UPDATE: The Personal Data Protection Bill 2019 has been withdrawn by the Indian government after over three years of discussion. The Bill had attracted major criticisms from industry stakeholders, NGOs, privacy activists and tech platforms as it proposed strict rules for international data transfers and giving the Indian government the authority to request user data from businesses. The Government is now considering working on a new comprehensive legislation that would adequately capture needs and concerns of data privacy, cyber security, and overall digital ecosystem to meet the global privacy standard.
Back in December 2019, India followed in the steps of several major countries worldwide and introduced the Personal Data Protection Bill (PDPB). In the two years since then, the Bill has gone through some radical changes. The most important one is the inclusion of several provisions that would govern non-personal data as well.
The Data Protection Bill 2021, assented by President Murmu on Aug 12, 2023 after it was passed in Lok Sabha and Rajya Sabha, became an official part of India's legislature as the Data Protection Act 2023. It defines the rights of data principals (data subjects), the obligations of data fiduciaries (data handlers), and penalties for non-compliance.
Moreover, it establishes a Data Protection Authority that will have the power to enforce the law and ensure that all data fiduciaries operating in India or dealing with the data of Indian citizens are doing so within the confines of the law.
The Data Protection Bill is seen as a significant upgrade on the current Information Technology Act 2000 (IT Act 2000). In the years since the IT Act 2000’s formulation, technology has evolved tenfold, leaving a void in the legislature when dealing with issues related to social media and information being collected on Indian citizens online.
Scope of the Law
The Data Protection Act 2023 covers two distinct types of data. Additionally, it follows a similar approach to that of the GDPR (General Data Protection Regulation that is followed by European Union) and the CPRA (California Privacy Rights Acts, which will take effect from Jan 1, 2023) when it comes to who needs to comply with this new law.
The Digital Personal Data Protection Act, 2023 which lays down the obligations of entities handling and processing data as well as the rights of individuals. The Act proposes a maximum penalty of Rs 250 crore and minimum of Rs 50 crore on entities violating the norms.
The norms of the bill will apply to personal data collected within India from data principals online and personal data collected offline, but subsequently digitised. It will also apply to such processing outside India if it is for offering goods or services to individuals in India.
The bill provides for the processing of digital personal data in a manner “that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes”.
Key provisions of the Act
Firms dealing with user data must protect personal data even if it is stored with a third-party data processor
In case of a data breach, companies must inform the Data Protection Board (DPB) and users
Children’s data and data of physically disabled persons with guardians must be processed after consent from guardians
Firms must appoint a Data Protection Officer, and provide such details to users
The Centre retains the power to restrict the transfer of personal data to any country, or territory outside India
Appeals against DPB decisions to be heard by the Telecom Disputes Settlement and Appellate Tribunal
DPB may summon, examine people under oath, inspect books, and documents of companies working with personal data
DPB to decide on penalty after considering the nature and gravity of the breach, the type of personal data impacted
DPB may advise government to block access to an intermediary, if DPDP Bill provisions are breached more than twice
Penalties can go up to Rs 250 crore for a data breach, failure to protect personal data or inform DPB and users of the breach.
Material Scope
The Data Protection Act 2023 applies to both personal and non-personal data. The Bill defines "personal data" as any data related to the natural person that may identify those regarding characteristics, traits, attributes, and features. "Non-personal data" is defined as any data that is not personal in nature. It is the combination of all such information that can profile an individual.
Territorial Scope
As far as the territorial scope of the Data Protection Act is concerned, it applies to the processing of all personal data that has been "collected, disclosed, shared" within the territory of India or by a person that is under Indian law. Furthermore, it applies to all data fiduciaries that are not present in India if the collected data is used for any business purpose within India.
Obligations for Organizations Under DPB Law
Under the new Data Protection Bill, the organizations or "Data Fiduciary," as they're referred to in the Bill, have several obligations towards all data subjects. These responsibilities fall under the following categories:
1. Lawful Basis Requirements
Data fiduciaries can only use the processed data for the purpose stated when they first acquired data subject (data principal) consent. Moreover, there's a limit to the scale and extent of data that an organization can process. This information should be disclosed to the data subject in multiple languages within a practical limit.
Other provisions existing within the bill that allow processing of a data subject’s data when the following conditions are met:
Processing relates to personal data which are manifestly made public by the data subject
Processing is necessary for the establishment, exercise or defense of legal claims
Processing is necessary for reasons of substantial public interest
Processing is necessary for the purposes of medicine, the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services
Processing is necessary for reasons of public interest in the area of public health
Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
2. Consent Requirements
No data can be processed on a data subject without their express consent at the commencement of the data processing. Furthermore, consent would have to be of the data subject's free will after being reasonably informed of what information will be collected. If any sensitive personal data is to be collected, then consent will have to be obtained separately on each occasion.
Additionally, the consent notification will have to be specific about what information will be collected. The data subject will always retain the right to withdraw consent. The data fiduciary cannot compromise the goods' or services' quality based on the refusal of the data subject to provide consent to data collection. Similarly, the data fiduciary cannot refuse customers access to the goods or services based on their choice not to provide consent.
3. Privacy Policy Requirements
All data fiduciaries are required to prepare a robust privacy policy that would illustrate the managerial, organizational, technical, and business practice systems in use by the data fiduciary to anticipate, identify, and avoid harm to the data subject.
Other information required in the privacy policy includes the obligations of the data fiduciary, the technology used by the data fiduciary in processing the data subjects' data, the business interests of the data fiduciary, the mechanisms in place to protect the data subjects' data, and how the data subject is protected at every data processing stage.
4. Security Requirements
Under Section 24, all data fiduciaries are required to ensure the use of the most robust encryption and de-identification methods. The data fiduciaries are also required to formulate ways to prevent the misuse, unauthorized access to, modification, disclosure, or destruction of personal data. Lastly, the data fiduciary must carry out thorough assessments of its protection measures regularly and keep the DPA informed of these assessments.
5. Data Breach Requirements
In case of a data breach, the primary data handler in charge of the processed data must inform the relevant supervisory authority about the scale of the breach and damage within 72 hours of the breach being detected.
6. Data Protection Officer Requirement
Under Section 30 of the Data Protection Act 2023, all data fiduciaries must hire a Data Protection Officer (DPO) to ensure appropriate data protection measures are in place as per the Bill within the organization. The DPO must be a senior-level employee within the organization
7. Data Protection Impact Assessment
Under Section 27 of the Data Protection Act 2023, all data fiduciaries are required to carry out an extensive data protection assessment if they plan to use sensitive personal data or use large-scale profiling techniques.
Once the data fiduciary has carried out the assessment, the DPO must review the assessment and submit it to the DPA with his findings and recommendations. At this point, the DPA can direct the data fiduciary to cease its data processing activities if the assessment is unsatisfactory in its judgment.
8. Record of Processing Activities
The Bill also requires the data fiduciary to keep a detailed and up-to-date record of the following:
Important operations in the data life-cycle
The data protection impact assessments carried out
9. Cross Border Data Transfer Requirements
The Bill is ambiguous about cross-border data transfer requirements. The Bill does require the data fiduciary to inform the data principal if they have any intention to transfer their data outside the territory of India. Moreover, the DPA also has the right to monitor the cross-border data transfers of any data fiduciary and suspend or discontinue such transfer if the DPA deems a fiduciary to be in non-compliance with the necessary data protection provisions.
Data Subject Rights
The data subjects, or data principal, as they're referred to in this Act, have the following rights:
1. Right to Information
The data principal has the right to know what information the data fiduciary has collected on them. If the data fiduciary has shared the data principal's information with other third parties, the principal must be informed of this. Furthermore, the data fiduciary's responsibility is to ensure that any information they provide to the data principal is easily understandable.
2. Right to Correction & Erasure
In addition to knowing what information is being collected on them, the data principal has the right to know the purpose for which the data fiduciary used their information. As such, the data principal has the right to request the correction of inaccurate, incomplete, or misleading information. The data principal can also request an update of their data in addition to having the right to request deletion of their data.
However, if the data fiduciary disagrees with the data subject's request for correction, completion, update or erasure, they can request such a request with proper justification in writing for the rejection. The data principal can then follow up further request details on the matter.
3. Right to Portability
The data principal has the right to request whatever data has been collected on them by the data fiduciary in a commonly used and machine-readable format. This includes information that may have been collected on the data principal in the course of the provision of services by the data fiduciary.
4. Right to be Forgotten
The data principal has the right to request a restriction to the data fiduciary's continued use or processing of personal data. The data principal can request an end to their data being processed if the purpose of collecting the data is no longer being served.
Regulatory Authority
The Data Protection Act 2023 calls on the central government of India to establish a regulatory authority called the Data Protection Authority (DPA) of India via a notification. This authority will hold power to enforce this piece of legislation across the country. It will constitute a chairperson and six full-time members, which the central government will choose based on the recommendations of the Selection Committee.
The DPA is to be headed by the Cabinet Secretary. The Attorney General of India, the Secretary to the Government of India in Legal Affairs, the Secretary to the Government of India in Electronics and Information Technology, an independent expert nominated by the central government in data protection, information technology, data management, data science, data security, cyber and internet laws, and public administration, a Director of an Indian Institutes of Management, and a Director of the Indian Institutes of Technology.
The members and chairperson of the DPA shall serve a term of 5-years or till they reach the age of 65, whichever is earlier, and will not be eligible for re-appointment.
Penalties for Non-compliance
The Bill is explicit when it comes to stating the penalties for data fiduciaries if they are in non-compliance or offense of any provisions in this Bill. These can include but are not limited to:
Failure to respond promptly in response to a data breach
Failure to register with the DPA
Failure to undertake a data protection impact assessment
Failure to appoint a Data Protection Officer (DPO)
Processing personal data of children without consent
Transfer of personal data without proper permission from the DPA
In the event of an offense, the data fiduciary will be penalized five thousand Indian rupees every day until they rectify the offense. This amount may reach up to ten lakh rupees in the case of major data fiduciaries and five lakh rupees in other cases.
If a data fiduciary fails to provide timely reports or information to the DPA when requested, it can be fined ten thousand rupees per day. This amount may reach up to twenty lakh rupees in the case of major data fiduciaries and five lakh rupees in other cases. Similarly, if a data fiduciary fails to comply with any DPA directives, they may be fined twenty thousand rupees per day. This amount can reach up to two crore rupees.
How an Organization can operationalize the Law: Organizations or data fiduciaries, as the Act refers to them, have to ensure the following points if they wish to be compliant with the new data protection law in India:
Have regular data protection assessments on existing infrastructure to identify if there are any lapses and possible areas that need improvement
Ensure that the data principals are adequately aware of their rights and make it easier for them to use these rights to request access, alteration, deletion, and modification of the data collected on them
Hire a competent Data Protection Officer who understands the intricacies of the Data Protection Act 2023 and can help the data fiduciary achieve compliance with the new law
Ensure that the data fiduciary's employees are adequately aware of their responsibilities under the new Act
Catalog all the personal and non-personal data collected on data principals within India
Ensure that instant breach notifications are enabled in case a data breach occurs
KnitLogix is offering services to its clients as their Anytime Anywhere Cloud Partner
How can Knitlogix do Cloud Technology and Security Help?
India's Data Protection Act 2023 holds special significance considering how India has long been a highly lucrative market for some of the biggest companies in the world. Being compliant with this new law could give companies the competitive edge they need to outperform their competitors.
We assist our clients to outgrow their past, build their present and create their bright future in the cloud. We marry its technological brilliance with its domain expertise to catalyze change and deliver results. KnitLogix is on its path to becoming a global leader in Cloud Technology and Digital Transformation. KnitLogix considers its clients as its partners whom they help to simplify, strengthen, transform and redefine their businesses with the help of Cloud Technology. For the client, KnitLogix is it’s anytime, anywhere cloud partner. KnitLogix offers a host of products and Managed Services, all firmly rooted in Cloud Technology.
Why Knitlogix? Are you on the lookout for an anytime, anywhere cloud partner to address all the cloud technology needs of your organization? Are you in search of a Supply chain Technology solutions provider who can offer you the state of the art IVT & MRO integration solutions? Then, KnitLogix is your one stop shop which will offer you all these and much more. Are there more compelling reasons beyond these to reach out to KnitLogix?
Indeed KnitLogix serves your needs for a certified solution that can assure permanent data erasure when disposing or returning your IT assets. With KnitLogix Verified Secure Data Erasure Solution, you may securely wipe data beyond data recovery from all kinds of storage devices & generate tamper free audit trails. Our trusted automated reporting helps you to meet internal & external data security audit requirements and comply with global data privacy laws or regulations like – EU GDPR, GLB, SOX, HIPAA, ISO27001, PCI DSS etc.
Benefits of Hardware Security Keys...
1. Convenience
2. Longer codes
3. Simple to relocate
4. Difficult to hack How to set up your Yubikey? Where to buy your Yubikey? To know more details visit http://bit.ly/3A9PgqV
You’ll need a clear and successful approach to fulfill your security objectives. Using a security framework like NIST (National Institute of Standards and Technology, US Department of Commerce) will aid you in every step of your security journey, and opting for integrated solutions will make things easier while reducing blind spots. All five functions (Identify, Protect, Detect, Respond, and Recover) of the NIST framework are covered by KnitLogix.
Employee records, customer information, loyalty schemes, transactions, and data collection are all examples of key pieces of information that businesses typically maintain. This is to prevent third parties from misusing the information for fraudulent purposes, such as phishing scams and identity theft.
The following are examples of common data that your company might keep:
Name
Address
Phone number
Bank / Credit card details
Health Information
This information could pertain to your existing employees and their partners or relatives; shareholders, business partners, clients; customers, and other members of the public.
Businesses must follow specific rules in order to protect all of this data in compliance with the Data Protection Act.