guarding people’s privacy. As it becomes law, the entities need to handle challenges and stay updated in the digital world.

Elevate your data protection strategy to the next level. Join us in safeguarding your digital assets with our expert services – your peace of mind starts here.

In today’s hyper-connected world, where digital interactions have become an integral part of our lives, the protection of personal data has emerged as a critical concern. As India undergoes a digital transformation, the need to ensure the security and privacy of personal data has led to the formulation of comprehensive data protection regulations. This blog delves into the landscape of digital personal data protection in India, exploring the regulatory framework, key provisions, challenges, and the way forward.

The cornerstone of personal data protection in India is the Digital Personal Data Protection Bill (DPDP). This bill aims to establish a robust framework for the protection of digital personal data and governs how organizations collect, process, store, and share personal information. Drawing inspiration from global best practices such as the European Union’s General Data Protection Regulation (GDPR), the PDPB is designed to empower individuals and person (Dive into our blog for a deeper understanding of the inclusive scope defined under ‘Person’) to ensure their data privacy rights are respected.

Key Provisions of the DPDP

• Data Principal Rights: The bill grants data principals (individuals whose data is being collected) various rights, including the right to access their data, the right to correction, the right to be forgotten, and the right to data portability. This places the control of personal data back into the hands of individuals.

• Data Fiduciary Responsibilities: Organizations handling personal data, known as data fiduciaries, are required to follow stringent data protection measures. They must obtain explicit consent before collecting and processing personal data, and they are obligated to implement data protection safeguards.

• Data Localization: The bill proposes the concept of data localization, which requires organizations to store a copy of Indian users’ personal data within the country. This measure aims to ensure easier regulation and control over data flows and prevent cross-border misuse.

• Sensitive Personal Data: The bill categorizes certain types of data (such as financial data, health data, etc.) as sensitive personal data. The processing of such data comes with additional obligations and safeguards to prevent misuse.

• Data Protection Authority (DPA): The bill proposes the establishment of a Data Protection Authority to oversee and enforce data protection laws. The DPA will have the authority to investigate breaches, issue penalties, and provide guidance on data protection practices.

Challenges

While the DPDP signifies a significant step towards enhancing data protection, certain challenges and concerns need to be addressed:

• Balancing Innovation and Regulation: Finding the right mix between encouraging new technology ideas and keeping data safe is tricky. Rules shouldn’t stop the digital economy from growing.

• Enforcement and Penalties: The effectiveness of the bill will depend on the enforcement of regulations and penalties for non-compliance. There is a need to ensure that the regulatory framework is robust enough to deter data breaches.

• Data Localization Impact: While data localization can enhance data control, it also has implications for cross-border data flows and international trade. Striking the right balance between data sovereignty and global collaboration is crucial.

The Way forward

As India moves towards a more digitized society, the protection of personal data must remain a top priority. To ensure the success of the PDPB and the overall data protection regime, several steps can be taken:

• Awareness and Education: The government, private sector, and civil society should collaborate to raise awareness about data protection rights and best practices.

• Capacity Building: Organizations should invest in building data protection capabilities, including robust cybersecurity measures, to safeguard sensitive information.

• International Cooperation: Collaborating with international stakeholders can help India learn from global data protection experiences and harmonize its regulations with international standards.

In our data-focused world, keeping personal info safe is super important. India’s Digital Personal Data Protection Bill is a big step in guarding people’s privacy. As it becomes law, the entities need to handle challenges and stay updated in the digital world.

Elevate your data protection strategy to the next level. Join us in safeguarding your digital assets with our expert services – your peace of mind starts here.