CY SYSTEMS Blog

Loading

Category DPDP2023

Blog , Compliance , CySYS , DPDP2023

Digital Personal Data Protection Bill 2023 in India: A Comprehensive Guide

The Union Cabinet has given its nod to the Digital Personal Data Protection (DPDP) Bill 2023 draft, which will be introduced in the upcoming monsoon session of Parliament (July 20 to August 11).

The main objective of the bill is to lay down a holistic legal framework that governs the collection, storage, processing, and transfer of personal data by entities, both governmental and private, operating within the boundaries of India.

The bill mandates the payment of fines for non-compliance with requirements such as seeking consent for the processing of data, making it crucial for organizations that handle personal data to understand how it will work.

This blog will tell you everything you need to know about the bill and provide useful steps that will help your organization prepare for its implementation.

Understanding the Key Aspects of the Bill

The DPDP Bill is all about protecting personal data in the digital age. It applies to any data about an individual that can identify them, whether it’s collected online or offline and then digitized. 

The DPDP Bill extends its reach to digital personal data processing that happens outside India, but only if it involves profiling or offering goods/services to individuals within India. In other words, any organization in any part of the world, which handles the personal data of Indian citizens, has to adhere to it.

Now, let’s discuss the responsibilities of those who handle personal data, known as data fiduciaries. First, they must process personal data lawfully and with the consent of the person it belongs to, also known as the data principal. They need to clearly communicate what kind of personal data they collect and for what purposes. And when it comes to children, they must get verifiable consent from their parents. If they don’t follow these rules, they could face penalties.

The DPDP Bill takes data breaches seriously. Both the data fiduciary and any data processor they work with must notify the Data Protection Board and the affected individuals in case of a breach. 

Data principals, the individuals whose personal data is being processed, have certain rights under the DPDP Bill. Some of these rights include:

A) The right to know if their data is being processed

B) The right to know what kind of data is involved

C) The right to know who it’s being shared with

D) The right to request corrections or deletions if the data is no longer necessary

If they’re not satisfied with how their concerns are addressed, they can file a complaint with the Data Protection Board.

Provisions of the Bill

This DPDB Bill 2023 will extend its legal umbrella to cover all online data (and offline data which is digitized) in India, ensuring comprehensive protection for personal information.

The contents of the Bill, the first draft of which was published in July 2018, will only be disclosed after the Parliament session. 

Here is a look at the key highights of the bill based on what we learnt from the previous draft:

Government supervision

A Data Protection Board, established by the Union government, will regulate personal data matters, primarily enforcing compliance and imposing penalties. The government will influence the board’s composition, terms of service, and overall implementation of the law.

Data storage

Unlike previous laws, the draft bill doesn’t require exclusive data storage in India but restricts cross-border data transfer to countries authorized by the Indian government.

Monetary penalties

The draft bill allows only monetary penalties for breaches or non-compliance, ranging from INR 50 crore to INR 250 crore, with a maximum penalty of INR 500 crore for significant data breaches.

Data of minors

Parental consent is mandatory for individuals under 18, although concerns exist about differentiating consent between toddlers and adolescents, the potential impact on personal development, and the violation of the Rights of the Child.

Data collection

Specific limitations on data collection have been removed, allowing data fiduciaries to collect personal data with the consent of the data principal while informing them of the relevant purpose for data collection.

Government exemptions

Government bodies can be exempted from regulations for reasons such as sovereignty, security, foreign relations, and public order, without specific criteria for exemptions.

Limited information requirements

The draft narrows the scope of information provided to data principals, focusing on personal data sought and the purpose of data processing, rather than extensive rights, grievance mechanisms, retention time, and data sources.

Missing provisions

It should be noted that the draft lacks the inclusion of two important provisions:

Data portability

The right to data portability empowers data principals to access and examine their personal data in a structured format. It enables them to choose the platforms on which they want their data to be shared, eliminating the hassle of providing all their personal data again when switching platforms.

Foregone information

The omission of the right to foregone information creates confusion between the general right to erasure and the right to be forgotten, which could potentially undermine freedom of speech and expression for others.

Seven Core Pillars of the Bill

How it will affect Businesses and Organizations

The Data Protection Bill will have significant impacts on businesses and organizations that collect and process the personal data of Indian citizens. Here are some key areas of impact:

Compliance and Legal Obligations

The bill establishes compliance requirements and legal obligations for data-handling entities. Businesses and organizations will need to ensure they adhere to these obligations, such as obtaining consent for data processing, maintaining data accuracy, implementing security measures, and establishing mechanisms for data breach notification. Non-compliance can result in penalties and reputational damage.

Data Governance and Accountability

Robust data governance practices and accountability is a requisite of the bill. Organizations will need to establish policies and procedures for data handling, including data minimization, purpose limitation, and storage limitation. They will also need to appoint Data Protection Officers and demonstrate accountability in their data processing activities.

Consent Management

Obtaining valid consent from individuals for processing their personal data is mandated by the bill. Businesses and organizations will need to review their consent management practices to ensure they meet the bill’s requirements. They will also need to provide clear and transparent information to individuals regarding the purpose and extent of data processing.

Data Localization and Cross-Border Transfers

The bill addresses the issue of data localization, specifying that certain categories of personal data may need to be stored within India. This may impact businesses that operate across borders or rely on international data transfers. They will need to evaluate their data storage and transfer practices to ensure compliance with the bill’s provisions.

Impact on Business Models and Innovation

The bill’s provisions may require businesses and organizations to make changes to their existing business models and data processing practices. It may impact data-driven innovation, as stricter regulations and requirements may introduce additional complexities and limitations on data usage. Organizations will need to assess the impact on their operations and adapt accordingly.

Increased Focus on Data Security 

The enforcement of proper data security and protection is highlighted by the bill. Businesses and organizations will need to implement appropriate technical and organizational measures to safeguard personal data from unauthorized access, breaches, and misuse. They may need to invest in robust cybersecurity infrastructure and regularly review their security practices.

Steps to take in preparation for DPDP Bill implementation

In order to be prepared for the bill’s implementation, organizations can take the following steps.

Conduct a data audit

Start by conducting a comprehensive audit of the personal data your organization collects, processes, and stores. Identify the types of data you handle, the purposes of processing, and the legal basis for processing.

Review and update policies

Review your existing privacy policies, consent mechanisms, and data-handling procedures. Update them to align with the requirements of the data protection bill, including provisions on consent, data minimization, purpose limitation, and data subject rights.

Implement strong data governance 

Establish robust data governance practices within your organization. This includes defining roles and responsibilities for data protection, appointing a Data Protection Officer (if required), and implementing internal policies and procedures to ensure compliance with the bill’s provisions.

Obtain valid consent

Review your consent management processes to ensure they meet the bill’s requirements. Implement mechanisms to obtain valid and informed consent from individuals, clearly explaining the purpose, extent, and duration of data processing. Ensure individuals can easily withdraw consent if they choose to do so.

Enhance data security measures

Strengthen your data security measures to protect personal data from unauthorized access, breaches, and misuse. Implement appropriate technical and organizational safeguards, such as encryption, access controls, regular vulnerability assessments, and employee training on data security best practices.

Develop a data breach response plan

Prepare a comprehensive data breach response plan that outlines the steps to be taken in case of a data breach. This includes timely identification and assessment of breaches, notification procedures for affected individuals and the Data Protection Board, and remedial actions to mitigate harm and prevent future incidents.

Conduct employee training

Educate your employees about the provisions of the data protection bill and their roles and responsibilities in ensuring compliance. Provide regular training sessions on data protection principles, privacy best practices, and the organization’s data-handling policies.

Establish vendor management processes

Review and update contracts with third-party vendors or processors to ensure they comply with the data protection bill’s requirements. Implement robust vendor management processes, including due diligence, contractual safeguards, and periodic assessments of their data protection practices.

Develop data subject rights procedures

Establish procedures for handling data subject rights requests, such as access, correction, erasure, and objection. Ensure these procedures are efficient, transparent, and compliant with the bill’s timelines and requirements.

Stay updated and seek legal advice

Regularly monitor updates and guidance from the Data Protection Board and relevant authorities regarding the interpretation and enforcement of the data protection bill. Consider seeking legal advice to ensure ongoing compliance and to address any specific concerns or questions related to your organization’s operations.

How We can help you

At CySYS, we have extensive experience in assisting companies with compliance across various frameworks. While the DPDP Bill is yet to be passed, we are fully prepared to help you navigate its requirements. Our expertise extends to compliance with GDPR, ISO 27001, SOC 2, and many other frameworks, making us well-equipped to assist you in preparing for the DPDP Bill.

We understand the challenges that come with regulatory compliance, and our aim is to make the process as seamless as possible for you. Whether it’s implementing the necessary security controls or managing your vendors, we will guide you through every step. If you’re seeking the support of experienced professionals to navigate this new framework, feel free to reach out to us. We’re here to help!

Blog , CIS , Compliance , CySYS , DPDP2023

Potential Pros and Cons of the DPDP 2023 Act

Pros:

  1. Enhanced Individual Rights: The act strengthens the rights of individuals over their personal data, giving them more control and transparency regarding how their data is collected, processed, and used.
  2. Improved Data Security: Organizations are required to implement stricter data security measures to protect personal information, reducing the risk of data breaches and cyberattacks.
  3. Accountability: The act promotes organizational accountability by mandating the appointment of data protection officers (DPOs) and requiring regular audits of data processing practices. This can lead to better data handling and increased responsibility.
  4. Transparency: Organizations are obligated to provide clear and accessible privacy policies, ensuring individuals understand how their data will be used and processed.
  5. Cross-Border Data Transfers: The act provides a framework for secure cross-border data transfers, maintaining data protection standards even when personal data is moved to different jurisdictions.
  6. Privacy Impact Assessments: Mandatory Data Protection Impact Assessments (DPIAs) help organizations identify and mitigate privacy risks, leading to more thoughtful and responsible data processing practices.
  7. Fostering Trust: The act’s focus on individual rights, transparency, and accountability can lead to increased trust between consumers and organizations, benefiting both parties.

Cons:

  1. Compliance Costs: Implementing the requirements of the DPDP 2023 Act can be expensive for organizations, especially for smaller businesses with limited resources. This includes costs related to data protection officers, audits, and compliance tools.
  2. Complexity: The act may introduce complex legal and technical requirements that organizations need to understand and implement, potentially leading to confusion and errors in compliance.
  3. Impact on Innovation: Stricter regulations could potentially deter innovation, as organizations might be more cautious about experimenting with new data-driven technologies due to compliance concerns.
  4. Burden on Small Businesses: Smaller businesses might struggle to keep up with the compliance requirements, leading to a competitive disadvantage compared to larger, more resource-rich companies.
  5. Ambiguity in Interpretation: The language of the act might be open to interpretation, leading to differing interpretations among legal experts and potential difficulties in enforcement.
  6. International Operations: For organizations with international operations, adhering to the act’s cross-border data transfer requirements might prove challenging, potentially affecting business operations.
  7. Overregulation: Some critics might argue that strict regulations can stifle business growth and hamper data-driven industries by making it more cumbersome to utilize data for beneficial purposes.

In conclusion, the DPDP 2023 Act brings a mix of advantages and challenges. While it strengthens individual rights and data security, it also introduces compliance complexities and costs. Striking the right balance between protecting personal data and fostering innovation is crucial as governments and organizations navigate the evolving landscape of digital privacy and data protection.

we are happy to help our customers to gain use of DPDP 2023 act within their security budget. please feel free to get in touch with us at support@cysys.io

Blog , CIS , Compliance , CySYS , DPDP2023

The Digital Personal Data Protection Bill 2023: Understanding the Exemptions for Start-Ups

1. Introduction

1.1. In a first, the Digital Personal Data Protection Bill, 2023 (“Bill”), accorded recognition to start-ups as a separate industry class. Given the world of start-up is intrinsically hinged with technology and data, it becomes crucial to know what they can and cannot do in this new regime of data compliance. Through this article, the Data Protection team at Khaitan Legal Associates (“KLA”) decodes the exemptions that the Bill offers to startups and related implications.

2. Eligibility

2.1. The Bill defines start-ups as private limited companies, partnership firms, or limited liability partnerships incorporated in India, meeting the eligibility criteria set forth by the department responsible for start-ups in the Central Government. The current reading does give the impression that all start-ups that meet the prescribed eligibility criteria qualify for the exemptions irrespective of registration with the Department for Promotion of Industry and Internal Trade (“DPIIT”).

3. Exemptions

3.1 The Central Government is now empowered to notify certain data fiduciaries to whom certain obligations under the Bill would not apply. Such exemptions are primarily based on the volume and nature of personal data such notified entities process. The category of data fiduciary entities that may be notified now includes start-ups.

3.2 Such exemptions relate to giving notice for consent1; accuracy and maintaining continued accuracy of personal data2; retention of personal data beyond its period of use3; additional obligations of a significant data fiduciary4; and immunity from enforcement of data principal rights5.

4. Implications

4.1. Compliance Preparedness: Given the exemptions will be granted via notifications, it remains to be seen what the criterion, qualification and duration for such exemptions may be. It is also unclear whether such exemptions fall away as soon as a start-up ceases to be one. Therefore, compliance preparedness may be a good measure to adopt irrespective of such exemption.

4.2. Start-ups in Regulated Sectors: Indian companies must comply with both central legislation and sector-specific regulations applicable to their operations. Therefore, while the exemptions provided under the Bill may provide some respite, start-ups operating in regulated

sectors like banking and insurance will still need to comply with their industry-specific privacy related compliance requirements.

4.3. Liability for Data Breaches: Despite exemptions, start-ups are not exempted from liability in case of data breaches. They will be held equally responsible and subject to penalties prescribed under the Bill which can go up to 250 crores, similar to other data fiduciaries.

5. Balancing Innovation and Protection

5.1. The Bill aims to streamline data protection compliances and encourage innovation for businesses, particularly startups. However, in this pursuit, it may appear to compromise individual data privacy. Striking a balance between innovation and privacy protection is crucial. The exemption provision should be seen as a supportive measure to nurture early-stage start-ups with limited means and operating at an initial phase. However, it should not be misconstrued as a compromise on data privacy. As start-ups grow and mature, they will eventually have to align with more robust data protection measures to maintain compliance and build a sustainable business model.

5.2. Start-ups must approach this exemption with responsibility, ensuring they strike a balance that aligns with both their business objectives and the privacy concerns of their users and customers.

6. Conclusion

6.1. The Bill marks a significant step by providing such exemptions to start-ups in India. As start-ups heavily rely on technology and data, understanding their exemptions and implications under the new data compliance regime becomes crucial. While the Bill empowers the Central Government to notify exemptions based on data volume and nature, it is essential for start-ups to stay prepared for compliance, as criteria and duration for exemptions remain uncertain.

6.2. Start-ups operating in regulated sectors like banking and insurance must be aware that the exemptions provided may not entirely exempt them from sector-specific compliance requirements. Additionally, despite exemptions, start-ups are not exempted from liability in case of data breaches. They are equally accountable and subject to penalties prescribed under the Bill, which can be substantial.

6.3. In this new era of data compliance, founders must proactively navigate the complexities of data protection, fostering innovation while safeguarding individual privacy rights. By striking the right balance, start-ups can pave the way for success and earn the trust of their stakeholders, positioning themselves as responsible and trustworthy entities in the digital landscape.

In the landscape we will try to explain Pros and Cons of the DPDP 2023 in out next blog post.

Potential Pros and Cons of the DPDP 2023 Act https://cysys.io/blog/index.php/2023/08/14/potential-pros-and-cons-of-the-dpdp-2023-act/

Blog , CIS , Compliance , DPDP2023

Demystifying the DPDP 2023 Act: A Comprehensive Overview

In the rapidly evolving landscape of digital privacy and data protection, governments and regulatory bodies worldwide are continually working to establish comprehensive legal frameworks that safeguard individuals’ personal information while promoting innovation and growth in the digital economy. One such significant development is the DPDP 2023 Act – the latest milestone in data protection. In this blog, we’ll delve into the key aspects and implications of the DPDP 2023 Act, shedding light on how it aims to reshape the data protection landscape.

Understanding the DPDP 2023 Act

The DPDP 2023 Act, short for “Digital Privacy and Data Protection Act 2023,” is a comprehensive piece of legislation designed to address the intricacies and challenges of data privacy and protection in the digital age. Enacted by [Country/Region], this act aims to provide individuals with more control over their personal data while holding organizations accountable for responsible data handling practices.

Key Highlights

  1. Enhanced Individual Rights: One of the primary objectives of the DPDP 2023 Act is to empower individuals with enhanced rights over their personal data. It introduces provisions for easier access to their data held by organizations, the right to rectify inaccurate information, and the right to be forgotten, allowing individuals to request the deletion of their data under certain circumstances.
  2. Stricter Consent Mechanisms: The act places a strong emphasis on obtaining valid consent for data processing activities. Organizations are required to obtain explicit and informed consent from individuals before collecting or using their data. Additionally, consent must be specific and easy to withdraw, ensuring that individuals have full control over their data.
  3. Data Minimization and Purpose Limitation: To reduce data collection and processing to the necessary minimum, the act introduces principles of data minimization and purpose limitation. Organizations are expected to collect only the data required for the intended purpose and refrain from using it for other unrelated activities.
  4. Mandatory Data Protection Impact Assessments (DPIAs): High-risk data processing activities, such as large-scale data processing or utilizing sensitive information, will require organizations to conduct DPIAs. These assessments help organizations identify and mitigate potential privacy risks associated with their data processing activities.
  5. Accountability and Transparency: The DPDP 2023 Act emphasizes organizational accountability. Organizations are required to implement robust data protection policies, appoint data protection officers, and conduct regular audits of their data processing practices. Transparency is also emphasized, as organizations must provide clear and accessible privacy policies to individuals.
  6. Cross-Border Data Transfers: The act addresses the complexities of cross-border data transfers by outlining specific mechanisms and safeguards for transferring personal data to countries outside the jurisdiction. Adequacy agreements, standard contractual clauses, and binding corporate rules are some of the tools organizations can use to ensure data protection during international transfers.
  7. Enforcement and Penalties: To ensure compliance, the DPDP 2023 Act introduces significant penalties for organizations found in violation of its provisions. These penalties could include substantial fines, data processing suspensions, or even criminal charges in severe cases.

Implications for Businesses and Individuals

For Businesses:

  • Organizations must invest in robust data protection measures, including advanced encryption, secure storage, and access controls.
  • Compliance officers and data protection officers (DPOs) play a critical role in ensuring adherence to the act’s provisions.
  • Data breaches must be reported promptly to regulatory authorities and affected individuals, fostering transparency and trust.

For Individuals:

  • Enhanced control over personal data empowers individuals to make informed choices about their data usage.
  • Access to clear privacy policies and easy-to-understand consent mechanisms ensures individuals are well-informed about how their data is used.

The DPDP 2023 Act represents a significant stride towards bolstering data privacy and protection in the digital era. By establishing comprehensive guidelines for organizations and empowering individuals with greater control over their personal data, this act sets the stage for a more secure and transparent digital environment. As businesses adapt to these new standards, and individuals gain more control over their data, the digital landscape is likely to become more privacy-conscious and accountable, fostering trust and innovation in equal measure.

We will continue next blog post about Understanding the Exemptions for Start Ups.