Ardent Privacy Management Framework: Your Roadmap to India's DPDPA Compliance

1) Understand Applicable Laws and Regulations

The DPDP Act applies to:

• The processing of digital personal data within the territory of India, where the personal data is collected in (i) digital form or (ii) non-digital form and digitized subsequently.
• The processing of digital personal data outside the territory of India, if such processing is in connection with any activity relating to the offering of goods and services to data principals within the territory of India.

2) Perform a Privacy Impact Assessment (PIA)

Evaluate the potential risks and impact of processing personal data. Be ready for data audits by Data Protection Board of India (DPBI) approved independent auditors. Reports submitted to the regulatory body should reflect compliance with DPDPA.

3) Consent Management

If data processing relies on consent, organizations will need to comply with consent requirements under the Act and build a compliance plan that includes the following steps:

• One of the fundamental principles of the act is obtaining informed and explicit consent from individuals before collecting or processing their personal data. Consent plays a pivotal role in establishing the lawful basis for processing personal information and upholds the principle of data autonomy for individuals.
• Consent under the DPDP Act must be freely given, specific, informed, and unambiguous. This means that individuals must have a clear understanding of what they are consenting to and have the ability to withdraw their consent at any time. Data fiduciaries and processors are required to keep records of consent to demonstrate compliance with the Act.

4) Employee Training and Awareness

The DPDPA takes a graded approach to enforcement, with some violations attracting more severe penalties than others. Implementing “organizational measures” such as internal privacy policies and staff training programs must consider to protect personal information

Organizational measures:

• Roll out a security and privacy training and awareness program for employees and contractors handling personal information.
• Draft standard operating procedures detailing personal data handling requirements.
• Publish internal policies related to security and privacy. Human resources teams may integrate acknowledgment of these policies into the employee onboarding process or periodic training programs.

5) Enable data principal rights

To comply with the act, organizations will need to create processes to enable data principal rights.

• The right to know what personal data is being processed by a Data Fiduciary, the processing activities undertaken with respect to such personal data, and the identities (and not just categories) of all other Data Fiduciaries and data processors to whom the personal data has been shared.
• The right to correction, completion (i.e., complete any incomplete data), updating, and erasure of personal data for the processing of which the Data Principal has previously given consent.
• The right to grievance and redress for any act or omission of the Data Fiduciary regarding the performance of its obligations relating to the Data Principal’s personal data.
• The right to nominate any other individual to exercise the Data Principal’s rights in the event of death or incapacity.

6) Build a data inventory and data map

Data governance is foundational for building any privacy compliance program. Although the act does not explicitly call out data inventory or data map as requirements, privacy pros will need to understand what personal data types are processed, where they are stored, what kind of processing activity is performed, and which data processors the data is shared with to comply with certain obligations of the Act. Some examples of these obligations that rely on data inventory for implementation are:

• Data fiduciaries must ensure the data's completeness, accuracy and consistency, where personal data is used for decision-making that affects the data principals.
• Data fiduciaries must enable data principal rights such as the right to access, correction and erasure of personal information.
• Data fiduciaries and data processors must enforce data erasure requirements when the specified data processing purpose is no longer being served.
• Data fiduciaries must provide notice to data principals about the personal data being processed and the purpose of processing.
• There is no one size fits all solution for data inventory and mapping initiatives. Data discovery, classification and cataloging approaches can range from manual, often starting with interviews/questionnaires, to automated, with code scanning or machine learning-based data classification tools. Before selecting the appropriate method, privacy pros must consider several factors, including data ecosystem complexity, data volume, resource requirements, executive support, tooling availability, and scalability.

7) Incident Response and Reporting

Develop an incident response plan to address data breaches promptly. Establish a reporting mechanism to inform relevant authorities and should conduct regular compliance audits to check adherence to DPDPA requirements.

8) Monitor and Audit Employee Access to Personal Data

Regularly review and audit access to personal data to ensure compliance with the DPDPA. Conduct periodic privacy audits to identify and address potential vulnerabilities.

9) Data Minimization and Purpose Limitation

Adopt principles of data minimization by collecting and processing only the data necessary for the intended purpose. Clearly define the purpose for which data is collected and ensure that it is not used for other purposes without proper consent. The DPDPA emphasizes that only data which is necessary for offering a particular service should be collected. In other words, it emphasizes upon the principle of data minimization and purpose limitation. Therefore, SAP customers should only collect relevant data for intended purposes and not beyond that.

10) Appoint a Data Protection Officer (DPO) or Privacy Officer

Designate a DPO responsible for ensuring DPDPA compliance, managing data audits, and serving as a point of contact for grievance redressal. Ensure that the DPO has the necessary knowledge and expertise in data protection laws and practices.

Compliance with the DPDPA is an ongoing process, and regular monitoring, training, and updates to your compliance program will help ensure that your business remains compliant. Organizations need to check whether and to what extent the DPDP Act applies to them and their operations. With respect to notice and consent requirements, they should be prepared to go back to individuals once the Act becomes effective. Organizations that collect, process and monetize personal data need to ascertain where, how and whose personal information is lodged within their systems. Although organizations also need to consider improving their information technology and cybersecurity systems to meet the new compliance requirements, including in respect of a breach. Relatedly, organizations will need to monitor entities in their supply chains, such as suppliers, about data processing obligations, and review existing contractual arrangements.

About Ardent Privacy

Ardent Privacy is an "Enterprise Data Privacy Technology" solutions provider based in the Maryland/DC region of the United States and Pune, India. Ardent harnesses the power of AI to enable companies with data discovery and automated compliance with various global regulations by taking a data centric approach. Ardent Privacy's solution utilizes machine learning and artificial intelligence to identify data inventory, data mapping, data minimization, and securely delete data in enterprises to reduce legal and financial liability.

Download Framework