- the Data Principal to whom such data relates; or
- any other person who is under an obligation under any law for the time being in force in India to make such personal data publicly available.
For example, if an individual has publicly made her personal data available on social media while blogging her views, the provisions of the DPDP Act shall not apply.
4. Key Principles
4.1 What are the key principles that apply to the processing of personal data?
- Transparency: Section 4 of the DPDP Act requires that the purpose of processing data must be disclosed, and consent must be taken from the Data Principal before processing the data. As such, transparency must be maintained to get consent from the Data Principal.
- Lawful basis for processing: As per Section 4(1), there are two lawful bases:
- for which the Data Principal has given her consent; or
- for certain legitimate uses.
Section 4(1) of the DPDP Act clearly states that the personal data of a Data Principal will be collected only for a lawful purpose. This is further explained in Section 4(2), which clarifies that lawful purpose means “any purpose which is not expressly forbidden by law”.
- Purpose limitation: Section 5(1)(i) of the DPDP Act requires the Data Processor to give due notice to the Data Principal of the personal data that must be collected and the purpose for which the same is proposed to be processed. As such, once consent is obtained for a specific purpose, the data will be used specifically for the said purpose only.
- Data minimisation: Data minimisation has been defined only where consent is used as the legitimate basis. Section 6 speaks of consent having certain elements, one of which is “limited to such personal data as is necessary for such specified purpose”.
- Proportionality: In the General Data Protection Regulation (GDPR) parlance, proportionality refers to the fact that any personal data collected and processed needs to be adequate, relevant and limited to what is necessary for the purpose for which it is being processed. This is reflected in the DPDP Act, as per the mandates to have a specified purpose and, as discussed before, the need for it to be limited to what is necessary.
- Retention: In terms of the DPDP Act, the Data Fiduciary shall, unless retention is necessary for compliance with any law for the time being in force:
- erase personal data upon the Data Principal withdrawing her consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier; and
- cause its Data Processor to erase any personal data made available by the Data Fiduciary for processing to such Data Processor.
- Accuracy: Where personal data processed by a Data Fiduciary is likely to be:
- used to make a decision that affects the Data Principal; or
- disclosed to another Data Fiduciary, the data fiduciary processing such personal data shall ensure its completeness, accuracy and consistency. Section 15(c) of the DPDP Act also places an equal responsibility of ensuring the accuracy of the personal data shared by the Data Principal on the Data Principal. Any data shared by the Data Principal should be accurate and not suppress any material facts.
- Other key principles
The accountability principles will probably be laid out in the Rules. As of now, while both the Data Fiduciary and the Data Processor are responsible for the personal data, the obligations of accountability need to be articulated in more detail.
5. Individual Rights
5.1 What are the key rights that individuals have in relation to the processing of their personal data?
- Right of access to (copies of) data/information about processing: Section 11 of the DPDP Act gives the Data Principal the right to access a summary of the data being processed, the purpose for which it is being processed and with which other Data Fiduciary or Data Processors the data is being shared.
- Right to rectification of errors: Section 12(1) of the DPDP Act states that the Data Principal has a right to get the data corrected in case any changes have happened since the collection of data which render the data inaccurate or there has been some error in the recording of the data at the time of sharing.
- Right to deletion/right to be forgotten: According to Section 12(1) of the DPDP Act, Data Principals are entitled to exercise their right to request for correction, completion, updating or erasure of their personal data that they had previously given consent for processing. This right includes consent referred to in Section 7(a). Nevertheless, the exercise of this right is subject to the requirements and procedures prescribed by any applicable law in force. A Data Principal must request the Data Fiduciary to erase their personal data in a prescribed manner. Upon receipt of such a request, the Data Fiduciary is obliged to erase the personal data of the Data Principal unless it is necessary to retain the said data for the specified purpose or in compliance with any law currently in force. Therefore, the Data Fiduciary must maintain compliance with the law and ensure the privacy of the Data Principal’s personal data.The right to be forgotten has not been expressly included in the DPDP Act; however, the mandate to have Personal Data removed by the Data Processors has been covered as one of the obligations of the Data Fiduciary.
- Right to object to processing: Although the GDPR has established the right to object to data processing, this right has not yet been defined by Indian laws. It may be outlined in future regulations. However, if personal data is being processed without the consent of the Data Principal or for a purpose for which the consent was not given or sought, they have the right to object to the processing of their data. As such, consent from the Data Principal is essential for gathering, processing or sharing data. If the Data Principal at any point withdraws consent, the Data Fiduciary is bound under the DPDP Act to stop using the personal data of the Data Principal and erase any records maintained with respect to the same.
- Right to restrict processing: The concept of Restriction of Processing as under the GDPR has yet to be clearly defined in Indian laws, and it is expected that the Rules will provide clarity.
- Right to data portability: This right is not properly articulated. It may be mentioned in the prospective Rules.
- Right to withdraw consent: Section 6(4) of the DPDP Act states that where consent by the Data Principal is the basis for processing personal data, the Data Principal has the right to withdraw consent at any time, with the ease of withdrawing consent being comparable to ease of giving consent. Thus, the Data Principal can withdraw consent at any time after giving consent if the Data Principal feels the need to do so. Further, Section 6(7) of the DPDP Act states that the Data Principal can give, manage, review or withdraw the consent given to a Data Fiduciary through the Consent Manager.
- Right to object to marketing: Section 6(4) clearly states that consent given by the Data Principal is only for processing Personal Data for a specified purpose. Therefore, if the data is being used for marketing, including targeted marketing profiling or other such activities, the Data Principal can object to such marketing activities.
- Right protecting against solely automated decision-making and profiling: The right is inadequately articulated at present. However, it is possible that this issue may be addressed in forthcoming regulations. However, Section 9(2) clarifies that the Data Fiduciary shall not undertake the processing of personal data that is likely to have a detrimental effect on a child’s well-being. Section 9(3) prohibits tracking or behavioural monitoring of children or targeted advertising directed at children.
- Right to complain to the relevant data protection authority(ies): Under Section 13(1) of the DPDP Act, the Data Principal shall have a right to readily avail the means of grievance redressal provided by the Data Fiduciary or Consent Manager for any acts of omission or commission by the Data Fiduciary in relation to handling the personal data of the Data Principal. Section 13(3) of the DPDP Act further states that the Data Principal can only approach the Data Protection Board if she is dissatisfied with the grievance redressal by the Consent Manager or Data Protection Officer (DPO) to whom the complaint was made.
- Right to nominate: The DPDP Act contains a unique concept in Section 14(1), which grants Data Principals the right to nominate another individual to exercise their rights in the event of their death or incapacity. The Act specifies that the manner of nomination will be prescribed in its rules. This provision ensures that the rights of the Data Principal are protected even after they are no longer able to exercise them. The Act and the Rules thereunder will provide further clarity to potential nominees on how they can assume these responsibilities. For the purpose of this section, the term “incapacity” refers to the inability of a Data Principal to exercise their rights under the provisions of this Act or the Rules established therein due to unsoundness of mind or infirmity of the body.
- Right to compensation: The DPDP Act does not include any provisions for compensating the Data Principal. If the Data Fiduciary breaches any provisions of the DPDP Act, the Data Protection Board may impose fines, which will be credited to the Consolidated Fund of India as specified in Section 34 of the DPDP Act.
5.2 Please confirm whether data subjects have the right to mandate not-for-profit organisations to seek remedies on their behalf or seek collective redress.
A plain reading of the provisions of the DPDP Act does not mention any provision wherein the Data Principal can appoint a not-for-profit organisation to seek remedies on their behalf or seek collective redress. However, once the Rules are notified under the DPDP Act, there may be more clarity on this point.
6. Children’s Personal Data
6.1 What additional obligations apply to the processing of children’s personal data?
Section 9(1) of the DPDP Act states that before processing children’s personal data, the Data Fiduciary must obtain verifiable consent from the parent or lawful guardian.
Further, Section 9(2) clarifies that the Data Fiduciary shall not undertake any processing of personal data that is likely to have a detrimental effect on the well-being of a child.
Section 9(3) prohibits the tracking or behavioural monitoring of children or targeted advertising directed at children.
7. Registration Formalities and Prior Approval
7.1 Is there a legal obligation on businesses to register with or notify the data protection authority (or any other governmental body) in respect of its processing activities?
The DPDP Act is silent on the legal obligation of businesses to register with or notify the Data Protection Board or any other government body with respect to processing activities in the normal course. The concept of Voluntary Undertaking has been discussed under Section 32, but this is limited to a situation where there is a complaint.
However, Section 8(6) of the DPDP Act states that in the event of a data breach, the Data Fiduciary must inform the same to all the Data Principals, as well as the Data Protection Board, in such form and manner as may be prescribed.
7.2 If such registration/notification is needed, must it be specific (e.g., listing all processing activities, categories of data, etc.) or can it be general (e.g., providing a broad description of the relevant processing activities)?
The DPDP Act does not envisage this. It may be discussed once the Rules to the DPDP Act are notified.
7.3 On what basis are registrations/notifications made (e.g., per legal entity, per processing purpose, per data category, per system or database)?
The DPDP Act does not envisage this. It may be discussed once the Rules to the DPDP Act are notified.
7.4 Who must register with/notify the data protection authority (e.g., local legal entities, foreign legal entities subject to the relevant data protection legislation, representative or branch offices of foreign legal entities subject to the relevant data protection legislation)?
Barring what has been mentioned in question 7.1 above, the DPDP Act does not discuss this. It may be discussed once the Rules to the DPDP Act are notified.
7.5 What information must be included in the registration/notification (e.g., details of the notifying entity, affected categories of individuals, affected categories of personal data, processing purposes)?
Barring what has been stated in question 7.1 above, as of now no guidelines have been provided. It may be applicable once the Rules to the DPDP Act are notified.
7.6 What are the sanctions for failure to register/notify where required?
As per the DPDP Act, not observing the requirements of notifying the Board or individuals of a personal data breach will amount to a fine extending up to INR 200 crores. However, further guidance will be required once the Rules to the DPDP Act are notified.
7.7 What is the fee per registration/notification (if applicable)?
As of now, no guidelines have been provided. It may be applicable once the Rules of the DPDP Act are notified.
7.8 How frequently must registrations/notifications be renewed (if applicable)?
As of now, no guidelines have been provided. It may be applicable once the Rules of the DPDP Act are notified.
7.9 Is any prior approval required from the data protection regulator?
There is the concept of voluntary undertaking, but there is no mention of any prior approval beyond that. It may be applicable once the Rules of the DPDP Act are notified.
7.10 Can the registration/notification be completed online?
As of now, no guidelines have been provided. It may be applicable once the Rules of the DPDP Act are notified.
7.11 Is there a publicly available list of completed registrations/notifications?
No. It may be applicable once the Rules to the DPDP Act are notified.
7.12 How long does a typical registration/notification process take?
As of now, no guidelines have been provided. It may be applicable once the Rules to the DPDP Act are notified.
8. Appointment of a Data Protection Officer
8.1 Is the appointment of a Data Protection Officer mandatory or optional? If the appointment of a Data Protection Officer is only mandatory in some circumstances, please identify those circumstances.
Section 10 of the DPDP Act clarifies that the appointment of a DPO is mandatory for all Significant Data Fiduciaries who handle a great volume of sensitive data, the processing of which can cause risk to the rights of Data Principals or can have a potential impact on the sovereignty and integrity of India, such as causing risk to electoral democracy, security of the state or public order.
However, the appointment of a DPO is currently optional for the rest of the Data Fiduciaries who are not designated as Significant Data Fiduciaries.
8.2 What are the sanctions for failing to appoint a Data Protection Officer where required?
A breach of the obligations of the Significant Data Fiduciary under section 10, which includes the appointment of a DPO, entails a fine of INR 150 crores. It may be further clarified once the Rules to the DPDP Act are notified.
8.3 Is the Data Protection Officer protected from disciplinary measures, or other employment consequences, in respect of his or her role as a Data Protection Officer?
No. As of now, no guidelines have been provided. It may be applicable once the Rules to the DPDP Act are notified.
8.4 Can a business appoint a single Data Protection Officer to cover multiple entities?
Yes, there is no bar to appointment of a single or common DPO for more than one entity. However, as of now, no guidelines have been provided. It may be applicable once the Rules to the DPDP Act are notified.
8.5 Please describe any specific qualifications for the Data Protection Officer required by law.
As of now, no guidelines have been provided. However, the understanding of the law and the organisation are basic. It may be clarified once the Rules to the DPDP Act are notified.
8.6 What are the responsibilities of the Data Protection Officer as required by law or best practice?
The Act is silent here, but the DPO is a person who serves as a conduit between the Data Fiduciary, Data Principal and Data Protection Board. Their responsibility is to primarily oversee and make sure that the privacy framework is maintained. We will have further clarity once the Rules to the DPDP Act come in.
8.7 Must the appointment of a Data Protection Officer be registered/notified to the relevant data protection authority(ies)?
No. It may be applicable once the Rules to the DPDP Act are notified.
8.8 Must the Data Protection Officer be named in a public-facing privacy notice or equivalent document?
It is purported that the contact details of the DPO should be clearly mentioned on the website of the company or on the mobile app so as to enable aggrieved Data Principals to easily approach the DPO in the event of any grievance redressal.
9. Appointment of Processors
9.1 If a business appoints a processor to process personal data on its behalf, must the business enter into any form of agreement with that processor?
According to the DPDP Act, a Data Fiduciary is required to have a valid contract with the Data Processor. They can engage, appoint, use or involve a Data Processor to process personal data on their behalf, only under a valid contract. It applies to any activity related to offering goods or services to Data Principals.
Therefore, it is advisable to execute a written agreement to specify the purpose for which data is processed and ensure confidentiality of the data instead of getting into disputes due to ambiguity of purpose or confidentiality of data.
9.2 If it is necessary to enter into an agreement, what are the formalities of that agreement (e.g., in writing, signed, etc.) and what issues must it address (e.g., only processing personal data in accordance with relevant instructions, keeping personal data secure, etc.)?
The form and format of the agreement are not defined; however, the usual practice is that all obligations of the Data Fiduciary will be passed onto the Data Processor and liabilities thereof.
10. Marketing
10.1 Please describe any legislative restrictions on the sending of electronic direct marketing (e.g., for marketing by email or SMS, is there a requirement to obtain prior opt-in consent of the recipient?).
Section 6(4) clearly states that the consent given by the Data Principal is only for the processing of personal data for a specified purpose. Therefore, if the Data Principal’s personal data is being used for sending direct marketing messages, specific prior consent from the Data Principal is required before sending such emails or messages. Without specific consent, the Data Principal can object to such marketing activities.
10.2 Are these restrictions only applicable to business-to-consumer marketing, or do they also apply in a business-to-business context?
These regulations apply to the Personal Data of the Data Principal. Even where the data of a Data Principal is being shared between business entities, specific consent for the purpose will be applicable.
10.3 Please describe any legislative restrictions on the sending of marketing via other means (e.g., for marketing by telephone, a national opt-out register must be checked in advance; for marketing by post, there are no consent or opt-out requirements, etc.).
As of now, no specific guidelines on marketing have been provided. It may be applicable once the Rules to the DPDP Act are notified.
10.4 Do the restrictions noted above apply to marketing sent from other jurisdictions?
Section 3(b) of the DPDP Act clarifies that the DPDP Act applies to the processing of digital personal data outside the territory of India and also if such processing is in connection with any activity related to the offering of goods or services to Data Principals within the territory of India. Therefore, any marketing being done on the basis of personal data of Data Principals located in India will invite restrictions imposed by this Act, which can be done only if explicit consent is given.
10.5 Is/are the relevant data protection authority(ies) active in enforcement of breaches of marketing restrictions?
The authority defined under the DPDP Act is the Data Protection Board as the overarching body for redressing any grievances for enforcement of breaches of marketing restrictions.
10.6 Is it lawful to purchase marketing lists from third parties? If so, are there any best practice recommendations on using such lists?
Under the DPDP Act, the purchase of marketing lists from third parties is not permissible unless the Data Principal gives specific consent for permitting her personal data to be used in such a manner.
10.7 What are the maximum penalties for sending marketing communications in breach of applicable restrictions?
The maximum penalty for sending marketing communications in breach of applicable restrictions is INR 250 crores, as per the Schedule to the DPDP Act.
11. Cookies
11.1 Please describe any legislative restrictions on the use of cookies (or similar technologies).
The DPDP Act mentions that the unambiguous and explicit consent of the Data Principal is required for any use to which the personal data of the Data Principal is being put. Accordingly, the concept of cookies and the ability to seek information from essential cookies versus non-essential cookies remain consistent with best practices.
Even the IT Act and the supplementing Rules do not explicitly provide any legislative restrictions on the use of cookies. However, under the SPDI Rules, the processing of SPDI requires written consent, which also applies to cookies used to collect SPDI. There are no exceptions to this obligation. Since the SPDI Rules allow denial of services if consent is withheld for the collection of data, organisations often use them to restrict access to their websites or platforms if users do not give consent for using necessary cookies.
Under Section 43 of the IT Act, permission from the data owner is required to download, copy or extract any data or information from the computer, which squarely applies to cookies. However, there are no specific guidelines or judicial precedents for the same.
11.2 Do the applicable restrictions (if any) distinguish between different types of cookies? If so, what are the relevant factors?
While the law will never go into such detailed mandates, the purpose limitation and data minimisation principles under the DPDP Act mandate a clear distinction between the levels, such as essential and non-essential cookies.
11.3 To date, has/have the relevant data protection authority(ies) taken any enforcement action in relation to cookies?
Once the Data Protection Board is appointed and the Rules are notified, such enforcement actions relating to cookies may be provided.
11.4 What are the maximum penalties for breaches of applicable cookie restrictions?
There is no clarity on this so far that is specific to cookies. However, upon an interpretation of the DPDP Act, as it now stands, a maximum fine of INR 250 crores may be levied.
12. Restrictions on International Data Transfers
12.1 Please describe any restrictions on the transfer of personal data to other jurisdictions.
Section 16(1) of the DPDP Act states that the Central Government, by notification, may restrict the transfer of personal data by a Data Fiduciary for processing to any country or territory outside India. However, no specific country has been mentioned in the negative list as of now.
The DPDP Act further goes on to state, however, that if there are stricter/higher obligations in other Acts, as regards transfer, these laws will supersede the DPDP Act. For example, the RBI has restrictions on the transfer of specific financial data.
12.2 Please describe the mechanisms businesses typically utilise to transfer personal data abroad in compliance with applicable transfer restrictions (e.g., consent of the data subject, performance of a contract with the data subject, approved contractual clauses, compliance with legal obligations, etc.).
There are currently no established guidelines for this matter; however, it is expected that contracts in this regard will serve as guidance. Upon notification, the Rules may provide further elaboration on the issue.
12.3 Do transfers of personal data to other jurisdictions require registration/notification or prior approval from the relevant data protection authority(ies)? Please describe which types of transfers require approval or notification, what those steps involve, and how long they typically take.
As of now, no guidelines have been provided. It may be applicable once the Rules of the DPDP Act are notified.
12.4 Do transfers of personal data to other jurisdictions require a transfer impact assessment? If conducting a transfer impact assessment is only mandatory in some circumstances, please identify those circumstances.
The DPDP Act currently does not provide any guidelines for transfer impact assessments. However, we advise our clients that this is a best practice that can be adopted. The same may be applicable once the Rules of the DPDP Act are notified.
12.5 What guidance (if any) has/have the data protection authority(ies) issued following the decision of the Court of Justice of the EU in Schrems II (Case C‑311/18)?
The Indian system does not provide guidance based on foreign decisions. However, we will need to see how the Rules are framed wherein this may be considered.
12.6 What guidance (if any) has/have the data protection authority(ies) issued in relation to the use of standard contractual/model clauses as a mechanism for international data transfers?
As of now, no guidelines have been provided for the use of standard contractual/model clauses as a mechanism for international data transfers. It may be applicable once the Rules to the DPDP Act are notified.
13. Whistle-blower Hotlines
13.1 What is the permitted scope of corporate whistle-blower hotlines (e.g., restrictions on the types of issues that may be reported, the persons who may submit a report, the persons whom a report may concern, etc.)?
The Whistleblowers Protection Act, 2014, relates to a vigil mechanism for the security of an individual reporting unethical, immoral and illegal acts, such as malpractice and fraud in public-sector organisations. A complainant can be any person who makes a complaint relating to disclosure under the DPDP Act. Under the DPDP Act, any complaint by a whistleblower must be submitted to the Competent Authority as defined under the DPDP Act. The Competent Authority differs with the persons against whom any complaint is made. However, the Competent Authority under the DPDP Act is usually the senior official in the same hierarchy as the person against whom a complaint is being made. This negates the neutrality of the investigation, and the findings that are reached are usually biased.
The legal framework concerning whistleblower or vigil mechanisms is also governed by the provisions of: the Companies Act, 2013; the Companies (Meeting of Board and its Powers) Rules, 2014; and the Securities and Exchanges Board of India (Listing Obligations and Disclosure Requirements) Regulations, 2015.
13.2 Is anonymous reporting prohibited, strongly discouraged, or generally permitted? If it is prohibited or discouraged, how do businesses typically address this issue?
According to the Whistleblowers Protection Act, 2014, an authorised body can only act on an allegation if the whistleblower reveals their identity in the claim. Whistleblowers who provide counterfeit aliases or make complaints anonymously are not acknowledged. Nonetheless, there is no bar in the Companies Act, 2013, regarding confidential disclosure of company activity.
The Audit Committee or the Board of Directors may independently evaluate the substance of the unidentified accusation and take appropriate action, or they may seek to contact the whistleblower for additional material and assistance.
Leading business organisations in India accept complaints anonymously and have put in place procedures to protect whistleblowers’ identities and the secrecy of the investigation procedure.
14. CCTV
14.1 Does the use of CCTV require separate registration/notification or prior approval from the relevant data protection authority(ies), and/or any specific form of public notice (e.g., a high-visibility sign)?
The DPDP Act has not explicitly addressed the question of registration or approval for the use of CCTV cameras. However, the principles in the DPDP Act will need to be followed in terms of legitimacy, transparency, necessity and proportionality.
Therefore, in the absence of any specific mention in the DPDP Act, reliance also needs to be placed on the IT Act and the SPDI Rules for the use of CCTV for surveillance, as there are no provisions or regulatory requirements for the same. The IT Act provides that if a camera captures or transmits photos of a person’s private parts, male or female, without consent, the criminal can be charged under Section 66E.
This, nevertheless, has several exemptions. For example, the use of CCTV cameras at public locations without the approval of individuals is permitted if the cameras are not pointed at locations where individuals are entitled to a reasonable right to privacy, such as restrooms or changing facilities. Furthermore, CCTV cameras may be used to preserve the welfare and protection of individuals and possessions and to hinder, identify and investigate crime. In such circumstances, the video footage gathered can be shared with law enforcement agencies as required by the law.
14.2 Are there limits on the purposes for which CCTV data may be used?
At present, there are no explicit legislation regarding installation of CCTV cameras. As such, we can rely on the IT Act and SPDI Rules as elaborated in question 14.1 above.
15. Employee Monitoring
15.1 What types of employee monitoring are permitted (if any), and in what circumstances?
Section 7(i) of the DPDP Act states that employee monitoring may be permitted for employment or related purposes to safeguard the employer from loss or liability. This may include preventing corporate espionage, maintaining the confidentiality of trade secrets, intellectual property, and classified information, or providing any service or benefit sought by a Data Principal who is an employee. It is important to note that this provision only provides for the exclusion of consent and does not exempt the Data Fiduciary from fulfilling any of its other obligations.
However, the DPDP Act, read with the IT Act, permits the “interception, inspection or deciphering of any data transferred, obtained or retained on an organisation’s device”. This is particularly relevant if the monitoring has a genuine and reasonable business objective and does not infringe on the personnel’s personal space and privacy. Most organisations collect employee data for background verification or standard business purposes such as payroll and insurance.
15.2 Is consent or notice required? Describe how employers typically obtain consent or provide notice.
The DPDP Act also requires consent from the Data Principal, including the employee. A legitimate use exception allows one to claim that one does not need to seek consent “for employment purposes”, although we will have to wait until the rules are notified to understand how this needs to be interpreted.
In addition, judicial precedents establish that monitoring, especially audio monitoring, must be done only after obtaining such consent.
15.3 To what extent do works councils/trade unions/employee representatives need to be notified or consulted?
There is no legal requirement to consult or notify work councils, trade unions or employee representatives under existing legislation in India, nor has any such requirement been specified under the DPDP Act.
15.4 Are employers entitled to process information on an employee’s attendance in office (e.g., to monitor compliance with any internal return-to-office policies)?
Yes, employers can monitor such information for the employee as the employee is working for the employer, as mentioned in question 15.1 above.
16. Data Security and Data Breach
16.1 Is there a general obligation to ensure the security of personal data? If so, which entities are responsible for ensuring that data are kept secure (e.g., controllers, processors, etc.)?
Under Section 8(5) the DPDP Act, the Data Fiduciary is responsible for ensuring the security of personal data from any breach, whether by the Data Fiduciary or by the Data Processor who has been given the task of processing the personal data by the Data Fiduciary.
16.2 Is there a legal requirement to report data breaches to the relevant data protection authority(ies)? If so, describe what details must be reported, to whom, and within what timeframe. If no legal requirement exists, describe under what circumstances the relevant data protection authority(ies) expect(s) voluntary breach reporting.
Yes, Section 8(6) of the DPDP Act requires a Data Fiduciary to report an event of breach of data security to the Data Protection Board, as well as to the Data Principal whose data has been compromised.
There is no timeline as per the DPDP Act so far; however, it is expected that the best practices of GDPR of 72 hours will be followed.
Under the separate mandate of CERT-IN under the IT Act, however, the reporting of a data breach must be done by the Data Fiduciary within six hours of becoming aware of the breach.
16.3 Is there a legal requirement to report data breaches to affected data subjects? If so, describe what details must be reported, to whom, and within what timeframe. If no legal requirement exists, describe under what circumstances the relevant data protection authority(ies) expect(s) voluntary breach reporting.
Yes, Section 8(6) of the DPDP Act requires a Data Fiduciary to report an event of breach of data security to the Data Protection Board, as well as to the Data Principal whose data has been compromised. No timeline has been prescribed currently.
16.4 What are the maximum penalties for personal data security breaches?
The maximum penalty is INR 250 crores, as per Schedule I to the DPDP Act, which contains the Schedule of penalties that can be imposed for various offences under the DPDP Act. However, it is clarified that the penalty so imposed is to be deposited in the Consolidated Fund of India and no amount is paid to the Data Principal.
17. Enforcement and Sanctions
17.1 Describe the enforcement powers of the data protection authority(ies).
- Investigative Powers: According to the DPDP Act, the Data Protection Board has been endowed with investigative powers. However, the Board’s formation is yet to be realised.
- Corrective Powers: The Data Protection Board can instruct the Data Fiduciary to take remedial steps and confirm; however, the Board has not been formed yet.
- Authorisation and Advisory Powers: The MeitY is presently the body with advisory powers until the time the Data Protection Board is formed.
- Imposition of administrative fines for infringements of specified legal provisions: The Data Protection Board is empowered to impose fines under the DPDP Act. Until such time that the Board is formed, MeitY is responsible for all monitoring activities.
- Non-compliance with a data protection authority: Any person aggrieved by any order of the Data Protection Board can file an appeal before the Appellate Tribunal, as per the provisions of Section 29 of the DPDP Act.
17.2 Does the data protection authority have the power to issue a ban on a particular processing activity? If so, does such a ban require a court order?
Yes, the Data Protection Board has the power to take any appropriate action that is required after investigation to ensure protection of data and impose penalty along with instructions for prohibiting such processing of data which is not in compliance with the law. The order of the Data Protection Board is enforceable without the requirement of a court order.
17.3 Describe the data protection authority’s approach to exercising those powers, with examples of recent cases.
The Data Protection Board has not been formulated yet, so we do not have any examples.
17.4 Does the data protection authority ever exercise its powers against businesses established in other jurisdictions? If so, how is this enforced?
The Data Protection Board has not been formed yet, so such a situation is yet to occur. However, as per the DPDP Act, a business operating in other jurisdictions will be liable to comply with the Indian law for personal data of Data Principals located in India.
18. E-discovery/Disclosure to Foreign Law Enforcement Agencies
18.1 How do businesses typically respond to foreign e-discovery requests, or requests for disclosure from foreign law enforcement agencies?
India ratified the Hague Convention on the Taking of Evidence Abroad in Civil or Commercial Matters (Hague Convention) in 2007. However, no domestic law has been passed by the Parliament of India to give effect to the Hague Convention. The closest provisions in Indian law that allow requests for disclosure or e-discovery in the form of “letters of request issued by foreign courts” are under Section 78 and Order 26, Rules 19 to 22 of the Code of Civil Procedure (CPC).
Section 78, read with Rule 19 of Order 26 of the CPC, provides for conditions that are required to be satisfied for the execution of letters of request from foreign courts:
- a foreign court should wish to obtain evidence of a witness in any proceeding of a civil nature before it; and
- the witness should be residing within the appellate jurisdiction of the High Court before which the request is placed.
After India ratified the Hague Convention, the High Courts of Andhra Pradesh and Delhi entertained the letters of request presented to them and appointed commissioners to execute the letters of requests under Order 26 of the CPC, dehors the application of the Hague Convention.
The Indian Government has, in response to a questionnaire relating to the Hague Convention (published in May 2009), taken the position that the domestic implementation of the convention in India would be through Section 78 and Order 26, Rules 19 to 22 of the CPC.
Thus, Indian entities are not legally obligated to comply with any requests for e-discovery unless a specific request has been made in that regard as per the law.
18.2 What guidance has/have the data protection authority(ies) issued on disclosure of personal data to foreign law enforcement or governmental bodies?
At present, no guidelines have been issued. Under the DPDP Act, the Central Government can, by notification, inform if there is any country or region to which data is not to be sent for processing or storage.
19. Trends and Developments
19.1 What enforcement trends have emerged during the previous 12 months? Describe any relevant case law or recent enforcement actions.
Recent enforcement trends pertain to:
- The Indian Government laid down guidelines relating to fake news that endeavour to address the issue of misinformation by introducing guidelines to intermediaries and AI platforms. The guidelines aim to forestall the creation of inaccurate and misleading information that could incite unrest, especially in the lead-up to the forthcoming elections. Any news that is either unverified or fake must be flagged as potentially untrue, and a process must be followed to trace the origin of such false news that is generated with the aid of AI.
- There was a case of circulation of deep-fake pictures of Indian Film Star Rashmika Mandhana, where criminal action was taken against the engineer guilty of the act.
- The Delhi High Court passed a significant order relating to the protection of the voice and personality rights of film stars such as Amitabh Bachchan and Anil Kapoor.
- There was another order by the Delhi High Court to protect the rights of Aradhya Bachchan, daughter of film star Abhishek Bachana and Aishwarya Rai, who was being maligned by the circulation of false news about her mental and physical health conditions.
19.2 What “hot topics” are currently a focus for the data protection regulator?
The significant topics in focus for the data protection regulator are:
- Privacy by design, i.e., proactively embedding privacy into the design and operation of IT systems, networked infrastructure and business practices.
- Service providers may move to privacy-focused technology, such as: secure messaging apps and browsers; virtual private networks; and encrypted email services.
- Alternatives to cookies will invoke newer technologies and methods to track and target users. For example, using browser fingerprints that can be used to track a user without using cookies.
- Edge computing that allows data processing near the source of data rather than in a centralised data centre.
- AI-enabled cyber security ensuring traceability and reliability to check fake news, deep-fakes, frauds by use of AI, etc.
- Security of children’s data.
- Synthetic data generation that does not contain any data from real persons, but still has the statistical features that are characteristic of real-life data.
- Confidential computing using hardware-based, trusted execution environments, such as processors that guarantee certain security features for the memory or parts of the memory.
Production Editor's Note
This chapter has been written by a member of ICLG's international panel of experts, who has been exclusively appointed for this task as a leading professional in their field by Global Legal Group, ICLG's publisher. ICLG's in-house editorial team carefully reviews and edits each chapter, updated annually, and audits each one for originality, relevance and style, including anti-plagiarism and AI-detection tools. This chapter was copy-edited by Maya Tyrrell , our in-house editor.
- Buy Chapter in PDF format £100
- Buy the Book in PDF format £295
