India’s DPDPA | Digital Personal Data Protection Act 2023
The Trust Challenge

Key obligations and consequences

The Act confirms that it only applies to digital personal data. Specifically, it applies to.

  • The processing of personal data carried out by any person in the public sector, the private sector or the cooperative sector, namely, when the data controller is based in Angola.
  • the processing of digital personal data outside the territory of India, if such processing is in connection with any activity related to the offering of goods or services to data principals within the territory of India.

The Central Government may deem certain data fiduciaries as being 'significant' based on various factors, these include the volume and sensitivity of personal data processed, the risk to the rights of data principals, and the potential impact on the sovereignty and integrity of India.

Such a designation entails the requirement to comply with additional obligations under the Act, as significant data fiduciaries must:

  • Appoint a DPO, who must represent the significant data fiduciary and be based in India, among other things.
  • Appoint an independent data auditor to carry out audits for evaluating compliance of the significant data fiduciary with the Act.
  • Undertake periodic Data Protection Impact Assessments (DPIAs), periodic audits, and other measures which may be prescribed by implementing rules to be issued under the Act.
  • Specific obligations are defined under Clause 9 of the Act in relation to the processing of personal data of children. The Act mandates data fiduciaries to obtain 'verifiable' parental consent before processing the personal data of children. Regardless, a data fiduciary must not process such data if this is likely to determine any detrimental effect on the well-being of the child, nor undertake tracking or behavioral monitoring of children or targeted advertising directed at them.
The Trust Challenge

Key Challenges in brief

The Data Fiduciaries are obligated to delete personal data once the purpose for which it was collected is fulfilled or when the Data Principal withdraws his/her consent, whichever is earlier. Further, if the Data Principal does not approach the Data Fiduciary for a certain period as prescribed, the retention period shall be deemed to have expired, and the Data Fiduciary would be required to erase such personal data.

The DPDPA has eased the cross border data transfer requirement where the Data Fiduciaries can transfer personal data to other countries unless notified and restricted by the Central Government. This could be a relief for the Data Fiduciaries as the need to enforce restrictions and related controls would be limited to the countries notified and this will have limited impact on the ongoing business.

As per the DPDPA, the requirement of serving a notice applies only where the ground of processing is consent. Data Fiduciaries need to provide the details of personal data, the purpose for which it is processed, and the manner in which the Data Principal can exercise their rights under the DPDPA.

The DPDPA imposes penalty for non-compliance on Data Principles, Data Fiduciaries and Consent Manager. THe legislation has adopted a layered penalty mechanism, where severe violations leading to data breaches, have been levied with the highest penalty of RS 250 crores. Data Principals will also be imposed with a fine of Rs 10,000 if they violate their duties defined under the Act.

Key data subject rights encoded within DPDPA are as follows.

Data principles have been empowered with the rights to cease processing by withdrawing their consent.

A data principal has the right to lodge a complaint with a data fiduciary. If a data fiduciary's response to a grievance is unsatisfactory, or if no response is received within seven days or another shorter time frame that may be prescribed, the data principal may submit a complaint with the Data Protection Board in the way that may be required.

A data principal has the right to request information from the data fiduciary. This includes obtaining confirmation of whether the data fiduciary is or has processed the data principal's personal data, a summary of the personal data being or that has been processed, and the identities of all data fiduciaries with whom the personal data has been shared, along with the categories of personal data shared.

A data principal shall be entitled to designate any other person in the manner that may be prescribed who shall, in the case of the data principal's death or incapacity, exercise the data principal's rights in accordance with the requirements of this Act.

A data principals shall have the right to correction and erasure of their personal data. Upon receiving a request for such correction of the personal data from a data principal, a data fiduciary is required to correct any inaccuracies, complete any incomplete information and update a data principal's personal data in the systems accordingly. In addition, the data fiduciary must also erase the personal data that is no longer required for the purpose for which it was collected and processed unless data retention is required by law.

Win-Win Situation

Solutions

TurtleShield PA (Privacy Automation) automates and streamline privacy-related processes and tasks. PIAs and DPIAs aim to enhance privacy practices, ensure compliance with applicable privacy laws and regulations, and protect sensitive information. Overall, a privacy automation solution simplifies and streamlines privacy management processes, reducing the risk of non-compliance and improving data protection practices.

Our AI-based, patented solution, TurtleShield PI (Privacy Intelligence) discovers all personal and sensitive data in structured and unstructured data systems across on-premises and multi-cloud environments. TurtleShield DI (Data Inventory) enables organizations to inventory & map their entire “Data footprint”, enabling them to protect what matters the most.

Often there are silos within entities or business and IT teams and it is challenging to get a full picture of data going outside organization and which is coming into organization, especially when data is shared with third parties, vendors, business partners and much more. Our TurtleShield PI (Privacy Intelligence) creates a data map based on your “data sharing”, to facilitate you to take action on it.

TurtleShield DM (Data Minimization) helps businesses minimize excess data and adhere to data minimization principle. This is data hygiene control and we are approaching it from a risk reduction and compliance perspective. We scan large data sets to scan for excess data using Machine Learning and find out excess data including personal data. This can eliminate operational inefficiencies and save cost by removing the unwanted data and legal cost of having it with respect to regulatory compliance.

With TurtleShield (Right to Erasure) provides the businesses the capabilities to comply with mandatory deletion of personal data by providing the capabilities to delete the data on request along with the validation of the deletion.

Search capability in large datasets to fulfill data subject requests in totality and at rapid space. Assumption that data only exists in databases and nowhere else is often not reality as customer data exists in many sources. Using Machine learning and AI we crawl across data sources and predict where PII can exist.

TurtleShield CM is the solution designed to help in enabling consent compliance within your organization involves implementing processes, technologies, and policies that ensure you collect and manage user consent in a way that aligns with applicable data protection regulations and industry best practices. It also helps in enabling consent management in 22 regional languages.

The Trust Challenge

Key obligations and consequences

Pointer

Applicability: The Act confirms that it only applies to digital personal data. Specifically, it applies to

  • The processing of digital personal data within the territory of India, where the personal data is collected either in digital form or in non-digital form and subsequently digitized.
  • The processing of digital personal data outside the territory of India, if such processing is in connection with any activity related to the offering of goods or services to data principals within the territory of India.
Pointer

Data Fiduciaries: The Central Government may deem certain data fiduciaries as being 'significant' based on various factors, these include the volume and sensitivity of personal data processed, the risk to the rights of data principals, and the potential impact on the sovereignty and integrity of India.

Such a designation entails the requirement to comply with additional obligations under the Act, as significant data fiduciaries must:

  • appoint a DPO, who must represent the significant data fiduciary and be based in India, among other things.
  • appoint an independent data auditor to carry out audits for evaluating compliance of the significant data fiduciary with the Act.
  • undertake periodic Data Protection Impact Assessments (DPIAs), periodic audits, and other measures which may be prescribed by implementing rules to be issued under the Act.
Pointer

Processing of personal data of children: Specific obligations are defined under Clause 9 of the Act in relation to the processing of personal data of children. The Act mandates data fiduciaries to obtain 'verifiable' parental consent before processing the personal data of children. Regardless, a data fiduciary must not process such data if this is likely to determine any detrimental effect on the well-being of the child, nor undertake tracking or behavioral monitoring of children or targeted advertising directed at them.

The Trust Challenge

Challenges

The following are the issues created by DPB laws that the majority of organizations face:

Pointer

Data Retention & Deletion: The Data Fiduciaries are obligated to delete personal data once the purpose for which it was collected is fulfilled or when the Data Principal withdraws his/her consent, whichever is earlier. Further, if the Data Principal does not approach the Data Fiduciary for a certain period as prescribed, the retention period shall be deemed to have expired, and the Data Fiduciary would be required to erase such personal data.

Pointer

Cross Border Data Transfer: The DPDPA has eased the cross border data transfer requirement where the Data Fiduciaries can transfer personal data to other countries unless notified and restricted by the Central Government. This could be a relief for the Data Fiduciaries as the need to enforce restrictions and related controls would be limited to the countries notified and this will have limited impact on the ongoing business.

Pointer

Privacy Notice: As per the DPDPA, the requirement of serving a notice applies only where the ground of processing is consent. Data Fiduciaries need to provide the details of personal data, the purpose for which it is processed, and the manner in which the Data Principal can exercise their rights under the DPDPA.

Pointer

Penalties: The DPDPA imposes penalty for non-compliance on Data Principles, Data Fiduciaries and Consent Manager. THe legislation has adopted a layered penalty mechanism, where severe violations leading to data breaches, have been levied with the highest penalty of RS 250 crores. Data Principals will also be imposed with a fine of Rs 10,000 if they violate their duties defined under the Act.

Pointer

Fulfillment of Data Subject Rights: Key data subject rights encoded within DPDPA are as follows.

Pointer

Right to withdraw Consent: Data principles have been empowered with the rights to cease processing by withdrawing their consent.

Pointer

Right to Grievance Redressal: A data principal has the right to lodge a complaint with a data fiduciary. If a data fiduciary's response to a grievance is unsatisfactory, or if no response is received within seven days or another shorter time frame that may be prescribed, the data principal may submit a complaint with the Data Protection Board in the way that may be required.

Pointer

Right to Access Information: A data principal has the right to request information from the data fiduciary. This includes obtaining confirmation of whether the data fiduciary is or has processed the data principal's personal data, a summary of the personal data being or that has been processed, and the identities of all data fiduciaries with whom the personal data has been shared, along with the categories of personal data shared.

Pointer

Right To Nominate: A data principal shall be entitled to designate any other person in the manner that may be prescribed who shall, in the case of the data principal's death or incapacity, exercise the data principal's rights in accordance with the requirements of this Act.

Pointer

Right To Correction And Erasure Of Personal Data: A data principals shall have the right to correction and erasure of their personal data. Upon receiving a request for such correction of the personal data from a data principal, a data fiduciary is required to correct any inaccuracies, complete any incomplete information and update a data principal's personal data in the systems accordingly. In addition, the data fiduciary must also erase the personal data that is no longer required for the purpose for which it was collected and processed unless data retention is required by law.

Win-Win Situation

Solutions

Pointer

Privacy Process Automation: TurtleShield PA (Privacy Automation) automates and streamline privacy-related processes and tasks. PIAs and DPIAs aim to enhance privacy practices, ensure compliance with applicable privacy laws and regulations, and protect sensitive information. Overall, a privacy automation solution simplifies and streamlines privacy management processes, reducing the risk of non-compliance and improving data protection practices.

Pointer

Data discovery, inventory and mapping: Our AI-based, patented solution, TurtleShield PI (Privacy Intelligence) discovers all personal and sensitive data in structured and unstructured data systems across on-premises and multi-cloud environments.
TurtleShield DI (Data Inventory) enables organizations to inventory & map their entire “Data footprint”, enabling them to protect what matters the most.

Pointer

Third party “Privacy Intelligence” (monitors third party sharing): Often there are silos within entities or business and IT teams and it is challenging to get a full picture of data going outside organization and which is coming into organization, especially when data is shared with third parties, vendors, business partners and much more. Our TurtleShield PI (Privacy Intelligence) creates a data map based on your “data sharing”, to facilitate you to take action on it.

Pointer

“Data Minimization”: TurtleShield DM (Data Minimization) helps businesses minimize excess data and adhere to data minimization principle. This is data hygiene control and we are approaching it from a risk reduction and compliance perspective. We scan large data sets to scan for excess data using Machine Learning and find out excess data including personal data. This can eliminate operational inefficiencies and save cost by removing the unwanted data and legal cost of having it with respect to regulatory compliance.

Pointer

“Right to Erasure with Assured Deletion": With TurtleShield (Right to Erasure) provides the businesses the capabilities to comply with mandatory deletion of personal data by providing the capabilities to delete the data on request along with the validation of the deletion.

Pointer

Enable Data subject rights with cost savings and compliance in totality: Search capability in large datasets to fulfill data subject requests in totality and at rapid space. Assumption that data only exists in databases and nowhere else is often not reality as customer data exists in many sources. Using Machine learning and AI we crawl across data sources and predict where PII can exist.

Pointer

Consent Management: TurtleShield CM is the solution designed to help in enabling consent compliance within your organization involves implementing processes, technologies, and policies that ensure you collect and manage user consent in a way that aligns with applicable data protection regulations and industry best practices. It also helps in enabling consent management in 22 regional languages.

Featured News, Blogs

India DPDPA 2023 - All You Need to Know
Ardent Privacy at AISS 2024: A Recap
Understanding NYDFS Rules: A Comprehensive Guide to Financial Regulation in New York

Be the first to catch our latest updates,
happenings and more.

Follow us

Facebook Linkedin Twitter Instagram Icon

5520 Research Park Drive, Suite 100 Catonsville MD 21228

Plot # 847, SR No. 113/2 , Veerbhadra Nagar Road , Baner,Pune 411045 India

+1 833.888.7853 (USA)

+91.7498281428 (India)

Solutions

Products

Company

© 2024 Ardent Privacy, Inc. All Rights Reserved