US
IN
Introduction:
With the rapid growth of technology and the pervasive use of the internet, the protection of personal data has become a critical concern. In the constantly evolving digital landscape , the need for robust data privacy regulations has never been more apparent. India, acknowledging the significance of safeguarding personal data, has taken a significant step in this direction with the introduction of the Digital Personal Data Protection Bill.
Data is the main driving force of the digital age. It fuels the services we use, the products we buy, and the way we connect with the world. However, this digital transformation has also exposed individuals and businesses to new risks, including data breaches, identity theft, and unauthorized use of personal information. Hence, it’s essential to have a legal framework that protects the rights and interests of both individuals and organizations.
What is the Digital Personal Data Protection Bill?
The Digital Personal Data Protection Bill, also known as the PDP Bill, is poised to reshape how personal data is collected, processed, and stored in India. It aims to empower individuals with greater control over their data while holding organizations accountable for responsible data handling. For businesses, it means adapting to new compliance requirements and rethinking data management practices. For individuals, it offers the promise of enhanced data security and privacy.
The key highlights of the bill:
Consent: Individuals must give their explicit consent before their personal data can be collected or processed. This is a significant shift from the current regime, where companies often collect and process personal data without obtaining explicit consent from individuals.
Purpose limitation: Personal data can only be collected and processed for specific purposes that are disclosed to the individual in advance. This means that companies cannot collect and use personal data for purposes that individuals are not aware of or do not consent to.
Data minimization: Companies can only collect and process the personal data that is necessary for the specific purpose for which it is collected. This helps to protect individual privacy by reducing the amount of personal data that is exposed to companies.
Data accuracy: Companies must take reasonable steps to ensure that the personal data they hold is accurate and up-to-date. This is important because inaccurate or outdated personal data can lead to discrimination and other harms.
Data storage and transfer: Personal data must be stored in a secure manner and can only be transferred outside of India with the consent of the individual. This helps to protect individual privacy from unauthorized access or use.
Data access and correction: Individuals have the right to access and correct their personal data. This means that individuals can request to see the personal data that companies hold about them, and they can also request that any inaccurate or outdated personal data be corrected.
Data erasure: Individuals have the right to have their personal data erased. This means that individuals can request that companies delete their personal data, unless the company is required by law to retain the data.
Data breach notification: Companies are required to notify the Data Protection Board of India and affected individuals of any data breaches. This helps to ensure that individuals are aware of data breaches and can take steps to protect themselves.
Data Protection Authority (DPA): The bill sets up the Data Protection Authority of India (DPA) to vigilantly enforce its provisions. Empowered to probe data breaches, levy fines for non-compliance, and offer expert guidance on data protection best practices.
Data Impact Assessments (DIAs): The bill introduces DIAs as a vital component to assess potential risks tied to data processing activities. Organizations must conduct DIAs for specific data processing operations to guarantee alignment with the bill’s regulations.
In addition, the bill requires companies to minimize the amount of personal data they collect and process. This means that companies can only collect and process the personal data that is necessary for the specific purpose for which it is collected. This helps to protect individual privacy by reducing the amount of personal data that is exposed to companies.
The Digital Personal Data Protection Bill, 2023 is a significant step forward in protecting the privacy of Indian citizens in the digital age. The bill covers a wide range of issues, including data collection, processing, storage, and transfer. The bill also provides for a number of penalties for non-compliance of regulations and data breaches.
To get a clearer understanding of the bill, let’s familiarize ourselves with some key terms:
Data fiduciary: A data fiduciary is an entity or person responsible for determining the purposes and means of processing personal data. They are typically in a position of trust and responsibility when it comes to managing and protecting this data.
Data processor: A data processor is an entity or person that processes personal data on behalf of the data fiduciary. They act under the direction and authority of the data fiduciary and are responsible for executing the processing activities.
Data controllers: A data controller is an entity or person that determines the purposes and means of processing personal data. They are responsible for ensuring that data processing activities comply with data protection regulations.
Data principal: A data principal, also known as a data subject, is an individual whose personal data is being collected, processed, or stored.
Consent management system: a consent management system is a mechanism or process used by organizations to collect, record, and manage individuals’ consent for processing their personal data. It ensures that data processing is carried out with the consent of data principals and in compliance with data protection regulations.
Sub processor: A sub-processor is an entity or person that processes personal data on behalf of a data processor. They work under the direction of the data processor and assist in specific processing activities.
Role of data controller: The role of a data controller involves determining the purposes and means of personal data processing, ensuring compliance with data protection laws, and safeguarding the rights of data subjects.
Role of data processor: The role of a data processor is to process personal data on behalf of the data controller. They are responsible for executing processing activities according to the controller’s instructions and ensuring data security.
Consent Manager: A consent manager represents the Data Principal and takes action on their behalf when granting, managing, reviewing and revoking consent.
While we’ve given you a broad understanding of the Digital Personal Data Protection Bill, in our upcoming blog we will take a deeper dive into understanding what it means for your business. We will break down the challenges, discuss the impacts, and provide clear guidance for your business to comply with the new regulations.
FAQ’s
An Act to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto.
A data processor is an entity or person that processes personal data on behalf of the data fiduciary. They act under the direction and authority of the data fiduciary and are responsible for executing the processing activities.
The bill distinguishes between data controllers and data processors. Data controllers determine how and why personal data is processed, while data processors carry out the processing activities on behalf of the controller, following their instructions.
Not necessarily. The role an organization plays depends on its relationship with personal data. Some organizations may act as both a data controller and a data processor, while others may only serve as one or the other. It depends on whether they have control over the data’s purpose and processing activities.
