By Rohit Chakraborty
It isn’t uncommon for an unsuspecting Indian to receive a phone call from “their bank” where they are asked to disclose sensitive financial information such as ATM PIN, Transaction OTPs or Credit Card CVVs. More often than not, the credibility of these “employees” are pretty convincing as they provide the victim with very particular personal details first, only to have them divulge sensitive personal data by the end of the call.
In a separate yet more frightening scenario, a law-abiding and tax-paying citizen might someday randomly discover that there are several bank accounts in their name which they had no knowledge of.
So how are the victims being targeted in these situations? The answer isn’t “crime” as much as it is “lack of regulation.”
Certainly, most of us have heard about the data breaches that occurred at Air India, BigBasket, Domino’s India and of course, the infamous AADHAR Data Leak case. Personal data of several million Indians were compromised and sold in each of these cases. However, these breaches are not the only source that fuels such cybercriminal activities. Due to the lack of a Data Protection framework so far, India has been a breeding ground for unscrupulous companies involved in illegal and unethical data sharing. The absence of a comprehensive data protection regulation and its enforcement thereto has incentivized quite a lot of companies to sell or share customer personal data without consent, oftentimes with bad actors. To cure these evils existing in the Indian cyberspace, a robust data protection regulation was long overdue. With the objective to regulate data sharing in the cyberspace, India recently enacted its first formulated law on protection of personal data. In the digital era where personal data is slowly becoming equivalent to currency, the new law comes with an aim to strike a balance between individual privacy rights and the need for legitimate use of personal data.
Several compliances have been introduced through this legislation which shall apply on all businesses within India dealing with digitized personal data or non-digitized personal data that has been digitized subsequently. The compliance requirements outlined in this act may be broadly classified under 6 major headings. Depending upon the type of entity, the following may or shall apply.
However, before moving ahead with the compliances, it is pertinent to understand the simplified definitions of a few key terminologies used within the act.
Data Fiduciary: A person or group of persons deciding the purpose and means of collecting and processing certain personal data. It is termed as “Data Controller” under the GDPR and most other privacy laws.
Data Principal: An individual to whom the personal data relates. It is equivalent to “Data Subject” as under the GDPR.
Significant Data Fiduciary: Businesses or organizations processing huge amounts of personal data. The exact definition is yet to be notified.
Now that we have a grasp over the important definitions, we may proceed to explain the several compliances laid down within this Act. The checklist provided hereunder briefly illustrates the compliances in a nutshell.
A Privacy Notice (or Privacy Policy) is an intimation to be provided by the Data Fiduciary to the Data Principal, prior to collection of any Personal Data. As per Section 5(1) of the Act, it is mandatory for a Data Fiduciary to serve a Privacy Notice which must include:
In the case of personal data already collected prior to the enactment of this Act (historical data), the law mandates refreshment of consent. In other words, upon commencement of the act, the Data Fiduciary shall, as soon as reasonable practicable, serve a Privacy Notice to all Data Principals pertaining to the personal data already collected. [Section 5(2)]
Furthermore, the Data Principal shall have the option to choose their preferred language for the notice between English and any of the 22 languages mentioned under the Eighth Schedule of the Constitution of India. [Section 5(3)]
The Privacy Notice so served shall transparently explain the processing activities taken up by the Data Fiduciary in clear and pellucid terms. As mandated under Section 6(1) of the Act, the acceptance of this notice shall only be considered legally valid when there is an affirmative action by the
Data Principal in furtherance of such acceptance. This means pre-marked checkboxes and notices without an option to reject shall not be considered valid. Additionally, the Privacy Notice shall also provide the name and contact details of the Data Protection Officer, or any other representative in charge of Data Protection.
A novel feature that has been introduced by the Indian legislation which had never been witnessed before within any other Privacy Law in the world is the requirement of a Consent Management Framework. The Act, under Section 6(7), mandates the appointment of a “Consent Manager” who shall be registered with the Data Protection Board, and is assigned the duty to overlook the consent management system within the organization.
Responsibilities of a Data Fiduciary
Certain technical and organizational responsibilities have been expected of all Data Fiduciaries within the legislation, as outlined hereunder:
The Act requires Data Fiduciaries engaged in the processing of children’s personal data to adhere to a few compliances. The age of consent for the purpose of this Act is yet to be notified by the Government.
In order to process the Personal Data belonging to children or persons with disability, a Data Fiduciary, under Section 9(1) of the Act, is required to obtain verifiable consent of the parent or lawful guardian respectively, prior to engaging in such processing. One of the methods to comply to this clause may be the introduction of an age-verification system coupled with a system to obtain and verify parental consent.
The Act prohibits the processing of personal data which is likely to cause harmful or detrimental effects to a child’s well-being. [Section 9(2)]
Tracking of children and targeted advertisements directed towards children are also prohibited under Section 9(3) of this Act.
The law upholds the digital rights of Data Principals and guarantees four major rights to all Data Principals within the territory of India. Accordingly, the Data Fiduciaries are expected by the law to respect these rights and comply as and when required. Neglecting the rights of Data Principals shall result into non-compliance and is a serious form of offence under the Act.
The four major rights are explained in brief.
The Data Principals have been bestowed with the right to access their personal information held by a particular Data Fiduciary. The Data Principal shall be entitled to a summary of the information relating to them, the names and details of Data Processors with whom their information has been shared, and a description of the data shared. Additionally, the Government may further prescribe any other information that a Data Principal may be entitled to.
The Data Fiduciary is expected to maintain a Data Map alongside a record of all processing activities (RoPA) to ascertain ease of locating personal data and comply with requests made under this section.
Under this section, the Data Principals are guaranteed with the right to:
In order to ensure effective enforcement of this right, the Act has mandated the establishment of a Grievance Redressal Mechanism for each Data Fiduciary. A request can thereby be made either to the Consent Manager or to the Data Fiduciary through the Grievance Redressal System.
It is to be noted that this section must be exhausted by a Data Principal prior to approaching the Data Protection Board. If and only if the resolution provided by the Data Fiduciary through its Grievance Redressal Model is insufficient or unacceptable, the Data Principal may make a complaint directly before the Data Protection Board of India.
The Data Principal can nominate another person to exercise their rights in the case of their death or incapacity (unsoundness of mind or infirmity of the body).
The Government may from time to time declare some Data Fiduciaries as Significant Data Fiduciaries (SDF) through notification, under the ambit of this Section 10(1). While deciding whether a Data Fiduciary falls under this category or not, the following criteria shall be considered:
The Data Protection Regime in India is changing rapidly. Even though most of the compliances have already been established through the Act itself, we can still easily expect the Government to notify further regulatory compliances through rules and by-laws. Almost every business which has an online presence today is processing some amount of data on a regular basis. Thus, regardless of their size and stature, they will be subjected to the compliances mentioned herein.
Advoke Law specializes in Data Protection Compliances and works with the objective to make the cyberspace a safer place for everyone. We formulate individual strategies and optimize them accordingly to perfectly fit your business practices thus helping you reach exceptional compliance scores. Feel free to contact us to schedule a free consultation!
Book a free consultation — no commitment, no charge. We will listen and give you an honest assessment.
Bar Council of India — Mandatory Notice
Advoke Law is a dedicated legal advisory firm. Please read and acknowledge the following before proceeding.
As per the Bar Council of India Rules, 1975, advocates and law firms are not permitted to solicit work or advertise. By continuing, you confirm that:
By clicking “I Understand – Enter Site” or continuing to access this website, you confirm that you have read and understood this disclaimer and voluntarily wish to access the website.
