Companies must work hard to ensure data protection

The new law requires Data Fiduciaries to erase personal data as soon as it is reasonable to assume that the specified purpose for which it was collected is no longer being served.
The new law requires Data Fiduciaries to erase personal data as soon as it is reasonable to assume that the specified purpose for which it was collected is no longer being served.


Businesses need to urgently set up elaborate data systems for compliance with the provisions of this law

On Monday, the Lok Sabha voted to pass the new Digital Personal Data Protection Bill. Union minister Ashwini Vaishnaw had promised, when he withdrew the previous draft of the data protection law, that we would have a new law in force before the conclusion of India’s Monsoon Session of Parliament. Monday’s vote was the first step in that direction.

While commentators have been falling over themselves to dissect various provisions of the draft law—and, in particular, the new changes it has introduced—I don’t think anyone has appreciated fully the extent to which businesses across the length and breadth of this country need to re-orient themselves to the new and fairly rigorous compliance regime that is about to come into force. This is a law that will apply to all businesses that process digital personal data in the country. Given how deeply data technologies have ingrained themselves in all facets of modern life, virtually every organization in India will be affected. All of them will have to revisit their data practices, study their workflows and review their standard operating procedures to make sure they align with the requirements of the new law.

Take the marketing function, for example. Most sales teams today acquire new customers by making cold calls to potential leads in an attempt to convert them into clients. They source these leads from data brokers who aggregate these databases through dubious means—often without valid consent. Once the new law comes into force, nobody will be able to process personal information without the consent of those to whom it pertains. This means that, going forward, sales agents will be in violation of the law if they cannot demonstrate that the people they are calling have consented to being contacted. Even if they have such consent, they will need to make sure that their use of the personal data is in line with the express purposes for which it was permitted, and not, for instance, to upsell other unrelated services.

The new law makes it clear that wherever a question arises as to whether or not personal data was validly processed, it will be the responsibility of the Data Fiduciary (to whom data was entrusted) to demonstrate that it has the consent of the Data Principal (whose data it is) for processing it towards the purpose specified. This means that firms must adopt appropriate organizational and technological mechanisms to effectively respond to such questions if and when they are posed by an individual whose data they are processing. Few companies in India have such mechanisms in place.

For businesses that have international operations, many of these requirements will not be new. Data protection laws around the world have similar stipulations and chances are that they would have already put systems in place to ensure that their operations are legally compliant. But even these businesses will need to do additional work in order to bring their operations in line with the requirements of the Digital Personal Data Protection Bill.

Take, for instance, its language requirement. Once the new law comes into force, Data Fiduciaries will need to ensure that every notice for data collection and every request for consent is made available not only in English but also in each of the languages specified in the Eighth Schedule to the Constitution. Even if a company already has in place a privacy policy that meets the law’s requirements, it will have to create versions of this policy in all these different languages by the time the new provisions come to bear on its operations.

Another provision of the law is a stipulation that any agreement between a Data Fiduciary and a Data Principal that runs contrary to provisions of the law will be invalid to that extent. This means that if a company has specifically introduced language into its terms of service and privacy policies in order to (with the consent of the Data Principal) carry out a business process that is not strictly in line with the provisions of the new law, it will no longer be able to rely on those contractual terms. My advice to all business entities operating in India would be to review their terms of service from this perspective, and, since they can no longer make contracts that violate the law, make appropriate changes in the way their business functions in order to ensure compliance.

Perhaps the biggest change that companies will have to make is in relation to data retention. The new law requires Data Fiduciaries to erase personal data as soon as it is reasonable to assume that the specified purpose for which it was collected is no longer being served. It goes on to specify that this will be assumed to have taken place if the Data Principal has not approached the Data Fiduciary for the specified performance or has not exercised his or her rights for a specific period of time (which will be separately notified). In order to comply with this part, Data Fiduciaries will need to put in place a process by which they can record the last time each item of data under their control was used for a specified process, so that they can count down from then to determine when they must delete it. To the best of my knowledge, no company has such measures in place today, and I am struggling to understand how, given the vast amounts of data that they have under their control, they will engineer such a system in good time.

I have been eagerly awaiting the enactment of this law for over a decade. Now that it is upon us, I am beginning to realize how much work is left for everyone to adapt.

Rahul Matthan is a partner at Trilegal and also has a podcast by the name Ex Machina. His Twitter handle is @matthan

Catch all the Business News, Market News, Breaking News Events and Latest News Updates on Live Mint. Download The Mint News App to get Daily Market Updates.