WEBVTT
00:00:15.679 --> 00:00:22.800
Hello, everybody, and welcome to the first episode of our series on global data protection regulations.
00:00:23.440 --> 00:00:25.280
I'm Maria Malone, Dr.
00:00:25.359 --> 00:00:29.519
Maria Maloney, and I'm head of research here at Privacy Engine.
00:00:29.679 --> 00:00:40.079
Myself and Katie are talking to you today about the Digital Personal Data Protection Act 2023 in India.
00:00:40.240 --> 00:00:49.439
And the reason why we've started with this for our first episode is because a lot of the act has come into effect in November 2025.
00:00:49.600 --> 00:00:58.000
So we thought it appropriate that we would start our series on international data protection law with the Indian data protection law.
00:00:59.119 --> 00:01:00.560
So as I said, I'm Dr.
00:01:00.640 --> 00:01:03.439
Maria Maloney and I'm head of research here at Privacy Engine.
00:01:03.520 --> 00:01:08.000
And my colleague Katie is just going to introduce herself now and then we can get started.
00:01:08.079 --> 00:01:09.439
So over to you, Katie.
00:01:10.879 --> 00:01:12.719
So I'm Katie Barch.
00:01:12.799 --> 00:01:17.280
I'm a data protection consultant at Privacy Engine.
00:01:18.079 --> 00:01:20.959
My title is Data Protection Legal Specialist.
00:01:21.200 --> 00:01:29.439
So outside of consultancy, I also do bits and pieces of research into global privacy laws.
00:01:46.879 --> 00:01:48.159
Yeah, great.
00:01:48.319 --> 00:01:50.319
So we'll get started.
00:01:50.480 --> 00:01:59.519
We have about 12 questions, and uh so I'm gonna start and then we'll take it, we'll alternate the questions between myself and Katie.
00:02:09.599 --> 00:02:18.960
So the Digital Personal Data Act, or what we call the DPDP Act, which is a bit of a tongue twister, um, is India's first comprehensive data protection law.
00:02:19.039 --> 00:02:32.960
It regulates how digital personal data is processed about individuals in India and how personal data or digital personal data is collected, used, shared, and stored.
00:02:33.280 --> 00:02:36.800
The act tries to balance two things, which I think it does quite well.
00:02:36.879 --> 00:02:57.599
And considering that we have the digital omnibus coming out of Europe uh recently, um, I think uh, you know, we have to with the GDPR, we're kind of going back to the drawing board, whereas with this DPDP act, they seem to have kind of almost gotten the balance right um initially at the at the beginning.
00:02:57.759 --> 00:02:59.599
So that it tries to balance two things.
00:02:59.759 --> 00:03:14.319
On the one hand, um it tries to balance an individual's right to privacy, and on the other hand, it the need for governments and businesses to be able to process data legitimately and without too much burden.
00:03:14.560 --> 00:03:22.719
So that I think and I think it creates a good a good balance there, and we'll go into that in more details um as we go through the questions.
00:03:23.599 --> 00:03:27.919
But um so so that it looks to balance those two things.
00:03:28.080 --> 00:03:42.240
Um the terminology is quite different to um the GDPR that myself and Katie are used to because you know we're we're based in Ireland, and so we have uh we've done a lot of work in the GDPR, but now we're looking into international data protection laws.
00:03:42.400 --> 00:04:02.560
So um we understand a data controller would be an organization that processes personal data, uh, but in the Indian law or in the PDPD Act, um, these data controllers are actually called data fiduciaries, um, but they have similar um obligations under the act.
00:04:02.800 --> 00:04:13.680
Um, also, if you know the GDPR, you are familiar with the term um data processors, and they're actually called the same thing under the PDBT PD Act.
00:04:14.479 --> 00:04:22.639
Um, it covers so the act covers per digital personal data as opposed to just personal data that the GDPR would cover.
00:04:22.800 --> 00:04:33.839
Um, so the GDPR would cover paper-based personal data, whereas um the Indian Act it just handles digitized uh personal data.
00:04:34.000 --> 00:04:49.120
Okay, um, so if you um your organization actually um is doing business with India and you're processing personal data of um Indian citizens, then this is um a data protection law that you need to understand.
00:04:50.000 --> 00:04:55.920
Um, at a high level, the act sets out rules um about how you can process data.
00:04:56.399 --> 00:05:13.519
So there's um the idea of consent, just like the GDPR, but um what's different is that it it uh sets out certain legitimate uses, um and it also has individual rights like the GDPR and security safeguards are also required.
00:05:13.759 --> 00:05:20.240
Um we also will be looking at data breaches because that's also part of the act, just like the GDPR.
00:05:20.480 --> 00:05:29.920
So that's kind of a kind of a broad overview of the similarities and the differences between the DPDP Act and the GDPR.
00:05:30.160 --> 00:05:39.279
Um and now, Katie, if it's okay with you, would you be able to give us a kind of a brief history of um where the act, the DPDP Act came from?
00:05:41.199 --> 00:06:00.879
Yeah, so the act kind of has its roots in a case that started in 2014 after Facebook acquired WhatsApp, um, where WhatsApp's data sharing policy was challenged by the Supreme Court.
00:06:01.279 --> 00:06:13.680
So the case Pudaswamy, it was decided in 2017, and it actually found that in India there is a fundamental right to privacy under the Indian constitution.
00:06:14.319 --> 00:06:23.759
So then they were kind of like, well, people have this fundamental right, how are we gonna facilitate that?
00:06:24.000 --> 00:06:37.920
So following this, the government set up a committee of experts to design a data protection framework, um which ended up in the actual we have today, but it went through three different drafts.
00:06:38.079 --> 00:06:43.519
The first draft came out a year later, the decision in that case, 2018.
00:06:43.920 --> 00:06:48.480
Um it imp it talked about conditions like data localization.
00:06:49.120 --> 00:06:54.240
Um, and at the time, technology firms actually weren't weren't really for it.
00:06:54.319 --> 00:06:56.560
They were quite lobbying against it.
00:06:56.959 --> 00:07:03.839
Um but the official bill came out actually the same year it was finalized, which was 2023.
00:07:04.079 --> 00:07:11.199
It was introduced in August as a bill, and it was passed the same month by presidential assent.
00:07:12.000 --> 00:07:25.600
So the 2023 law is the product of about eight years of legal, political, and technical debate following this judgment that took three years to come to the final conclusion on.
00:07:26.000 --> 00:07:39.360
Um the latest version of the act strips out a lot of the things that were seen in the original draft, but it's as Marie said, it kind of struck that balance that people are looking for.
00:07:39.439 --> 00:07:59.839
It was a lot better received among um both Indian and global tech firms uh because I suppose they're the ones facing the requirements at the end of the day, so it has to go down well with the people who are going to be working with it in their day-to-day work.
00:08:00.160 --> 00:08:07.920
So um NASCOM represents the main IT and technology firms in India.
00:08:08.399 --> 00:08:19.360
Uh, they said in a statement issued through their Data Security Council of India initiative that they welcomed the new the new legislation.
00:08:19.680 --> 00:08:31.839
They had a couple of problems that they that they raised around like parental consent and the deadlines for breaches and stuff.
00:08:32.399 --> 00:08:38.879
But I mean, that's almost stuff that you hear no matter what law, no matter what country it passes through.
00:08:38.960 --> 00:08:47.200
So I would still say that's quite a success to have that level of acceptance with the technology firms is kind of rare.
00:08:48.000 --> 00:08:49.120
I agree totally, yeah.
00:08:49.200 --> 00:08:56.399
You're you're not you're never gonna get them 100% happy, and even if you do get them 100% happy, then that might be a problem in itself.
00:08:56.480 --> 00:08:57.200
Do you know what I mean?
00:08:57.279 --> 00:08:58.960
It might be too lenient, then you know.
00:08:59.200 --> 00:09:08.240
Yeah, and like things like parental consent, you know, it there's no point having uh uh data protection law if you're not gonna include things like that anyway.
00:09:08.320 --> 00:09:09.759
So absolutely, yeah.
00:09:09.919 --> 00:09:12.000
What's it all for if you don't protect children?
00:09:12.080 --> 00:09:12.720
Do you know what I mean?
00:09:13.039 --> 00:09:13.519
Exactly.
00:09:13.759 --> 00:09:14.240
Yeah.
00:09:14.480 --> 00:09:22.000
And you you mentioned there that they weren't happy back in 2018 about the data localization um parts of the act.
00:09:22.320 --> 00:09:27.679
Data localization means in this context and not every context, but uh data sovereignty.
00:09:27.840 --> 00:09:29.919
I think it was about oh right.
00:09:30.480 --> 00:09:40.559
Data the the Indian government wanted the data to be kind of in the Indian uh within the Indian you know boundaries, regulatory boundaries.
00:09:41.279 --> 00:09:51.360
Yeah, so Maria, who does the act apply and what are data principles and data fiduciaries?
00:09:51.919 --> 00:09:59.919
Okay, so I kind of highlighted, I kind of explained what they were, the data fiduciaries and the data principles at the beginning and then my first question.
00:10:00.080 --> 00:10:17.440
But so basically the the the act applies to um largely data principles who and what we understand by data principles, if you know the GDPR again, uh they would be data subjects under under the the act.
00:10:17.519 --> 00:10:22.799
So data principles are the individuals to whom the personal data pertains.
00:10:23.200 --> 00:10:31.759
Um so I think it applies to uh anybody within within India and how their personal data is getting processed.
00:10:32.080 --> 00:10:36.799
We will be looking at children under the age of 18, which I think is a really good thing.
00:10:36.960 --> 00:10:47.679
Um, you know, with the GDPR, it kind of leaves it up to the member states to decide what is the legal age of consent, whereas um the the DPDP act is very, very clear.
00:10:47.759 --> 00:10:52.000
Um, a child is anybody under the age of 18, which is which is good.
00:10:52.159 --> 00:10:56.480
Um, I think we're going to be talking about that later on in in um other questions.
00:10:56.639 --> 00:11:06.720
But um, so you have the data principle, and then you have data fiduciaries, like I said before, is very similar to the data controller under the the GDPR.
00:11:07.440 --> 00:11:11.200
And we have the same kind of terminology for data processors.
00:11:11.440 --> 00:11:32.480
So in the Indian Act, that you have a data processor which would take the personal data from the data fiduciary and process it in some way for the data fiduciary, but the data producery, like the controller under the GDPR, is still responsible for the personal data that the data processes, the data processor processes.
00:11:32.799 --> 00:11:45.200
The act also creates a concept of um what they have called significant data fiduciaries, and these are large or high-risk organizations that must meet extra obligations under the act.
00:11:45.279 --> 00:11:59.600
Um, and these obligations would be things like appointing a data protection officer or conducting uh data protection impact assessments, and uh maybe also like um having to undergo periodic audits and so on.
00:11:59.840 --> 00:12:24.080
Um, the scope of the of the act applies, like I said before, where the personal data is digital or is going to be digital, um, and as well the processing is where that you know that it applies to where the processing of the personal data is within India, um, or it relates to offering goods or services to data principles in India.
00:12:24.639 --> 00:12:41.279
So when you think about it from the perspective of the DDPR, it's quite similar in that respect, the narrower focus because it looks more primarily at digital data as opposed to kind of the personal data that could be also paper-based under the GDPR.
00:12:42.559 --> 00:12:50.720
So um, question four, then Katie, for you would be when does the DPDP Act actually come into force?
00:12:50.960 --> 00:12:53.200
And what is its current status?
00:12:54.080 --> 00:13:08.000
I'll just start off answering that question with a kind of bit more to do with the history again, but the act itself actually replaces the Informational Technology Act of 2000.
00:13:08.799 --> 00:13:23.919
So that regime under that act remains in force until the end of the final implementation of the DPA, which is in different phases, so it's not all at once, basically.
00:13:24.000 --> 00:13:36.000
So uh the act itself, as I said, it was passed in August 2023, but uh, I mean, like a lot of legislation, that wasn't an overnight deadline for all these companies.
00:13:36.240 --> 00:14:01.279
Um the key structural provisions, including the definitions, the territorial scope, as you were saying previously, the creation and powers of the data protection board of India, that is what went into force this November, which is what we were saying earlier, um, alongside the personal data protection rules.
00:14:01.919 --> 00:14:09.039
So the law requires firms to safeguard the data of Indian citizens.
00:14:09.200 --> 00:14:19.360
Obviously, there is exceptions um for kind of official official state, what they call it as instrumentality.
00:14:20.240 --> 00:14:26.720
Um and they do actually enforce penalties for firms that breach those obligations.
00:14:26.960 --> 00:14:46.879
So they are gonna have to, you know, nothing's basically nothing is stopping firms from sharing information that kind of helps the state, you know, similar similar to GDPR, you know, like investigation of crime, your tax um financial regulations and stuff, employment regulations.
00:14:47.279 --> 00:14:54.159
Enforcement timeline itself is scheduled to kick in fully in 2026 and 2027.
00:14:54.559 --> 00:15:19.360
So for instance, data fiduciaries who collect and use personal data have until November 2026 to comply with a number of provisions, including hiring and integrating a DPO, a data protection officer, into their into their organization, um, which is something we're quite we're quite well versed in.
00:15:19.519 --> 00:15:28.960
Um so I mean that's that's not new, that's something that there's going to be a lot of resources out there to help Indian companies kind of adopt.
00:15:29.200 --> 00:15:43.679
Uh the same month, they are gonna need to bring in a consent manager framework, which allows firms to exercise data removal and amendment of rights on our behalf of data principles.
00:15:44.799 --> 00:15:55.919
And then the 2027 phase is for large technology firms to be subject to the full force of the act.
00:15:56.399 --> 00:16:03.360
So, and that's also when the data protection board of India are going to have their the ability to exercise their full powers.
00:16:03.600 --> 00:16:16.480
So basically, it starts this is last December or November, it starts last month and it's gonna be going on for two years to basically have full compliance with the act.
00:16:17.039 --> 00:16:27.279
So the number they've set the number of the data protection board, which is it's basically the Indian enforcement authority for this piece of legislation.
00:16:27.440 --> 00:16:29.519
They've set the number of members to four.
00:16:30.080 --> 00:16:39.279
They can they're gonna be able to hold inquiries in response to complaints, they're gonna be able to impose penalties uh in cases of data breaches.
00:16:39.759 --> 00:16:48.320
As of yet, they haven't chosen the board members, but they're gonna be appointed by the Ministry of Electronics and Information Technology.
00:16:49.039 --> 00:17:05.200
So basically, this is the first kind of window where organizations holding Indian digital personal data can kind of take a look at it and evaluate where they stand in relation to this legislation.
00:17:05.440 --> 00:17:08.000
And it's better to start early than never.
00:17:08.079 --> 00:17:16.319
You know, you have a a year to kind of get your DPO in order, but that year it's not going to be long creeping up.
00:17:16.880 --> 00:17:17.759
Absolutely, yeah.
00:17:17.839 --> 00:17:22.960
But it's good that they give them time to kind of get their ducks in order before it actually comes into effect.
00:17:23.519 --> 00:17:24.240
That is true.
00:17:24.799 --> 00:17:32.799
We had something similar with the GDPR, so we had two years, do you remember from before like uh the GDPR came into effect in 2016?
00:17:33.039 --> 00:17:44.960
No, sorry, the GDPR was passed in 2016, but they had the organizations in Europe had two years to become compliant before the 25th of May, which was 2018.
00:17:45.119 --> 00:17:46.319
So it was something similar.
00:17:46.480 --> 00:17:50.720
We have something similar with the EU data protection or the EU AI Act as well.
00:17:50.880 --> 00:17:53.039
So that's a phased implementation.
00:17:57.920 --> 00:18:02.559
What are the core components of the act, would you say, Maria?
00:18:02.720 --> 00:18:07.039
Like how would you how would you compartmentalize it?
00:18:08.240 --> 00:18:16.319
Okay, so I think um we have kind of covered a lot, but um I think what you what I mean again, there's various different layers.
00:18:16.400 --> 00:18:21.519
You can go into a lot of detail or you can kind of um give a kind of high-level overview of the act.
00:18:21.759 --> 00:18:25.039
You could break the act down into kind of five sections.
00:18:25.759 --> 00:18:38.880
Um, and these five sections for people that have already um worked with the GDPR, uh, I broke it, I've broken it down into five sections that would be kind of familiar to people um that have worked with the GDPR.
00:18:39.039 --> 00:18:58.960
So the first section would be kind of the lawful grounds for processing, the second would be notices and consent, the third would be data principal rights, um, and the fourth would be then the obligations of the data fiduciaries, and then we'll we'll talk about the enforcement and the penalties of the um of the act.
00:18:59.200 --> 00:19:02.720
So the first one, like I said, was lawful grounds for processing.
00:19:02.799 --> 00:19:06.640
So there's a few differences here between the GDPR.
00:19:06.880 --> 00:19:17.519
Um so processing must be for a lawful purpose and based either on consent or specific legitimate uses that are listed in the act.
00:19:17.599 --> 00:19:21.519
Okay, so you don't have article six like you do in the GDPR.
00:19:21.759 --> 00:19:28.720
Consent is kind of primary apart from specific uh use cases within the act.
00:19:28.960 --> 00:19:48.720
Um, legitimate uses that would be listed in the act include things like the provision of state benefits and subsidies to individuals, so the state would have to process their personal data, um, compliance with other other laws, and you mentioned you know the uh law enforcement there would be would be something to consider.
00:19:49.200 --> 00:19:58.319
And then you have things like um public emergencies, you may have to process people's information if there's an emergency or if there's a personal emergency for the individual.
00:19:58.480 --> 00:20:09.279
Um, so they would be taken into consideration, and then of course, certain employment purposes as well, where you don't actually have to process somebody's uh information without the requirement for specific consent.
00:20:09.680 --> 00:20:24.079
Um, I think what's important here, and a kind of a significant uh divergence between the GDPR and the Indian Act is they don't actually they don't create a special category for sensitive data.
00:20:24.160 --> 00:20:30.720
So there's no special category data under under the Indian Act as opposed to the GDPR, so there's no article nine.
00:20:30.960 --> 00:20:42.559
Uh it it so that the whole theory behind that would be that personal data is personal data and it it requires the highest protection, regardless of what type of personal data it is.
00:20:43.039 --> 00:20:49.119
So can I just ask you a question on the the lawful grounds of of processing?
00:20:49.599 --> 00:20:51.440
Are them legitimate uses?
00:20:51.599 --> 00:20:53.519
Is that an exhaustive list?
00:20:54.799 --> 00:20:56.240
I think so.
00:20:56.400 --> 00:21:06.079
I think that they're brought so there's a list within the the act, and they seem to be broad enough to actually uh include whatever's needed.
00:21:06.240 --> 00:21:22.079
Um I don't think, and I could be wrong now, but I don't think you're allowed, they're quite specific and they're quite um uh they're quite contained in that, you know, you like there, there's a list there and you have to abide by the list, from what I understand.
00:21:22.480 --> 00:21:34.559
So, like the you know, because of Article 6 under the GDPR, there's a lot of there's a lot of room for interpretation under the GDPR, whereas I don't think that's there in the Indian Act.
00:21:34.720 --> 00:21:44.079
So you either have to find you either have to get the individual to consent um or you have to find um a way to fit it into the legitimate uses.
00:21:44.160 --> 00:21:51.119
If you can't fit them into the legitimate uses, my understanding is then you have to get consent, otherwise, you just can't process the data.
00:21:51.759 --> 00:21:53.440
Notices and consent.
00:21:53.680 --> 00:21:57.440
Um, and I I think it's quite similar to the GDPR in this area.
00:21:57.519 --> 00:22:18.480
So data fiduciaries must give a clear Notice describing what data will be collected, for what purpose it's going to be collected, and what and how the individual can exercise their rights, and how they can, you know, the means for complaining to the data protection board as well, if they're not happy with the treatment and so on.
00:22:18.880 --> 00:22:28.000
Also, if the organization that's collecting the data has a DPO, they have to provide access or how to be able to contact the DPO of the organization.
00:22:28.160 --> 00:22:37.279
Or if they don't have a DPO, then they have to give access details to the grievance officer or the grievance contact in that organization.
00:22:37.440 --> 00:22:44.559
So if the individuals or the data principals have grievances, they they know how they can contact the organisation.
00:22:45.039 --> 00:22:57.279
Notices must be in English, and they and any kind of official Indian languages they you know that's necessary for providing to the individual.
00:22:57.440 --> 00:23:04.079
There's 22 Indian languages in total, so that could be quite a bit of work.
00:23:04.240 --> 00:23:12.720
And consent must be free, specific, informed, unambiguous, and signalled by a clear affirmative action.
00:23:12.799 --> 00:23:16.079
So it's it's very similar, in my opinion, to the GDPR.
00:23:16.559 --> 00:23:18.880
The data subject principal rights.
00:23:19.119 --> 00:23:31.440
So I won't get into too much detail here because I think we have a full question on this coming up, but so the data principles' rights are slightly more specific than the rights under the GDPR.
00:23:31.599 --> 00:23:33.200
I think there's four of them there.
00:23:33.519 --> 00:23:43.200
So the individual has the right to obtain a summary of the personal information that's being processed by the data fiduciary, and that's called the right to information.
00:23:43.359 --> 00:23:58.240
They have the right to seek the correction, completion, or updates of personal data, and the right to request erasure of data when the purpose has been met, or if they withdraw their consent, and that's called the right to correction and erasure.
00:23:58.480 --> 00:24:12.240
They have the right to have grievances addressed by the data fiduciary and to approach the data protection board if unsatisfied by the actions of the data fiduciary, and that's called the right to grievance redressal.
00:24:12.799 --> 00:24:30.319
Um, data principals also have the right to nominate another person to exercise rights in the event of death or incapacity, which is a really interesting right, and we'll get into that more in detail when we kind of have the specific question on uh data principal rights.
00:24:30.559 --> 00:24:44.720
But it doesn't exist in the GDPR, but if you know that you are, you know, if you have awareness that you're going to die or if you're going to be incapacitated, you can actually nominate another individual to assume your rights, your data protection rights.
00:24:44.799 --> 00:24:49.200
And I'll go into that in more detail in the next questions.
00:24:49.599 --> 00:24:58.880
Um, the obligation of data fiduciaries, they remain responsible for compliance, including any processing carried out by their data processors.
00:24:59.039 --> 00:25:19.599
They must ensure data accuracy where it affects decisions, put in place appropriate technical and organizational measures, again like the GDPR, to protect the data with reasonable security safeguards, and they must notify the board, the data protection board, and affected individuals in the event of a personal data breach.
00:25:19.839 --> 00:25:25.920
Then the fifth um area, the fifth category I kind of specified would be enforcement and penalties.
00:25:26.079 --> 00:25:38.319
And again, this is very similar to the GDPR in that they're quite um onerous, they're quite heavy fines for data fiduciaries if you know if they are found guilty of negligence.
00:25:38.480 --> 00:25:44.640
So a day the Tata Protection Board of India can investigate breaches and impose monetary penalties.
00:25:44.880 --> 00:26:00.880
The fines can range from 50 crore up to 250 crore per violation, and an example of a violation would be failing to take security measures or violating children's data obligations, which is taken very seriously under the act.
00:26:01.039 --> 00:26:07.200
So you're talking, if you're talking about 250 crore, you're talking about millions of euro, like tens of millions of euro.
00:26:07.759 --> 00:26:20.640
So again, like the GDPR, the the fines would be so heavy that you know it would encourage organizations not to breach the data or to to ensure that they're compliant with the data.
00:26:20.960 --> 00:26:21.680
It's deterrent.
00:26:22.079 --> 00:26:22.559
It's a deterrent.
00:26:24.240 --> 00:26:25.119
Absolutely, yeah.
00:26:25.279 --> 00:26:25.839
Yeah.
00:26:26.000 --> 00:26:31.119
Um, and like I said, we'll get into more details about the um data subject rights in the next few questions.
00:26:31.279 --> 00:26:40.559
But question six, Katie, what rights do individuals get under the DPDP Act and how do they differ from the GDPR?
00:26:41.039 --> 00:26:49.039
This is kind of more specific, so I kind of touched on the data subject rights or the data principle rights, but again, now we're getting more specific into the rights.
00:26:49.519 --> 00:26:59.519
So I think for this question, I might kind of present it in a way that's more focused on the actual data principles rather than the companies.
00:27:00.160 --> 00:27:14.799
So under the DP DP Act, individuals have the right to ask what personal data is being processed and get access to that information.
00:27:15.680 --> 00:27:23.119
They can request correction, completion, and the updating and erasure of their data.
00:27:23.279 --> 00:27:28.720
So I suppose uh equivalent to erasure and rectification.
00:27:29.680 --> 00:27:40.319
Um, you can raise grievances and escalate those grievances to the data protection board if they're not satisfied with the company that you raise that grievance with.
00:27:40.559 --> 00:27:52.480
I think that you do have to raise the grievance with the organization first, and then at that point where you're not satisfied with how they dealt with it, then you escalate it to the data protection board.
00:27:53.119 --> 00:28:06.400
And as Maria was saying, something quite interesting and unique to India, which is the ability to nominate someone to exercise those rights on your behalf in the case of death or incapacity.
00:28:06.880 --> 00:28:24.559
And I suppose, of course, you can, in a sense, nominate someone as in a family member or a solicitor to exercise your rights under the GDPR, but the main difference here is that it doesn't apply in the case of death.
00:28:24.799 --> 00:29:00.720
So in the Indian context, these laws still apply to a deceased individual's information, which is quite an interesting distinction because the GDPR applies explicitly to living individuals, and then so when an individual might become deceased, and if the relatives are kind of trying to make that process easier for them, trying to get their information back to make their own arrangements, it kind of can result in a bit of a block to that.
00:29:00.960 --> 00:29:12.799
So that's not going to be the case in India once this act comes into full force, which is kind of a nice, a nice thing for the families, to be honest.
00:29:12.880 --> 00:29:14.960
It's a nice distinction to have made.
00:30:33.440 --> 00:30:39.599
You can consider the fact that you know this often causes family feuds, disagreements in families.
00:30:40.640 --> 00:30:48.640
The data controller doesn't really know under the GDPR what they have to do or who they give the information to, and so on.
00:30:48.720 --> 00:30:59.200
So it just makes a very clear procedure for the for the data fiduciary and it eliminates all that kind of stress around illness and around death, you know, for the family.
00:30:59.279 --> 00:31:00.880
So I think it's a really good one.
00:31:02.240 --> 00:31:29.359
And I suppose the fact that the data principal nominates someone, you know, like there's kind of a transfer of authority there that the data fiduciary can be sure that, you know, whether they're family or not, they're not just releasing someone's personal data to, you know, someone who might not have the data principal's best interests at heart, you know, because they're the ones who made the nomination as well.
00:31:29.839 --> 00:31:30.880
Yeah, yeah, I agree.
00:31:30.960 --> 00:31:31.519
Yeah, yeah.
00:31:31.680 --> 00:31:33.359
That's very it's it's a good one, yeah.
00:31:33.519 --> 00:31:34.319
Yeah, for sure.
00:31:34.720 --> 00:32:03.279
So yeah, I suppose the other two biggest differences the GDPR does have a more extensive catalog of rights, like in the Indian Act, we don't see the right to data portability, we don't have we don't see the right to object at right to processing, and there isn't those specific provisions uh in relation to automated decision making and profiling that you do see in the GDPR.
00:32:03.680 --> 00:32:11.519
So there's no explicit obligation for data portability.
00:32:11.839 --> 00:32:22.799
So yeah, data portability, automated decision making, and objection, they're the three main GDPR rights that we don't see merge in the Indian PD PD.
00:32:23.039 --> 00:32:44.640
And another interesting one is that individuals actually have a duty, they they have a duty not to file false complaints or provide false information, and they they do have penalties uh for breach of those duties, which the GDPR doesn't have, which I think is kind of quite interesting.
00:32:44.880 --> 00:33:03.200
And personally, I quite like this because I know that you have the provision in the GDPR for the vexatious or manifest to be able to deny a vexatious or manifestly unfounded data subject access requests, but it's quite a high burden of proof for that.
00:33:03.519 --> 00:33:08.799
And you know, sometimes you can you take it on a case-by-case basis.
00:33:08.880 --> 00:33:29.759
So sometimes you're kind of you know wrestling with whether it is or not, whereas here the individual has the duty not to, I don't know, I feel like it's kind of a bit of a parallel in the sense, and it's actually saying, you know, don't waste people's time, you know, don't abuse these rights that you have in relation to your data, which I quite like.
00:33:30.079 --> 00:33:37.039
I totally agree because under the GDPR, again, there's no oblig there's no kind of um deterrent for people.
00:33:37.279 --> 00:33:48.559
So um, as you know, Katie, you know, um there's quite you can have quite a lot of vexatious uh requests, data subject requests, and they can go on for years sometimes.
00:33:48.799 --> 00:33:50.640
And um god, yeah.
00:33:50.880 --> 00:33:55.279
You know, so to avoid that for organizations, I think is a massive thing.
00:33:55.359 --> 00:34:07.599
Um, and the day the data principal in India will definitely think twice if they feel like there could be consequences for them um, you know, after one or two or three requests.
00:34:07.680 --> 00:34:08.400
Do you know what I mean?
00:34:08.480 --> 00:34:20.960
They may actually, you know, and it m it'll be it be easier for the organization as well to kind of push back and say, look, you know, this you know, uh you have obligations as well to not waste our time and so on.
00:34:21.039 --> 00:34:22.159
So I think it's a really good thing.
00:34:22.239 --> 00:34:23.360
I totally agree with you.
00:34:23.519 --> 00:34:33.039
I think that's one of the the weaknesses of the GDPR uh in that we it's very vague what vexatious requests are, you know.
00:34:33.599 --> 00:34:54.960
Um although the omnibus is dealing with that in in you know, it we don't know the final the final um wording, but it does it does touch on the fact that I think across Europe now everybody is aware that there's quite a lot of vexatious uh data subject access requests.
00:34:56.800 --> 00:34:57.920
It is true, yeah.
00:34:58.000 --> 00:35:16.239
And it's it's quite frustrating when you're spending days work full working multiple working days fulfilling a D SAR where you know the person actually they're not a pre they're like they don't actually want their data.
00:35:16.400 --> 00:35:26.800
They you know when you're doing all this work to get it ready and to send it out to them, and you know it's almost for nothing because they didn't kind of submit it in good faith.
00:35:27.119 --> 00:35:28.800
Yeah, and it's for another reason.
00:35:28.960 --> 00:35:33.920
It's not actually because they want to access their data, like you say, but it's another reason why they're doing it.
00:35:34.400 --> 00:35:35.280
Uh so yeah.
00:35:36.079 --> 00:35:39.119
You can't just throw throw it around willy-nilly either.
00:35:39.440 --> 00:35:40.639
Yeah, yeah, absolutely.
00:35:40.719 --> 00:35:42.320
There has to be a balance there again.
00:35:42.559 --> 00:35:49.920
Yeah, and that's why I said in the first question, it I think the the this act, the Indian Act, does get that balance well.
00:35:50.159 --> 00:35:51.280
It does get it right.
00:35:51.519 --> 00:36:15.119
And that's evidenced by the fact that you know there are obligations on the data principles, like we've just said, but as well, it's evidenced by the fact that now in Europe they're they've they're coming out with the digital omnibus um and they're making changes to the GDPR because um there has been feedback at a European level that the GDPR can be quite onerous for SMEs and so on.
00:36:15.280 --> 00:36:17.840
So yeah, so that's interesting.
00:36:18.239 --> 00:36:22.719
I suppose the GDPR is kind of like the first child of the family.
00:36:23.280 --> 00:36:24.000
Absolutely.
00:36:24.400 --> 00:36:28.239
Yeah, and the other apps are like learning from the eldest siblings.
00:36:28.559 --> 00:36:29.280
Yeah, it's great.
00:36:30.400 --> 00:36:31.119
Yeah, absolutely.
00:36:31.280 --> 00:36:35.760
They see what's going on in Europe and they can avoid those pitfalls for sure, yeah.
00:36:35.920 --> 00:36:36.559
Yeah.
00:36:36.880 --> 00:36:50.639
Um but yeah, so I think we'll move on now to how does the DPDP Act handle consent and how does that compare with consent under the GDPR?
00:36:51.280 --> 00:36:51.920
Okay, great.
00:36:52.000 --> 00:36:52.800
Thanks, Katie.
00:36:53.199 --> 00:37:03.679
So consent under the DPDP Act looks quite familiar if you're if you're if you've already worked with the GDPR.
00:37:03.840 --> 00:37:11.119
So it must be free, specific, informed, unambiguous, and indicated through a clear affirmative action.
00:37:11.199 --> 00:37:13.760
So that would be like a tick mark or something like that.
00:37:13.920 --> 00:37:16.960
Um explicit consent under the GDPR.
00:37:17.199 --> 00:37:26.639
So the act goes a step further by explicitly calling consent unconditional, which is not in the definition of in the GDPR.
00:37:26.800 --> 00:37:33.119
The idea being that access to essential services shouldn't be tied to unnecessary data collection.
00:37:33.440 --> 00:37:49.599
The act requires a concise, clear notice at or before the time of collection, explaining what data will be processed, for which purposes, how rights can be exercised, and how to complain to the data protection board.
00:37:49.840 --> 00:37:54.000
Um, very similar to the GDPR transparency requirements.
00:37:54.320 --> 00:38:05.920
Where the difference emerges between the DPDP and the and the GDPR is that the Indian Act uh leans heavily on legitimate uses.
00:38:06.159 --> 00:38:19.599
So these are what we call statutory carve-outs, like specific, a specific list where consent isn't needed at all, and that it relates to the you know the state processing uh individuals' personal data.
00:38:19.760 --> 00:38:55.039
So, like I said before in one of the other questions, um like when you know you're dealing with state sub subsidies, uh, legal claims, employment-related processing, and so on, the GDPR has multiple legal bases, but um the Indian list is drafted more as a set of legislative exemptions, and there's no and another important difference between the Indian Act and the GDPR is that there's no legitimate interests in um within the consent in the Indian Act.
00:38:55.119 --> 00:39:05.679
So we have the legitimate interest as one of the six legal bases under Article Six of the GDPR, and that doesn't exist under the Indian Act.
00:39:05.920 --> 00:39:10.400
So, like I said before, consent is much more specific.
00:39:10.639 --> 00:39:16.400
I have a table here as well, so I can go through that and kind of um outline the differences.
00:39:16.559 --> 00:39:25.440
So the definition of consent under the Indian Act is the words would be free, specific, informed, unconditional, and unambiguous.
00:39:25.599 --> 00:39:32.320
Whereas with the GDPR, it's consent must be freely given, specific, informed, and unambiguous.
00:39:32.480 --> 00:39:41.519
Um, the legal basis, so you have legitimate uses under the Indian Act, whereas you have the six alternative legal basis in the GDPR.
00:39:41.679 --> 00:39:50.320
Um, legitimate interest does not exist in the Indian Act, and it does exist um under the um the GDPR.
00:39:50.639 --> 00:40:05.280
Children's data as well, that's a significant difference in that children have to are defined as being under 18, whereas with um the GDPR, member states get to decide what is the legal age.
00:40:05.360 --> 00:40:13.679
So you sometimes you have it as low as 13, the age of you know, the age of consent is 13, and sometimes it's 16, and then 18 as well.
00:40:13.920 --> 00:40:18.400
So, in my opinion, I think that's better because it protects children more.
00:40:18.960 --> 00:40:25.840
There's no special category data under the Indian Act, whereas there is in in um the GDPR.
00:40:26.400 --> 00:40:29.440
Um, yeah, so that I think that's basically it.
00:40:30.000 --> 00:40:46.800
So, in terms of the differences and so on, yeah, I would say legitimate uses would be the main difference, and the fact that there's no special category data and there's no legitimate interests um under the Indian Act would be the three main things, I think.
00:40:53.840 --> 00:41:01.840
So, Katie, how are children's how is children's data you uh processed or handled under the Indian Act?
00:41:02.000 --> 00:41:09.199
And uh and can you talk to us a little bit about the sensitive use cases that would be referred to in the Indian Act?
00:41:09.760 --> 00:41:25.280
So I suppose you touched on that a bit by saying that a child is defined as under 18, which is a more strict approach than the GDPR has explicitly taken.
00:41:25.440 --> 00:41:31.039
I mean, whether an individual member state has chosen 18, I think in Ireland it is 18.
00:41:31.440 --> 00:41:44.960
Um but yeah, basically the whole yeah, that's 18 is the hard and fast rule for a child in as far as Indian data protection goes.
00:41:45.440 --> 00:41:55.119
Section 9 of the Act imposes strict and mandatory obligations on data fiduciaries when they deal with children's data.
00:41:55.440 --> 00:42:03.039
They need to obtain verifiable parental or guardian consent before processing their personal data.
00:42:03.519 --> 00:42:27.360
And I know that there was no kind of general data subjects' rights when it came to profiling, but it is a bit of a different case when it comes to children because the act does prohibit tracking, uh, behavioral monitoring, targeted advertising directed at children and any processing that's likely to cause a detrimental effect on child's well-being.
00:42:27.519 --> 00:42:34.880
So, you know, today's day and age that's quite important, and that could be interpreted quite broad.
00:42:35.039 --> 00:42:41.039
And this is also one of the aspects of the act that the tech companies had issue with.
00:42:41.280 --> 00:42:50.079
So I think that that says a lot that anyone would kind of have issue with these safety guards being put in place for children.
00:42:50.400 --> 00:42:51.519
Says a lot.
00:42:52.079 --> 00:43:03.039
So there's uh another table here that outlines more specifically the obligations on data fiduciaries.
00:43:04.079 --> 00:43:09.760
So from consent, it needs to be verifiable parental consent.
00:43:09.840 --> 00:43:13.679
It's mandatory before processing any data.
00:43:14.000 --> 00:43:19.760
And you're they're also going to need to make a reasonable effort to verify the age of the child.
00:43:20.159 --> 00:43:26.800
Processing without this consent is prohibited, so strictly prohibited.
00:43:26.960 --> 00:43:31.360
So if they want to find a way around that, then the processing is illegal.
00:43:31.920 --> 00:43:43.360
And I think there are some significant fines as well in terms of if you know if it's judged that they have uh breached uh children's rights, there are significant fines attached to that.
00:43:43.519 --> 00:43:45.599
So again, that's a deterrent.
00:43:46.000 --> 00:43:48.800
You know, yeah, which I mean, rightfully so.
00:43:48.960 --> 00:43:53.760
Again, like the this this is the kind of stuff that needs to be in place.
00:43:53.840 --> 00:43:55.119
Otherwise, what's the point?
00:43:55.360 --> 00:44:04.000
You know, if you're not putting safeguards for children in place, then what's the point of having A d digital data protection regulation in the first place, in my opinion.
00:44:04.239 --> 00:44:04.639
I agree.
00:44:04.800 --> 00:44:07.920
They're the most vulnerable in society, so they need protection.
00:44:08.079 --> 00:44:08.639
Yeah.
00:44:09.360 --> 00:44:25.039
Um so targeted uses, data fiduciaries must not process personal data of a child in a manner that is likely to cause a detrimental effect on the child's well-being.
00:44:25.440 --> 00:44:38.960
So I mean, you could argue that that's things like you know, social media, which you know, there's a lot of studies out there to say that it does affect grown adults' mental health, never mind children's.
00:44:39.039 --> 00:44:42.880
So, you know, that's an objective detrimental effect on their well-being.
00:44:43.199 --> 00:44:43.840
Absolutely.
00:44:44.159 --> 00:44:49.679
I wonder how that's I'm interested to see how that will actually translate into practice.
00:44:49.920 --> 00:44:50.159
Absolutely.
00:44:51.119 --> 00:44:53.039
Any changes, I don't know, but yeah.
00:44:53.280 --> 00:44:54.880
Can I can I just say one thing as well?
00:44:55.039 --> 00:45:08.960
You know, um, the GDPR came in in 2018, and I think um, like you say, Europe has kind of suffered from being the first mover in this area, so they didn't really put those laws into place to protect children.
00:45:09.119 --> 00:45:24.400
But then the Digital Services Act came in in 2024, and if you look at that, there's a lot of those that you see from the from the Indian Act, there's a lot of those kind of same protections in place now in the Digital Services Act.
00:45:24.639 --> 00:45:43.199
So, so yeah, again, we we kind of suffered from our own kind of first mover kind of um benefits there, in that you know, all the rest of the legislation across the globe saw what was happening in Europe, and then they can actually have one act that kind of covers everything.
00:45:43.280 --> 00:45:53.119
Uh, whereas Europe has to kind of bring in another act because you know the GDPR didn't really cover, didn't really um cover protection of children.
00:45:53.280 --> 00:46:05.360
Again, I think at the time at 2016 and even back in 2014 when they were writing the GDPR, it wasn't half as much of an issue as it is nowadays, you know.
00:46:05.440 --> 00:46:11.920
So but there there are those protections there, but but it's not the GDPR, it's more the Digital Services Act.
00:46:12.559 --> 00:46:32.320
Yeah, I think the drafters couldn't have known, and I suppose it's not all bad because it has served an as an example internationally, and I feel like that's kind of a win at the same time that these provisions are in the you know, are in the PDPD at the end of the day.
00:46:32.719 --> 00:46:34.000
Absolutely, yeah, yeah.
00:46:34.320 --> 00:46:39.199
They also have banned targeted advertising for children.
00:46:40.639 --> 00:46:42.239
I think that's quite a good thing.
00:46:42.480 --> 00:46:43.760
Yeah, and I agree.
00:46:44.719 --> 00:46:52.000
They they I think they do have certain exceptions, uh, there are narrow exceptions.
00:46:52.159 --> 00:47:10.639
Um certain classes of data fiduciaries, like clinics and educational institutions, are exempt from certain obligations like parental consent for processing every little piece of data when processing is necessary for specified purposes.
00:47:10.880 --> 00:47:38.800
And a couple of the specified purposes here are for providing health services, um, child safeguarding or essential services, which I mean that is necessary at the end of the day because there's always that question with kind of kids, schools and sports clubs about like we need to do this for a child, or we're worried about this child, but we don't know what our data protection obligations are in relation to that.
00:47:38.960 --> 00:47:44.159
So it's kind of hopefully we'll avoid that situation.
00:47:44.880 --> 00:47:46.079
Yeah, absolutely.
00:47:46.880 --> 00:47:56.960
So there are penalties, uh, violations of the obligations relating to the data of children can attract penalties of up to 200 crore.
00:47:58.079 --> 00:48:04.480
So I guess in the millions, so it's significant significant deterrent there.
00:48:04.880 --> 00:48:07.199
Yeah, in comparison to the GDPR.
00:48:08.480 --> 00:48:10.719
I mean, they're uh they are comparable, obviously.
00:48:10.800 --> 00:48:25.119
That's what we're doing here, but um the GDPR says that the age threshold can be as low as 13, and member states do have the authority to kind of decide where they're going to draw the line with children.
00:48:25.360 --> 00:48:28.480
And India has chosen uniform 18-year threshold.
00:48:28.559 --> 00:48:38.719
And as you said, Maria, that some of these provisions they're not in the GDPR, but they're still in Europe because it's kind of a bit of a trial and error.
00:48:39.039 --> 00:48:47.599
So it's just quite nice that they are all in the same piece of legislation, so people aren't kind of running over their tails as much, I suppose.
00:48:48.480 --> 00:48:55.679
And aside from children, they do also have sensitive use cases in the DPDP.
00:48:56.880 --> 00:49:13.360
This is not special category data, but it's basically uh applies the same high standard of data protection to all personal data, and where the draw of the distinction is what out is is a use case of the data.
00:49:13.440 --> 00:49:14.719
So it's not the data itself.
00:49:14.960 --> 00:49:19.360
The data becomes sensitive when it's being used in a certain way.
00:49:20.639 --> 00:49:36.320
So organizations are gonna need to figure out if they qualify as a significant data fiduciary because it's at this point that this classification give imposes on them stricter compliance obligations.
00:49:36.559 --> 00:49:43.760
It basically comes into play are you a significant data fiduciary or an ordinary data fiduciary?
00:49:44.400 --> 00:49:55.679
And it's not the data itself, it's the volume of data and what you're actually doing with the data that will impose the more stringent obligations.
00:49:56.800 --> 00:49:57.440
Very good.
00:49:58.639 --> 00:50:18.960
So I think we're gonna move on now to cross-border data transfers, which could be quite interesting considering the GDPR is European and we have kind of our own distinctions between data processing and you know, national or EU or outside the EU.
00:50:19.119 --> 00:50:20.880
So, where does it differ?
00:50:21.360 --> 00:50:23.360
Oh, it differs quite a lot, actually.
00:50:23.599 --> 00:50:49.760
So, this is where I think the Indian Act is is completely different to the GDPR, in that if you're again, if you're familiar with the GDPR, then you know that um when you process personal data and you have to transfer it outside of Europe, and you have to uh you have to have um standard contractual clauses, or you have to have you have to make sure that the country that you're sending the data to has an adequacy agreement.
00:50:50.000 --> 00:51:02.800
So you have to ensure that the you know the data that's being sent outside of Europe it will be will have the same level of protection as they they would have if they were um stored within Europe.
00:51:03.039 --> 00:51:10.800
Um so that's kind of like a it's a uh adequacy um model that the European or the GDPR follows.
00:51:11.039 --> 00:51:16.239
Here with the DPDP Act, it's a blacklist model.
00:51:16.480 --> 00:51:33.840
So um you can actually process, you can actually transfer data um to across across the borders to different countries um outside of India unless the Indian government has actually blacklisted the country that you want to send it to.
00:51:33.920 --> 00:51:42.639
And then that's if the the country has been blacklisted by the Indian government, then you cannot send personal data to that country.
00:51:42.800 --> 00:51:57.199
So as opposed to seeking adequacy um and ensuring that the you know the country that you're sending the data to has adequacy with the act, they are basing their transfer requirements on um blacklisting certain countries.
00:51:57.360 --> 00:52:11.679
So if you're not on the blacklist, uh if you're not on the blacklist, then there are no kind of other requirements that the the DPDP Act um puts on uh data fiduciaries when transferring personal data.
00:52:11.760 --> 00:52:36.800
Um and so far, and again, this is early days, but uh the blacklist uh hasn't been published by the Indian government, so um, you know, you can actually transfer data outside of India to countries um at the moment without um that you know, there's no kind of list, you don't have to check up on any list to ensure that they haven't been blacklisted because the list hasn't been published yet.
00:52:36.960 --> 00:53:07.199
But what I would say to you know, for people that are you know looking at this act and wanting to comply with the act is that you would, you know, make sure that you have some sort of contract in place to ensure that you know um your the personal data gets protected um to the same level as the you know as the act requires, because again, if you have a breach, the data produceries are you know they're they're responsible for the data anyway.
00:53:07.360 --> 00:53:21.360
So if you transfer your data to data processes outside of um India, make sure that you have some sort of contract in place just to ensure that you know you reduce the likelihood of of breaches and you ensure compliance.
00:53:21.840 --> 00:53:32.000
So, yeah, so that's an interesting thing that it's kind of kind of it moved away completely from the you know the way the Europe and the GDPR um transfers data.
00:53:32.159 --> 00:53:34.320
So that's that's something yeah interesting.
00:53:35.199 --> 00:53:35.840
Merriamage.
00:53:36.239 --> 00:53:37.840
Yeah, yeah, absolutely.
00:53:38.320 --> 00:53:41.119
So I think we're now at question 10.
00:53:41.280 --> 00:53:44.480
We're hopefully coming close to the end of the podcast.
00:53:44.719 --> 00:53:50.400
Um so Katie, can you talk to us a little bit about the penalties and the enforcement compared to the GDPR?
00:53:50.480 --> 00:54:01.920
Like how and we again we've discussed this throughout the podcast, but you know, can you be more specific about you know what are the penalties under the under the DPDP Act?
00:54:02.880 --> 00:54:16.000
Yeah, so I mean, as we have touched on it before, um, but it is focused on enforcement because at the end of the day, you know, it needs a bit of teeth for there.
00:54:16.239 --> 00:54:24.880
The there was pushback from the technology companies in the end, so there needs to be something to kind of make them kind of yeah, clean up your data and treat it properly.
00:54:25.199 --> 00:54:36.159
Um so the data protection board of India is, as I said previously, the central enforcement authority, and they have powers similar to the civil court.
00:54:36.480 --> 00:54:43.039
So they can call for evidence, they can examine witnesses, they can impose monetary penalties.
00:54:43.599 --> 00:55:03.599
The penalties for data fiduciaries are going to be able to go up to 250 crore per violation, so that can be stacked depending on how many violations an organization has committed or has you know neglected.
00:55:04.000 --> 00:55:13.920
So it could it can equate to roughly tens of millions of euro with a minimum of 50 crore for significant violations under the schedule.
00:55:14.239 --> 00:55:18.960
So there's a there's a floor, there's no ceiling for the fines basically.
00:55:19.199 --> 00:55:25.440
Um and children's data breaches and failure to notify breaches are explicitly called out.
00:55:26.079 --> 00:55:35.199
They do have a ceiling of around 200 crore, but again, this is a poor a per violation.
00:55:35.440 --> 00:55:47.039
So, you know, if if someone has a violation related to children's data and a violation related to breaches, you know, it's gonna stack up quickly.
00:55:47.360 --> 00:55:49.679
I'm gonna move on to the next question.
00:55:50.000 --> 00:55:58.960
If an organization is already GDPR compliant, what do they need to do to be DPDP compliant?
00:55:59.840 --> 00:56:01.119
That's a really good question.
00:56:01.280 --> 00:56:06.960
So again, we you know the GDPR is the gold standard of data protection legislation.
00:56:07.119 --> 00:56:07.920
Do you know what I mean?
00:56:08.000 --> 00:56:11.840
So you think if you're compliant with the GDPR, then you know, oh, we should be okay.
00:56:12.159 --> 00:56:18.559
No, there are certain things that you know you really need to take into consideration in order to be compliant with this Indian Act.
00:56:18.800 --> 00:56:28.239
So if you're compliant with the GDPR, you're probably about 60 to 70 percent covered for the um for the Indian Act.
00:56:28.400 --> 00:56:42.960
Um, so like if you're compliant, we're talking about you'd have your ropas in place, you'd have your uh data protection policies in place, you'd have your DPA DPIAs done, you'd have your data protection agreements in place and so on.
00:56:43.039 --> 00:56:45.679
Um so you're you're already in a very good place.
00:56:45.760 --> 00:56:48.880
You'd have your security protections in place and so on.
00:56:49.039 --> 00:56:55.519
Um, but uh there's a number of DPDP specific gaps that should be anticipated.
00:56:55.679 --> 00:56:58.639
Organizations must assess digital-only scope.
00:56:58.800 --> 00:57:07.199
So, again, it's not about paper-based uh personal data with the DPDP, it's uh uh you know the digital uh personal data.
00:57:07.280 --> 00:57:21.760
So you'd have to kind of look at that, you'd have to look at the territorial relationship of their processing activities, um, make sure that you have contracts in place and so on, and keep an eye on that blacklist, even though the blacklist hasn't been published yet.
00:57:22.000 --> 00:57:27.760
So if you're sending personal data outside of India, you would have to know exactly where you're sending that data.
00:57:27.840 --> 00:57:43.519
Um, so that would have to be done to ensure that if a blacklist is created, then you can very quickly either bring your data back into India or or be rest assured that you know your data is not on any of the countries that are blacklisted.
00:57:43.599 --> 00:57:46.239
So that would be something that you'd have to take into account.
00:57:46.639 --> 00:57:51.840
Again, looking at lawful bases, there's quite a significant difference there.
00:57:51.920 --> 00:58:17.920
You can't rely on legitimate interest, so you'd have to look at your legal bases and um see if you can like the primary uh data protection collection would be consent, so you you no longer would have those six legal bases under article six, so you'd have to kind of revise and how you collect data under you know, under what kind of uh lawful basis you collect data.
00:58:18.079 --> 00:58:20.719
Um, so that's another significant change.
00:58:20.960 --> 00:58:30.880
Um, in terms of data protection rights or data principle rights, I should say the DPD Act provides a more limited set of statutory rights than the GDPR.
00:58:31.119 --> 00:58:36.559
So existing GDPR-based procedures will often exceed the minimal legal threshold.
00:58:36.719 --> 00:58:44.880
Um, so you have to kind of decide: are we gonna keep these rights or are we gonna have specific rights to the to the DPDP?
00:58:45.519 --> 00:58:54.159
Um, so you you'd have to kind of create a policy around that um and decide what you're gonna do in terms of data principal rights.
00:58:54.320 --> 00:58:59.440
And another thing you'd have to do is you'd have to actually decide whether you are a significant data fiduciary.
00:58:59.920 --> 00:59:15.039
So, again, that doesn't exist under the GDPR, but it's important to be able to identify the fact that whether you are or are not one of these, and then if you are, then you'd have to look into what are your obligations under the DPDP Act to ensure compliance.
00:59:15.199 --> 00:59:24.159
So I think the main thing that you should do, even though even if you are GDPR compliant, the first thing you should do is um do a gap analysis.
00:59:24.400 --> 00:59:37.519
Look at what you have in place for the GDPR and identify the gaps and get a plan in place and like um the GDPR, start rolling it out and making sure that you're filling those gaps as you go forward.
00:59:38.159 --> 00:59:45.920
So, so yeah, so but rest assured that you're 60-70% there, so you're in a good place if you're already compliant with the GDPR.
00:59:46.800 --> 00:59:51.920
So we're finally at the last question, and this took a little bit longer than we anticipated.
00:59:52.079 --> 00:59:55.199
I thought it would take about 20 minutes, but it's taking a bit longer.
00:59:55.440 --> 01:00:08.800
Um so, Katie, for the last question, what is the big takeaway for you regarding the difference between the DPDP Act of 2025 or 2023, sorry, and the GDPR?
01:00:10.480 --> 01:00:36.960
Okay, so I'd say in a nutshell, the GDPR is principle-based, rights-driven, detailed obligations, strong independent DPAs, a long list of individual rights, and it's noteworthy that those DPAs are also in each individual member state within Europe.
01:00:38.239 --> 01:00:50.079
Whereas the DPDP Act is a more centralized legal framework and it applies to a lot more individuals than the GDPR at the end of the day.
01:00:50.239 --> 01:00:53.119
Um, it focuses on digital personal data.
01:00:53.599 --> 01:01:11.920
It does give a smaller bundle of rights, but I think that those rights are really meaningful, as we were saying earlier, that they've just given a couple of tweakments here and there that we really like, like the nominations and in relations to children's rights.
01:01:12.079 --> 01:01:20.159
Like I think that just because there's less rights doesn't mean there are it has less protections for the individual.
01:01:20.559 --> 01:01:37.760
Um it leans hard on consent and legitimate uses and the central board is quite powerful, and the fines, it's very it is enforcement focused because the fines are not you know something to just be brushed off your shoulder.
01:01:38.079 --> 01:01:38.960
Absolutely, yeah.
01:01:39.199 --> 01:01:51.440
Um so basically, I would although you said you're 60 to 70 percent there, I still wouldn't treat them as the same thing at the end of the day.
01:01:51.760 --> 01:02:01.360
It has its own model, it's only inspired to a certain extent by the GDPR, it's not completely based off it.
01:02:01.920 --> 01:02:03.119
Yeah, I agree.
01:02:03.280 --> 01:02:14.239
Yeah, and as well, I think a big takeaway that we have discussed throughout the podcast is that I think it has benefited from the fact that it is later than the GDPR.
01:02:14.400 --> 01:02:30.239
Um, and like you say, those eight years of legal kind of discussions and so on, it's quite a thoughtful act, and um, yeah, there's a lot of good kind of protections in there, um, not only for the data principles, but also for the data fiduceries.
01:02:30.320 --> 01:02:39.039
So I think the balance is very, very good between obligations and rights, which uh which maybe the GDPR needs to be revised slightly.
01:02:39.119 --> 01:02:39.679
Yeah.
01:02:40.800 --> 01:02:46.320
Yeah, I could there definitely is a few things we could take back today.
01:02:47.119 --> 01:02:49.199
Yeah, yeah, absolutely.
01:02:49.519 --> 01:02:50.000
Great.
01:02:50.239 --> 01:02:52.639
So um I just want to wrap up here then.
01:02:52.719 --> 01:03:04.960
Um this kind of completes our um discussion on um, and it's the first in uh a series of um podcasts that we'll be doing, and we'll be looking at international data protection rights.
01:03:05.039 --> 01:03:14.639
So I hope you enjoyed the the podcast, and hopefully very soon you'll see myself and Katie back again um with the second second episode in the series.
01:03:14.800 --> 01:03:18.159
So thank you very much for joining us and uh have a great day.
01:03:20.719 --> 01:03:21.280
Bye.
00:00:15.679 --> 00:00:22.800
Hello, everybody, and welcome to the first episode of our series on global data protection regulations.
00:00:23.440 --> 00:00:25.280
I'm Maria Malone, Dr.
00:00:25.359 --> 00:00:29.519
Maria Maloney, and I'm head of research here at Privacy Engine.
00:00:29.679 --> 00:00:40.079
Myself and Katie are talking to you today about the Digital Personal Data Protection Act 2023 in India.
00:00:40.240 --> 00:00:49.439
And the reason why we've started with this for our first episode is because a lot of the act has come into effect in November 2025.
00:00:49.600 --> 00:00:58.000
So we thought it appropriate that we would start our series on international data protection law with the Indian data protection law.
00:00:59.119 --> 00:01:00.560
So as I said, I'm Dr.
00:01:00.640 --> 00:01:03.439
Maria Maloney and I'm head of research here at Privacy Engine.
00:01:03.520 --> 00:01:08.000
And my colleague Katie is just going to introduce herself now and then we can get started.
00:01:08.079 --> 00:01:09.439
So over to you, Katie.
00:01:10.879 --> 00:01:12.719
So I'm Katie Barch.
00:01:12.799 --> 00:01:17.280
I'm a data protection consultant at Privacy Engine.
00:01:18.079 --> 00:01:20.959
My title is Data Protection Legal Specialist.
00:01:21.200 --> 00:01:29.439
So outside of consultancy, I also do bits and pieces of research into global privacy laws.
00:01:46.879 --> 00:01:48.159
Yeah, great.
00:01:48.319 --> 00:01:50.319
So we'll get started.
00:01:50.480 --> 00:01:59.519
We have about 12 questions, and uh so I'm gonna start and then we'll take it, we'll alternate the questions between myself and Katie.
00:02:09.599 --> 00:02:18.960
So the Digital Personal Data Act, or what we call the DPDP Act, which is a bit of a tongue twister, um, is India's first comprehensive data protection law.
00:02:19.039 --> 00:02:32.960
It regulates how digital personal data is processed about individuals in India and how personal data or digital personal data is collected, used, shared, and stored.
00:02:33.280 --> 00:02:36.800
The act tries to balance two things, which I think it does quite well.
00:02:36.879 --> 00:02:57.599
And considering that we have the digital omnibus coming out of Europe uh recently, um, I think uh, you know, we have to with the GDPR, we're kind of going back to the drawing board, whereas with this DPDP act, they seem to have kind of almost gotten the balance right um initially at the at the beginning.
00:02:57.759 --> 00:02:59.599
So that it tries to balance two things.
00:02:59.759 --> 00:03:14.319
On the one hand, um it tries to balance an individual's right to privacy, and on the other hand, it the need for governments and businesses to be able to process data legitimately and without too much burden.
00:03:14.560 --> 00:03:22.719
So that I think and I think it creates a good a good balance there, and we'll go into that in more details um as we go through the questions.
00:03:23.599 --> 00:03:27.919
But um so so that it looks to balance those two things.
00:03:28.080 --> 00:03:42.240
Um the terminology is quite different to um the GDPR that myself and Katie are used to because you know we're we're based in Ireland, and so we have uh we've done a lot of work in the GDPR, but now we're looking into international data protection laws.
00:03:42.400 --> 00:04:02.560
So um we understand a data controller would be an organization that processes personal data, uh, but in the Indian law or in the PDPD Act, um, these data controllers are actually called data fiduciaries, um, but they have similar um obligations under the act.
00:04:02.800 --> 00:04:13.680
Um, also, if you know the GDPR, you are familiar with the term um data processors, and they're actually called the same thing under the PDBT PD Act.
00:04:14.479 --> 00:04:22.639
Um, it covers so the act covers per digital personal data as opposed to just personal data that the GDPR would cover.
00:04:22.800 --> 00:04:33.839
Um, so the GDPR would cover paper-based personal data, whereas um the Indian Act it just handles digitized uh personal data.
00:04:34.000 --> 00:04:49.120
Okay, um, so if you um your organization actually um is doing business with India and you're processing personal data of um Indian citizens, then this is um a data protection law that you need to understand.
00:04:50.000 --> 00:04:55.920
Um, at a high level, the act sets out rules um about how you can process data.
00:04:56.399 --> 00:05:13.519
So there's um the idea of consent, just like the GDPR, but um what's different is that it it uh sets out certain legitimate uses, um and it also has individual rights like the GDPR and security safeguards are also required.
00:05:13.759 --> 00:05:20.240
Um we also will be looking at data breaches because that's also part of the act, just like the GDPR.
00:05:20.480 --> 00:05:29.920
So that's kind of a kind of a broad overview of the similarities and the differences between the DPDP Act and the GDPR.
00:05:30.160 --> 00:05:39.279
Um and now, Katie, if it's okay with you, would you be able to give us a kind of a brief history of um where the act, the DPDP Act came from?
00:05:41.199 --> 00:06:00.879
Yeah, so the act kind of has its roots in a case that started in 2014 after Facebook acquired WhatsApp, um, where WhatsApp's data sharing policy was challenged by the Supreme Court.
00:06:01.279 --> 00:06:13.680
So the case Pudaswamy, it was decided in 2017, and it actually found that in India there is a fundamental right to privacy under the Indian constitution.
00:06:14.319 --> 00:06:23.759
So then they were kind of like, well, people have this fundamental right, how are we gonna facilitate that?
00:06:24.000 --> 00:06:37.920
So following this, the government set up a committee of experts to design a data protection framework, um which ended up in the actual we have today, but it went through three different drafts.
00:06:38.079 --> 00:06:43.519
The first draft came out a year later, the decision in that case, 2018.
00:06:43.920 --> 00:06:48.480
Um it imp it talked about conditions like data localization.
00:06:49.120 --> 00:06:54.240
Um, and at the time, technology firms actually weren't weren't really for it.
00:06:54.319 --> 00:06:56.560
They were quite lobbying against it.
00:06:56.959 --> 00:07:03.839
Um but the official bill came out actually the same year it was finalized, which was 2023.
00:07:04.079 --> 00:07:11.199
It was introduced in August as a bill, and it was passed the same month by presidential assent.
00:07:12.000 --> 00:07:25.600
So the 2023 law is the product of about eight years of legal, political, and technical debate following this judgment that took three years to come to the final conclusion on.
00:07:26.000 --> 00:07:39.360
Um the latest version of the act strips out a lot of the things that were seen in the original draft, but it's as Marie said, it kind of struck that balance that people are looking for.
00:07:39.439 --> 00:07:59.839
It was a lot better received among um both Indian and global tech firms uh because I suppose they're the ones facing the requirements at the end of the day, so it has to go down well with the people who are going to be working with it in their day-to-day work.
00:08:00.160 --> 00:08:07.920
So um NASCOM represents the main IT and technology firms in India.
00:08:08.399 --> 00:08:19.360
Uh, they said in a statement issued through their Data Security Council of India initiative that they welcomed the new the new legislation.
00:08:19.680 --> 00:08:31.839
They had a couple of problems that they that they raised around like parental consent and the deadlines for breaches and stuff.
00:08:32.399 --> 00:08:38.879
But I mean, that's almost stuff that you hear no matter what law, no matter what country it passes through.
00:08:38.960 --> 00:08:47.200
So I would still say that's quite a success to have that level of acceptance with the technology firms is kind of rare.
00:08:48.000 --> 00:08:49.120
I agree totally, yeah.
00:08:49.200 --> 00:08:56.399
You're you're not you're never gonna get them 100% happy, and even if you do get them 100% happy, then that might be a problem in itself.
00:08:56.480 --> 00:08:57.200
Do you know what I mean?
00:08:57.279 --> 00:08:58.960
It might be too lenient, then you know.
00:08:59.200 --> 00:09:08.240
Yeah, and like things like parental consent, you know, it there's no point having uh uh data protection law if you're not gonna include things like that anyway.
00:09:08.320 --> 00:09:09.759
So absolutely, yeah.
00:09:09.919 --> 00:09:12.000
What's it all for if you don't protect children?
00:09:12.080 --> 00:09:12.720
Do you know what I mean?
00:09:13.039 --> 00:09:13.519
Exactly.
00:09:13.759 --> 00:09:14.240
Yeah.
00:09:14.480 --> 00:09:22.000
And you you mentioned there that they weren't happy back in 2018 about the data localization um parts of the act.
00:09:22.320 --> 00:09:27.679
Data localization means in this context and not every context, but uh data sovereignty.
00:09:27.840 --> 00:09:29.919
I think it was about oh right.
00:09:30.480 --> 00:09:40.559
Data the the Indian government wanted the data to be kind of in the Indian uh within the Indian you know boundaries, regulatory boundaries.
00:09:41.279 --> 00:09:51.360
Yeah, so Maria, who does the act apply and what are data principles and data fiduciaries?
00:09:51.919 --> 00:09:59.919
Okay, so I kind of highlighted, I kind of explained what they were, the data fiduciaries and the data principles at the beginning and then my first question.
00:10:00.080 --> 00:10:17.440
But so basically the the the act applies to um largely data principles who and what we understand by data principles, if you know the GDPR again, uh they would be data subjects under under the the act.
00:10:17.519 --> 00:10:22.799
So data principles are the individuals to whom the personal data pertains.
00:10:23.200 --> 00:10:31.759
Um so I think it applies to uh anybody within within India and how their personal data is getting processed.
00:10:32.080 --> 00:10:36.799
We will be looking at children under the age of 18, which I think is a really good thing.
00:10:36.960 --> 00:10:47.679
Um, you know, with the GDPR, it kind of leaves it up to the member states to decide what is the legal age of consent, whereas um the the DPDP act is very, very clear.
00:10:47.759 --> 00:10:52.000
Um, a child is anybody under the age of 18, which is which is good.
00:10:52.159 --> 00:10:56.480
Um, I think we're going to be talking about that later on in in um other questions.
00:10:56.639 --> 00:11:06.720
But um, so you have the data principle, and then you have data fiduciaries, like I said before, is very similar to the data controller under the the GDPR.
00:11:07.440 --> 00:11:11.200
And we have the same kind of terminology for data processors.
00:11:11.440 --> 00:11:32.480
So in the Indian Act, that you have a data processor which would take the personal data from the data fiduciary and process it in some way for the data fiduciary, but the data producery, like the controller under the GDPR, is still responsible for the personal data that the data processes, the data processor processes.
00:11:32.799 --> 00:11:45.200
The act also creates a concept of um what they have called significant data fiduciaries, and these are large or high-risk organizations that must meet extra obligations under the act.
00:11:45.279 --> 00:11:59.600
Um, and these obligations would be things like appointing a data protection officer or conducting uh data protection impact assessments, and uh maybe also like um having to undergo periodic audits and so on.
00:11:59.840 --> 00:12:24.080
Um, the scope of the of the act applies, like I said before, where the personal data is digital or is going to be digital, um, and as well the processing is where that you know that it applies to where the processing of the personal data is within India, um, or it relates to offering goods or services to data principles in India.
00:12:24.639 --> 00:12:41.279
So when you think about it from the perspective of the DDPR, it's quite similar in that respect, the narrower focus because it looks more primarily at digital data as opposed to kind of the personal data that could be also paper-based under the GDPR.
00:12:42.559 --> 00:12:50.720
So um, question four, then Katie, for you would be when does the DPDP Act actually come into force?
00:12:50.960 --> 00:12:53.200
And what is its current status?
00:12:54.080 --> 00:13:08.000
I'll just start off answering that question with a kind of bit more to do with the history again, but the act itself actually replaces the Informational Technology Act of 2000.
00:13:08.799 --> 00:13:23.919
So that regime under that act remains in force until the end of the final implementation of the DPA, which is in different phases, so it's not all at once, basically.
00:13:24.000 --> 00:13:36.000
So uh the act itself, as I said, it was passed in August 2023, but uh, I mean, like a lot of legislation, that wasn't an overnight deadline for all these companies.
00:13:36.240 --> 00:14:01.279
Um the key structural provisions, including the definitions, the territorial scope, as you were saying previously, the creation and powers of the data protection board of India, that is what went into force this November, which is what we were saying earlier, um, alongside the personal data protection rules.
00:14:01.919 --> 00:14:09.039
So the law requires firms to safeguard the data of Indian citizens.
00:14:09.200 --> 00:14:19.360
Obviously, there is exceptions um for kind of official official state, what they call it as instrumentality.
00:14:20.240 --> 00:14:26.720
Um and they do actually enforce penalties for firms that breach those obligations.
00:14:26.960 --> 00:14:46.879
So they are gonna have to, you know, nothing's basically nothing is stopping firms from sharing information that kind of helps the state, you know, similar similar to GDPR, you know, like investigation of crime, your tax um financial regulations and stuff, employment regulations.
00:14:47.279 --> 00:14:54.159
Enforcement timeline itself is scheduled to kick in fully in 2026 and 2027.
00:14:54.559 --> 00:15:19.360
So for instance, data fiduciaries who collect and use personal data have until November 2026 to comply with a number of provisions, including hiring and integrating a DPO, a data protection officer, into their into their organization, um, which is something we're quite we're quite well versed in.
00:15:19.519 --> 00:15:28.960
Um so I mean that's that's not new, that's something that there's going to be a lot of resources out there to help Indian companies kind of adopt.
00:15:29.200 --> 00:15:43.679
Uh the same month, they are gonna need to bring in a consent manager framework, which allows firms to exercise data removal and amendment of rights on our behalf of data principles.
00:15:44.799 --> 00:15:55.919
And then the 2027 phase is for large technology firms to be subject to the full force of the act.
00:15:56.399 --> 00:16:03.360
So, and that's also when the data protection board of India are going to have their the ability to exercise their full powers.
00:16:03.600 --> 00:16:16.480
So basically, it starts this is last December or November, it starts last month and it's gonna be going on for two years to basically have full compliance with the act.
00:16:17.039 --> 00:16:27.279
So the number they've set the number of the data protection board, which is it's basically the Indian enforcement authority for this piece of legislation.
00:16:27.440 --> 00:16:29.519
They've set the number of members to four.
00:16:30.080 --> 00:16:39.279
They can they're gonna be able to hold inquiries in response to complaints, they're gonna be able to impose penalties uh in cases of data breaches.
00:16:39.759 --> 00:16:48.320
As of yet, they haven't chosen the board members, but they're gonna be appointed by the Ministry of Electronics and Information Technology.
00:16:49.039 --> 00:17:05.200
So basically, this is the first kind of window where organizations holding Indian digital personal data can kind of take a look at it and evaluate where they stand in relation to this legislation.
00:17:05.440 --> 00:17:08.000
And it's better to start early than never.
00:17:08.079 --> 00:17:16.319
You know, you have a a year to kind of get your DPO in order, but that year it's not going to be long creeping up.
00:17:16.880 --> 00:17:17.759
Absolutely, yeah.
00:17:17.839 --> 00:17:22.960
But it's good that they give them time to kind of get their ducks in order before it actually comes into effect.
00:17:23.519 --> 00:17:24.240
That is true.
00:17:24.799 --> 00:17:32.799
We had something similar with the GDPR, so we had two years, do you remember from before like uh the GDPR came into effect in 2016?
00:17:33.039 --> 00:17:44.960
No, sorry, the GDPR was passed in 2016, but they had the organizations in Europe had two years to become compliant before the 25th of May, which was 2018.
00:17:45.119 --> 00:17:46.319
So it was something similar.
00:17:46.480 --> 00:17:50.720
We have something similar with the EU data protection or the EU AI Act as well.
00:17:50.880 --> 00:17:53.039
So that's a phased implementation.
00:17:57.920 --> 00:18:02.559
What are the core components of the act, would you say, Maria?
00:18:02.720 --> 00:18:07.039
Like how would you how would you compartmentalize it?
00:18:08.240 --> 00:18:16.319
Okay, so I think um we have kind of covered a lot, but um I think what you what I mean again, there's various different layers.
00:18:16.400 --> 00:18:21.519
You can go into a lot of detail or you can kind of um give a kind of high-level overview of the act.
00:18:21.759 --> 00:18:25.039
You could break the act down into kind of five sections.
00:18:25.759 --> 00:18:38.880
Um, and these five sections for people that have already um worked with the GDPR, uh, I broke it, I've broken it down into five sections that would be kind of familiar to people um that have worked with the GDPR.
00:18:39.039 --> 00:18:58.960
So the first section would be kind of the lawful grounds for processing, the second would be notices and consent, the third would be data principal rights, um, and the fourth would be then the obligations of the data fiduciaries, and then we'll we'll talk about the enforcement and the penalties of the um of the act.
00:18:59.200 --> 00:19:02.720
So the first one, like I said, was lawful grounds for processing.
00:19:02.799 --> 00:19:06.640
So there's a few differences here between the GDPR.
00:19:06.880 --> 00:19:17.519
Um so processing must be for a lawful purpose and based either on consent or specific legitimate uses that are listed in the act.
00:19:17.599 --> 00:19:21.519
Okay, so you don't have article six like you do in the GDPR.
00:19:21.759 --> 00:19:28.720
Consent is kind of primary apart from specific uh use cases within the act.
00:19:28.960 --> 00:19:48.720
Um, legitimate uses that would be listed in the act include things like the provision of state benefits and subsidies to individuals, so the state would have to process their personal data, um, compliance with other other laws, and you mentioned you know the uh law enforcement there would be would be something to consider.
00:19:49.200 --> 00:19:58.319
And then you have things like um public emergencies, you may have to process people's information if there's an emergency or if there's a personal emergency for the individual.
00:19:58.480 --> 00:20:09.279
Um, so they would be taken into consideration, and then of course, certain employment purposes as well, where you don't actually have to process somebody's uh information without the requirement for specific consent.
00:20:09.680 --> 00:20:24.079
Um, I think what's important here, and a kind of a significant uh divergence between the GDPR and the Indian Act is they don't actually they don't create a special category for sensitive data.
00:20:24.160 --> 00:20:30.720
So there's no special category data under under the Indian Act as opposed to the GDPR, so there's no article nine.
00:20:30.960 --> 00:20:42.559
Uh it it so that the whole theory behind that would be that personal data is personal data and it it requires the highest protection, regardless of what type of personal data it is.
00:20:43.039 --> 00:20:49.119
So can I just ask you a question on the the lawful grounds of of processing?
00:20:49.599 --> 00:20:51.440
Are them legitimate uses?
00:20:51.599 --> 00:20:53.519
Is that an exhaustive list?
00:20:54.799 --> 00:20:56.240
I think so.
00:20:56.400 --> 00:21:06.079
I think that they're brought so there's a list within the the act, and they seem to be broad enough to actually uh include whatever's needed.
00:21:06.240 --> 00:21:22.079
Um I don't think, and I could be wrong now, but I don't think you're allowed, they're quite specific and they're quite um uh they're quite contained in that, you know, you like there, there's a list there and you have to abide by the list, from what I understand.
00:21:22.480 --> 00:21:34.559
So, like the you know, because of Article 6 under the GDPR, there's a lot of there's a lot of room for interpretation under the GDPR, whereas I don't think that's there in the Indian Act.
00:21:34.720 --> 00:21:44.079
So you either have to find you either have to get the individual to consent um or you have to find um a way to fit it into the legitimate uses.
00:21:44.160 --> 00:21:51.119
If you can't fit them into the legitimate uses, my understanding is then you have to get consent, otherwise, you just can't process the data.
00:21:51.759 --> 00:21:53.440
Notices and consent.
00:21:53.680 --> 00:21:57.440
Um, and I I think it's quite similar to the GDPR in this area.
00:21:57.519 --> 00:22:18.480
So data fiduciaries must give a clear Notice describing what data will be collected, for what purpose it's going to be collected, and what and how the individual can exercise their rights, and how they can, you know, the means for complaining to the data protection board as well, if they're not happy with the treatment and so on.
00:22:18.880 --> 00:22:28.000
Also, if the organization that's collecting the data has a DPO, they have to provide access or how to be able to contact the DPO of the organization.
00:22:28.160 --> 00:22:37.279
Or if they don't have a DPO, then they have to give access details to the grievance officer or the grievance contact in that organization.
00:22:37.440 --> 00:22:44.559
So if the individuals or the data principals have grievances, they they know how they can contact the organisation.
00:22:45.039 --> 00:22:57.279
Notices must be in English, and they and any kind of official Indian languages they you know that's necessary for providing to the individual.
00:22:57.440 --> 00:23:04.079
There's 22 Indian languages in total, so that could be quite a bit of work.
00:23:04.240 --> 00:23:12.720
And consent must be free, specific, informed, unambiguous, and signalled by a clear affirmative action.
00:23:12.799 --> 00:23:16.079
So it's it's very similar, in my opinion, to the GDPR.
00:23:16.559 --> 00:23:18.880
The data subject principal rights.
00:23:19.119 --> 00:23:31.440
So I won't get into too much detail here because I think we have a full question on this coming up, but so the data principles' rights are slightly more specific than the rights under the GDPR.
00:23:31.599 --> 00:23:33.200
I think there's four of them there.
00:23:33.519 --> 00:23:43.200
So the individual has the right to obtain a summary of the personal information that's being processed by the data fiduciary, and that's called the right to information.
00:23:43.359 --> 00:23:58.240
They have the right to seek the correction, completion, or updates of personal data, and the right to request erasure of data when the purpose has been met, or if they withdraw their consent, and that's called the right to correction and erasure.
00:23:58.480 --> 00:24:12.240
They have the right to have grievances addressed by the data fiduciary and to approach the data protection board if unsatisfied by the actions of the data fiduciary, and that's called the right to grievance redressal.
00:24:12.799 --> 00:24:30.319
Um, data principals also have the right to nominate another person to exercise rights in the event of death or incapacity, which is a really interesting right, and we'll get into that more in detail when we kind of have the specific question on uh data principal rights.
00:24:30.559 --> 00:24:44.720
But it doesn't exist in the GDPR, but if you know that you are, you know, if you have awareness that you're going to die or if you're going to be incapacitated, you can actually nominate another individual to assume your rights, your data protection rights.
00:24:44.799 --> 00:24:49.200
And I'll go into that in more detail in the next questions.
00:24:49.599 --> 00:24:58.880
Um, the obligation of data fiduciaries, they remain responsible for compliance, including any processing carried out by their data processors.
00:24:59.039 --> 00:25:19.599
They must ensure data accuracy where it affects decisions, put in place appropriate technical and organizational measures, again like the GDPR, to protect the data with reasonable security safeguards, and they must notify the board, the data protection board, and affected individuals in the event of a personal data breach.
00:25:19.839 --> 00:25:25.920
Then the fifth um area, the fifth category I kind of specified would be enforcement and penalties.
00:25:26.079 --> 00:25:38.319
And again, this is very similar to the GDPR in that they're quite um onerous, they're quite heavy fines for data fiduciaries if you know if they are found guilty of negligence.
00:25:38.480 --> 00:25:44.640
So a day the Tata Protection Board of India can investigate breaches and impose monetary penalties.
00:25:44.880 --> 00:26:00.880
The fines can range from 50 crore up to 250 crore per violation, and an example of a violation would be failing to take security measures or violating children's data obligations, which is taken very seriously under the act.
00:26:01.039 --> 00:26:07.200
So you're talking, if you're talking about 250 crore, you're talking about millions of euro, like tens of millions of euro.
00:26:07.759 --> 00:26:20.640
So again, like the GDPR, the the fines would be so heavy that you know it would encourage organizations not to breach the data or to to ensure that they're compliant with the data.
00:26:20.960 --> 00:26:21.680
It's deterrent.
00:26:22.079 --> 00:26:22.559
It's a deterrent.
00:26:24.240 --> 00:26:25.119
Absolutely, yeah.
00:26:25.279 --> 00:26:25.839
Yeah.
00:26:26.000 --> 00:26:31.119
Um, and like I said, we'll get into more details about the um data subject rights in the next few questions.
00:26:31.279 --> 00:26:40.559
But question six, Katie, what rights do individuals get under the DPDP Act and how do they differ from the GDPR?
00:26:41.039 --> 00:26:49.039
This is kind of more specific, so I kind of touched on the data subject rights or the data principle rights, but again, now we're getting more specific into the rights.
00:26:49.519 --> 00:26:59.519
So I think for this question, I might kind of present it in a way that's more focused on the actual data principles rather than the companies.
00:27:00.160 --> 00:27:14.799
So under the DP DP Act, individuals have the right to ask what personal data is being processed and get access to that information.
00:27:15.680 --> 00:27:23.119
They can request correction, completion, and the updating and erasure of their data.
00:27:23.279 --> 00:27:28.720
So I suppose uh equivalent to erasure and rectification.
00:27:29.680 --> 00:27:40.319
Um, you can raise grievances and escalate those grievances to the data protection board if they're not satisfied with the company that you raise that grievance with.
00:27:40.559 --> 00:27:52.480
I think that you do have to raise the grievance with the organization first, and then at that point where you're not satisfied with how they dealt with it, then you escalate it to the data protection board.
00:27:53.119 --> 00:28:06.400
And as Maria was saying, something quite interesting and unique to India, which is the ability to nominate someone to exercise those rights on your behalf in the case of death or incapacity.
00:28:06.880 --> 00:28:24.559
And I suppose, of course, you can, in a sense, nominate someone as in a family member or a solicitor to exercise your rights under the GDPR, but the main difference here is that it doesn't apply in the case of death.
00:28:24.799 --> 00:29:00.720
So in the Indian context, these laws still apply to a deceased individual's information, which is quite an interesting distinction because the GDPR applies explicitly to living individuals, and then so when an individual might become deceased, and if the relatives are kind of trying to make that process easier for them, trying to get their information back to make their own arrangements, it kind of can result in a bit of a block to that.
00:29:00.960 --> 00:29:12.799
So that's not going to be the case in India once this act comes into full force, which is kind of a nice, a nice thing for the families, to be honest.
00:29:12.880 --> 00:29:14.960
It's a nice distinction to have made.
00:30:33.440 --> 00:30:39.599
You can consider the fact that you know this often causes family feuds, disagreements in families.
00:30:40.640 --> 00:30:48.640
The data controller doesn't really know under the GDPR what they have to do or who they give the information to, and so on.
00:30:48.720 --> 00:30:59.200
So it just makes a very clear procedure for the for the data fiduciary and it eliminates all that kind of stress around illness and around death, you know, for the family.
00:30:59.279 --> 00:31:00.880
So I think it's a really good one.
00:31:02.240 --> 00:31:29.359
And I suppose the fact that the data principal nominates someone, you know, like there's kind of a transfer of authority there that the data fiduciary can be sure that, you know, whether they're family or not, they're not just releasing someone's personal data to, you know, someone who might not have the data principal's best interests at heart, you know, because they're the ones who made the nomination as well.
00:31:29.839 --> 00:31:30.880
Yeah, yeah, I agree.
00:31:30.960 --> 00:31:31.519
Yeah, yeah.
00:31:31.680 --> 00:31:33.359
That's very it's it's a good one, yeah.
00:31:33.519 --> 00:31:34.319
Yeah, for sure.
00:31:34.720 --> 00:32:03.279
So yeah, I suppose the other two biggest differences the GDPR does have a more extensive catalog of rights, like in the Indian Act, we don't see the right to data portability, we don't have we don't see the right to object at right to processing, and there isn't those specific provisions uh in relation to automated decision making and profiling that you do see in the GDPR.
00:32:03.680 --> 00:32:11.519
So there's no explicit obligation for data portability.
00:32:11.839 --> 00:32:22.799
So yeah, data portability, automated decision making, and objection, they're the three main GDPR rights that we don't see merge in the Indian PD PD.
00:32:23.039 --> 00:32:44.640
And another interesting one is that individuals actually have a duty, they they have a duty not to file false complaints or provide false information, and they they do have penalties uh for breach of those duties, which the GDPR doesn't have, which I think is kind of quite interesting.
00:32:44.880 --> 00:33:03.200
And personally, I quite like this because I know that you have the provision in the GDPR for the vexatious or manifest to be able to deny a vexatious or manifestly unfounded data subject access requests, but it's quite a high burden of proof for that.
00:33:03.519 --> 00:33:08.799
And you know, sometimes you can you take it on a case-by-case basis.
00:33:08.880 --> 00:33:29.759
So sometimes you're kind of you know wrestling with whether it is or not, whereas here the individual has the duty not to, I don't know, I feel like it's kind of a bit of a parallel in the sense, and it's actually saying, you know, don't waste people's time, you know, don't abuse these rights that you have in relation to your data, which I quite like.
00:33:30.079 --> 00:33:37.039
I totally agree because under the GDPR, again, there's no oblig there's no kind of um deterrent for people.
00:33:37.279 --> 00:33:48.559
So um, as you know, Katie, you know, um there's quite you can have quite a lot of vexatious uh requests, data subject requests, and they can go on for years sometimes.
00:33:48.799 --> 00:33:50.640
And um god, yeah.
00:33:50.880 --> 00:33:55.279
You know, so to avoid that for organizations, I think is a massive thing.
00:33:55.359 --> 00:34:07.599
Um, and the day the data principal in India will definitely think twice if they feel like there could be consequences for them um, you know, after one or two or three requests.
00:34:07.680 --> 00:34:08.400
Do you know what I mean?
00:34:08.480 --> 00:34:20.960
They may actually, you know, and it m it'll be it be easier for the organization as well to kind of push back and say, look, you know, this you know, uh you have obligations as well to not waste our time and so on.
00:34:21.039 --> 00:34:22.159
So I think it's a really good thing.
00:34:22.239 --> 00:34:23.360
I totally agree with you.
00:34:23.519 --> 00:34:33.039
I think that's one of the the weaknesses of the GDPR uh in that we it's very vague what vexatious requests are, you know.
00:34:33.599 --> 00:34:54.960
Um although the omnibus is dealing with that in in you know, it we don't know the final the final um wording, but it does it does touch on the fact that I think across Europe now everybody is aware that there's quite a lot of vexatious uh data subject access requests.
00:34:56.800 --> 00:34:57.920
It is true, yeah.
00:34:58.000 --> 00:35:16.239
And it's it's quite frustrating when you're spending days work full working multiple working days fulfilling a D SAR where you know the person actually they're not a pre they're like they don't actually want their data.
00:35:16.400 --> 00:35:26.800
They you know when you're doing all this work to get it ready and to send it out to them, and you know it's almost for nothing because they didn't kind of submit it in good faith.
00:35:27.119 --> 00:35:28.800
Yeah, and it's for another reason.
00:35:28.960 --> 00:35:33.920
It's not actually because they want to access their data, like you say, but it's another reason why they're doing it.
00:35:34.400 --> 00:35:35.280
Uh so yeah.
00:35:36.079 --> 00:35:39.119
You can't just throw throw it around willy-nilly either.
00:35:39.440 --> 00:35:40.639
Yeah, yeah, absolutely.
00:35:40.719 --> 00:35:42.320
There has to be a balance there again.
00:35:42.559 --> 00:35:49.920
Yeah, and that's why I said in the first question, it I think the the this act, the Indian Act, does get that balance well.
00:35:50.159 --> 00:35:51.280
It does get it right.
00:35:51.519 --> 00:36:15.119
And that's evidenced by the fact that you know there are obligations on the data principles, like we've just said, but as well, it's evidenced by the fact that now in Europe they're they've they're coming out with the digital omnibus um and they're making changes to the GDPR because um there has been feedback at a European level that the GDPR can be quite onerous for SMEs and so on.
00:36:15.280 --> 00:36:17.840
So yeah, so that's interesting.
00:36:18.239 --> 00:36:22.719
I suppose the GDPR is kind of like the first child of the family.
00:36:23.280 --> 00:36:24.000
Absolutely.
00:36:24.400 --> 00:36:28.239
Yeah, and the other apps are like learning from the eldest siblings.
00:36:28.559 --> 00:36:29.280
Yeah, it's great.
00:36:30.400 --> 00:36:31.119
Yeah, absolutely.
00:36:31.280 --> 00:36:35.760
They see what's going on in Europe and they can avoid those pitfalls for sure, yeah.
00:36:35.920 --> 00:36:36.559
Yeah.
00:36:36.880 --> 00:36:50.639
Um but yeah, so I think we'll move on now to how does the DPDP Act handle consent and how does that compare with consent under the GDPR?
00:36:51.280 --> 00:36:51.920
Okay, great.
00:36:52.000 --> 00:36:52.800
Thanks, Katie.
00:36:53.199 --> 00:37:03.679
So consent under the DPDP Act looks quite familiar if you're if you're if you've already worked with the GDPR.
00:37:03.840 --> 00:37:11.119
So it must be free, specific, informed, unambiguous, and indicated through a clear affirmative action.
00:37:11.199 --> 00:37:13.760
So that would be like a tick mark or something like that.
00:37:13.920 --> 00:37:16.960
Um explicit consent under the GDPR.
00:37:17.199 --> 00:37:26.639
So the act goes a step further by explicitly calling consent unconditional, which is not in the definition of in the GDPR.
00:37:26.800 --> 00:37:33.119
The idea being that access to essential services shouldn't be tied to unnecessary data collection.
00:37:33.440 --> 00:37:49.599
The act requires a concise, clear notice at or before the time of collection, explaining what data will be processed, for which purposes, how rights can be exercised, and how to complain to the data protection board.
00:37:49.840 --> 00:37:54.000
Um, very similar to the GDPR transparency requirements.
00:37:54.320 --> 00:38:05.920
Where the difference emerges between the DPDP and the and the GDPR is that the Indian Act uh leans heavily on legitimate uses.
00:38:06.159 --> 00:38:19.599
So these are what we call statutory carve-outs, like specific, a specific list where consent isn't needed at all, and that it relates to the you know the state processing uh individuals' personal data.
00:38:19.760 --> 00:38:55.039
So, like I said before in one of the other questions, um like when you know you're dealing with state sub subsidies, uh, legal claims, employment-related processing, and so on, the GDPR has multiple legal bases, but um the Indian list is drafted more as a set of legislative exemptions, and there's no and another important difference between the Indian Act and the GDPR is that there's no legitimate interests in um within the consent in the Indian Act.
00:38:55.119 --> 00:39:05.679
So we have the legitimate interest as one of the six legal bases under Article Six of the GDPR, and that doesn't exist under the Indian Act.
00:39:05.920 --> 00:39:10.400
So, like I said before, consent is much more specific.
00:39:10.639 --> 00:39:16.400
I have a table here as well, so I can go through that and kind of um outline the differences.
00:39:16.559 --> 00:39:25.440
So the definition of consent under the Indian Act is the words would be free, specific, informed, unconditional, and unambiguous.
00:39:25.599 --> 00:39:32.320
Whereas with the GDPR, it's consent must be freely given, specific, informed, and unambiguous.
00:39:32.480 --> 00:39:41.519
Um, the legal basis, so you have legitimate uses under the Indian Act, whereas you have the six alternative legal basis in the GDPR.
00:39:41.679 --> 00:39:50.320
Um, legitimate interest does not exist in the Indian Act, and it does exist um under the um the GDPR.
00:39:50.639 --> 00:40:05.280
Children's data as well, that's a significant difference in that children have to are defined as being under 18, whereas with um the GDPR, member states get to decide what is the legal age.
00:40:05.360 --> 00:40:13.679
So you sometimes you have it as low as 13, the age of you know, the age of consent is 13, and sometimes it's 16, and then 18 as well.
00:40:13.920 --> 00:40:18.400
So, in my opinion, I think that's better because it protects children more.
00:40:18.960 --> 00:40:25.840
There's no special category data under the Indian Act, whereas there is in in um the GDPR.
00:40:26.400 --> 00:40:29.440
Um, yeah, so that I think that's basically it.
00:40:30.000 --> 00:40:46.800
So, in terms of the differences and so on, yeah, I would say legitimate uses would be the main difference, and the fact that there's no special category data and there's no legitimate interests um under the Indian Act would be the three main things, I think.
00:40:53.840 --> 00:41:01.840
So, Katie, how are children's how is children's data you uh processed or handled under the Indian Act?
00:41:02.000 --> 00:41:09.199
And uh and can you talk to us a little bit about the sensitive use cases that would be referred to in the Indian Act?
00:41:09.760 --> 00:41:25.280
So I suppose you touched on that a bit by saying that a child is defined as under 18, which is a more strict approach than the GDPR has explicitly taken.
00:41:25.440 --> 00:41:31.039
I mean, whether an individual member state has chosen 18, I think in Ireland it is 18.
00:41:31.440 --> 00:41:44.960
Um but yeah, basically the whole yeah, that's 18 is the hard and fast rule for a child in as far as Indian data protection goes.
00:41:45.440 --> 00:41:55.119
Section 9 of the Act imposes strict and mandatory obligations on data fiduciaries when they deal with children's data.
00:41:55.440 --> 00:42:03.039
They need to obtain verifiable parental or guardian consent before processing their personal data.
00:42:03.519 --> 00:42:27.360
And I know that there was no kind of general data subjects' rights when it came to profiling, but it is a bit of a different case when it comes to children because the act does prohibit tracking, uh, behavioral monitoring, targeted advertising directed at children and any processing that's likely to cause a detrimental effect on child's well-being.
00:42:27.519 --> 00:42:34.880
So, you know, today's day and age that's quite important, and that could be interpreted quite broad.
00:42:35.039 --> 00:42:41.039
And this is also one of the aspects of the act that the tech companies had issue with.
00:42:41.280 --> 00:42:50.079
So I think that that says a lot that anyone would kind of have issue with these safety guards being put in place for children.
00:42:50.400 --> 00:42:51.519
Says a lot.
00:42:52.079 --> 00:43:03.039
So there's uh another table here that outlines more specifically the obligations on data fiduciaries.
00:43:04.079 --> 00:43:09.760
So from consent, it needs to be verifiable parental consent.
00:43:09.840 --> 00:43:13.679
It's mandatory before processing any data.
00:43:14.000 --> 00:43:19.760
And you're they're also going to need to make a reasonable effort to verify the age of the child.
00:43:20.159 --> 00:43:26.800
Processing without this consent is prohibited, so strictly prohibited.
00:43:26.960 --> 00:43:31.360
So if they want to find a way around that, then the processing is illegal.
00:43:31.920 --> 00:43:43.360
And I think there are some significant fines as well in terms of if you know if it's judged that they have uh breached uh children's rights, there are significant fines attached to that.
00:43:43.519 --> 00:43:45.599
So again, that's a deterrent.
00:43:46.000 --> 00:43:48.800
You know, yeah, which I mean, rightfully so.
00:43:48.960 --> 00:43:53.760
Again, like the this this is the kind of stuff that needs to be in place.
00:43:53.840 --> 00:43:55.119
Otherwise, what's the point?
00:43:55.360 --> 00:44:04.000
You know, if you're not putting safeguards for children in place, then what's the point of having A d digital data protection regulation in the first place, in my opinion.
00:44:04.239 --> 00:44:04.639
I agree.
00:44:04.800 --> 00:44:07.920
They're the most vulnerable in society, so they need protection.
00:44:08.079 --> 00:44:08.639
Yeah.
00:44:09.360 --> 00:44:25.039
Um so targeted uses, data fiduciaries must not process personal data of a child in a manner that is likely to cause a detrimental effect on the child's well-being.
00:44:25.440 --> 00:44:38.960
So I mean, you could argue that that's things like you know, social media, which you know, there's a lot of studies out there to say that it does affect grown adults' mental health, never mind children's.
00:44:39.039 --> 00:44:42.880
So, you know, that's an objective detrimental effect on their well-being.
00:44:43.199 --> 00:44:43.840
Absolutely.
00:44:44.159 --> 00:44:49.679
I wonder how that's I'm interested to see how that will actually translate into practice.
00:44:49.920 --> 00:44:50.159
Absolutely.
00:44:51.119 --> 00:44:53.039
Any changes, I don't know, but yeah.
00:44:53.280 --> 00:44:54.880
Can I can I just say one thing as well?
00:44:55.039 --> 00:45:08.960
You know, um, the GDPR came in in 2018, and I think um, like you say, Europe has kind of suffered from being the first mover in this area, so they didn't really put those laws into place to protect children.
00:45:09.119 --> 00:45:24.400
But then the Digital Services Act came in in 2024, and if you look at that, there's a lot of those that you see from the from the Indian Act, there's a lot of those kind of same protections in place now in the Digital Services Act.
00:45:24.639 --> 00:45:43.199
So, so yeah, again, we we kind of suffered from our own kind of first mover kind of um benefits there, in that you know, all the rest of the legislation across the globe saw what was happening in Europe, and then they can actually have one act that kind of covers everything.
00:45:43.280 --> 00:45:53.119
Uh, whereas Europe has to kind of bring in another act because you know the GDPR didn't really cover, didn't really um cover protection of children.
00:45:53.280 --> 00:46:05.360
Again, I think at the time at 2016 and even back in 2014 when they were writing the GDPR, it wasn't half as much of an issue as it is nowadays, you know.
00:46:05.440 --> 00:46:11.920
So but there there are those protections there, but but it's not the GDPR, it's more the Digital Services Act.
00:46:12.559 --> 00:46:32.320
Yeah, I think the drafters couldn't have known, and I suppose it's not all bad because it has served an as an example internationally, and I feel like that's kind of a win at the same time that these provisions are in the you know, are in the PDPD at the end of the day.
00:46:32.719 --> 00:46:34.000
Absolutely, yeah, yeah.
00:46:34.320 --> 00:46:39.199
They also have banned targeted advertising for children.
00:46:40.639 --> 00:46:42.239
I think that's quite a good thing.
00:46:42.480 --> 00:46:43.760
Yeah, and I agree.
00:46:44.719 --> 00:46:52.000
They they I think they do have certain exceptions, uh, there are narrow exceptions.
00:46:52.159 --> 00:47:10.639
Um certain classes of data fiduciaries, like clinics and educational institutions, are exempt from certain obligations like parental consent for processing every little piece of data when processing is necessary for specified purposes.
00:47:10.880 --> 00:47:38.800
And a couple of the specified purposes here are for providing health services, um, child safeguarding or essential services, which I mean that is necessary at the end of the day because there's always that question with kind of kids, schools and sports clubs about like we need to do this for a child, or we're worried about this child, but we don't know what our data protection obligations are in relation to that.
00:47:38.960 --> 00:47:44.159
So it's kind of hopefully we'll avoid that situation.
00:47:44.880 --> 00:47:46.079
Yeah, absolutely.
00:47:46.880 --> 00:47:56.960
So there are penalties, uh, violations of the obligations relating to the data of children can attract penalties of up to 200 crore.
00:47:58.079 --> 00:48:04.480
So I guess in the millions, so it's significant significant deterrent there.
00:48:04.880 --> 00:48:07.199
Yeah, in comparison to the GDPR.
00:48:08.480 --> 00:48:10.719
I mean, they're uh they are comparable, obviously.
00:48:10.800 --> 00:48:25.119
That's what we're doing here, but um the GDPR says that the age threshold can be as low as 13, and member states do have the authority to kind of decide where they're going to draw the line with children.
00:48:25.360 --> 00:48:28.480
And India has chosen uniform 18-year threshold.
00:48:28.559 --> 00:48:38.719
And as you said, Maria, that some of these provisions they're not in the GDPR, but they're still in Europe because it's kind of a bit of a trial and error.
00:48:39.039 --> 00:48:47.599
So it's just quite nice that they are all in the same piece of legislation, so people aren't kind of running over their tails as much, I suppose.
00:48:48.480 --> 00:48:55.679
And aside from children, they do also have sensitive use cases in the DPDP.
00:48:56.880 --> 00:49:13.360
This is not special category data, but it's basically uh applies the same high standard of data protection to all personal data, and where the draw of the distinction is what out is is a use case of the data.
00:49:13.440 --> 00:49:14.719
So it's not the data itself.
00:49:14.960 --> 00:49:19.360
The data becomes sensitive when it's being used in a certain way.
00:49:20.639 --> 00:49:36.320
So organizations are gonna need to figure out if they qualify as a significant data fiduciary because it's at this point that this classification give imposes on them stricter compliance obligations.
00:49:36.559 --> 00:49:43.760
It basically comes into play are you a significant data fiduciary or an ordinary data fiduciary?
00:49:44.400 --> 00:49:55.679
And it's not the data itself, it's the volume of data and what you're actually doing with the data that will impose the more stringent obligations.
00:49:56.800 --> 00:49:57.440
Very good.
00:49:58.639 --> 00:50:18.960
So I think we're gonna move on now to cross-border data transfers, which could be quite interesting considering the GDPR is European and we have kind of our own distinctions between data processing and you know, national or EU or outside the EU.
00:50:19.119 --> 00:50:20.880
So, where does it differ?
00:50:21.360 --> 00:50:23.360
Oh, it differs quite a lot, actually.
00:50:23.599 --> 00:50:49.760
So, this is where I think the Indian Act is is completely different to the GDPR, in that if you're again, if you're familiar with the GDPR, then you know that um when you process personal data and you have to transfer it outside of Europe, and you have to uh you have to have um standard contractual clauses, or you have to have you have to make sure that the country that you're sending the data to has an adequacy agreement.
00:50:50.000 --> 00:51:02.800
So you have to ensure that the you know the data that's being sent outside of Europe it will be will have the same level of protection as they they would have if they were um stored within Europe.
00:51:03.039 --> 00:51:10.800
Um so that's kind of like a it's a uh adequacy um model that the European or the GDPR follows.
00:51:11.039 --> 00:51:16.239
Here with the DPDP Act, it's a blacklist model.
00:51:16.480 --> 00:51:33.840
So um you can actually process, you can actually transfer data um to across across the borders to different countries um outside of India unless the Indian government has actually blacklisted the country that you want to send it to.
00:51:33.920 --> 00:51:42.639
And then that's if the the country has been blacklisted by the Indian government, then you cannot send personal data to that country.
00:51:42.800 --> 00:51:57.199
So as opposed to seeking adequacy um and ensuring that the you know the country that you're sending the data to has adequacy with the act, they are basing their transfer requirements on um blacklisting certain countries.
00:51:57.360 --> 00:52:11.679
So if you're not on the blacklist, uh if you're not on the blacklist, then there are no kind of other requirements that the the DPDP Act um puts on uh data fiduciaries when transferring personal data.
00:52:11.760 --> 00:52:36.800
Um and so far, and again, this is early days, but uh the blacklist uh hasn't been published by the Indian government, so um, you know, you can actually transfer data outside of India to countries um at the moment without um that you know, there's no kind of list, you don't have to check up on any list to ensure that they haven't been blacklisted because the list hasn't been published yet.
00:52:36.960 --> 00:53:07.199
But what I would say to you know, for people that are you know looking at this act and wanting to comply with the act is that you would, you know, make sure that you have some sort of contract in place to ensure that you know um your the personal data gets protected um to the same level as the you know as the act requires, because again, if you have a breach, the data produceries are you know they're they're responsible for the data anyway.
00:53:07.360 --> 00:53:21.360
So if you transfer your data to data processes outside of um India, make sure that you have some sort of contract in place just to ensure that you know you reduce the likelihood of of breaches and you ensure compliance.
00:53:21.840 --> 00:53:32.000
So, yeah, so that's an interesting thing that it's kind of kind of it moved away completely from the you know the way the Europe and the GDPR um transfers data.
00:53:32.159 --> 00:53:34.320
So that's that's something yeah interesting.
00:53:35.199 --> 00:53:35.840
Merriamage.
00:53:36.239 --> 00:53:37.840
Yeah, yeah, absolutely.
00:53:38.320 --> 00:53:41.119
So I think we're now at question 10.
00:53:41.280 --> 00:53:44.480
We're hopefully coming close to the end of the podcast.
00:53:44.719 --> 00:53:50.400
Um so Katie, can you talk to us a little bit about the penalties and the enforcement compared to the GDPR?
00:53:50.480 --> 00:54:01.920
Like how and we again we've discussed this throughout the podcast, but you know, can you be more specific about you know what are the penalties under the under the DPDP Act?
00:54:02.880 --> 00:54:16.000
Yeah, so I mean, as we have touched on it before, um, but it is focused on enforcement because at the end of the day, you know, it needs a bit of teeth for there.
00:54:16.239 --> 00:54:24.880
The there was pushback from the technology companies in the end, so there needs to be something to kind of make them kind of yeah, clean up your data and treat it properly.
00:54:25.199 --> 00:54:36.159
Um so the data protection board of India is, as I said previously, the central enforcement authority, and they have powers similar to the civil court.
00:54:36.480 --> 00:54:43.039
So they can call for evidence, they can examine witnesses, they can impose monetary penalties.
00:54:43.599 --> 00:55:03.599
The penalties for data fiduciaries are going to be able to go up to 250 crore per violation, so that can be stacked depending on how many violations an organization has committed or has you know neglected.
00:55:04.000 --> 00:55:13.920
So it could it can equate to roughly tens of millions of euro with a minimum of 50 crore for significant violations under the schedule.
00:55:14.239 --> 00:55:18.960
So there's a there's a floor, there's no ceiling for the fines basically.
00:55:19.199 --> 00:55:25.440
Um and children's data breaches and failure to notify breaches are explicitly called out.
00:55:26.079 --> 00:55:35.199
They do have a ceiling of around 200 crore, but again, this is a poor a per violation.
00:55:35.440 --> 00:55:47.039
So, you know, if if someone has a violation related to children's data and a violation related to breaches, you know, it's gonna stack up quickly.
00:55:47.360 --> 00:55:49.679
I'm gonna move on to the next question.
00:55:50.000 --> 00:55:58.960
If an organization is already GDPR compliant, what do they need to do to be DPDP compliant?
00:55:59.840 --> 00:56:01.119
That's a really good question.
00:56:01.280 --> 00:56:06.960
So again, we you know the GDPR is the gold standard of data protection legislation.
00:56:07.119 --> 00:56:07.920
Do you know what I mean?
00:56:08.000 --> 00:56:11.840
So you think if you're compliant with the GDPR, then you know, oh, we should be okay.
00:56:12.159 --> 00:56:18.559
No, there are certain things that you know you really need to take into consideration in order to be compliant with this Indian Act.
00:56:18.800 --> 00:56:28.239
So if you're compliant with the GDPR, you're probably about 60 to 70 percent covered for the um for the Indian Act.
00:56:28.400 --> 00:56:42.960
Um, so like if you're compliant, we're talking about you'd have your ropas in place, you'd have your uh data protection policies in place, you'd have your DPA DPIAs done, you'd have your data protection agreements in place and so on.
00:56:43.039 --> 00:56:45.679
Um so you're you're already in a very good place.
00:56:45.760 --> 00:56:48.880
You'd have your security protections in place and so on.
00:56:49.039 --> 00:56:55.519
Um, but uh there's a number of DPDP specific gaps that should be anticipated.
00:56:55.679 --> 00:56:58.639
Organizations must assess digital-only scope.
00:56:58.800 --> 00:57:07.199
So, again, it's not about paper-based uh personal data with the DPDP, it's uh uh you know the digital uh personal data.
00:57:07.280 --> 00:57:21.760
So you'd have to kind of look at that, you'd have to look at the territorial relationship of their processing activities, um, make sure that you have contracts in place and so on, and keep an eye on that blacklist, even though the blacklist hasn't been published yet.
00:57:22.000 --> 00:57:27.760
So if you're sending personal data outside of India, you would have to know exactly where you're sending that data.
00:57:27.840 --> 00:57:43.519
Um, so that would have to be done to ensure that if a blacklist is created, then you can very quickly either bring your data back into India or or be rest assured that you know your data is not on any of the countries that are blacklisted.
00:57:43.599 --> 00:57:46.239
So that would be something that you'd have to take into account.
00:57:46.639 --> 00:57:51.840
Again, looking at lawful bases, there's quite a significant difference there.
00:57:51.920 --> 00:58:17.920
You can't rely on legitimate interest, so you'd have to look at your legal bases and um see if you can like the primary uh data protection collection would be consent, so you you no longer would have those six legal bases under article six, so you'd have to kind of revise and how you collect data under you know, under what kind of uh lawful basis you collect data.
00:58:18.079 --> 00:58:20.719
Um, so that's another significant change.
00:58:20.960 --> 00:58:30.880
Um, in terms of data protection rights or data principle rights, I should say the DPD Act provides a more limited set of statutory rights than the GDPR.
00:58:31.119 --> 00:58:36.559
So existing GDPR-based procedures will often exceed the minimal legal threshold.
00:58:36.719 --> 00:58:44.880
Um, so you have to kind of decide: are we gonna keep these rights or are we gonna have specific rights to the to the DPDP?
00:58:45.519 --> 00:58:54.159
Um, so you you'd have to kind of create a policy around that um and decide what you're gonna do in terms of data principal rights.
00:58:54.320 --> 00:58:59.440
And another thing you'd have to do is you'd have to actually decide whether you are a significant data fiduciary.
00:58:59.920 --> 00:59:15.039
So, again, that doesn't exist under the GDPR, but it's important to be able to identify the fact that whether you are or are not one of these, and then if you are, then you'd have to look into what are your obligations under the DPDP Act to ensure compliance.
00:59:15.199 --> 00:59:24.159
So I think the main thing that you should do, even though even if you are GDPR compliant, the first thing you should do is um do a gap analysis.
00:59:24.400 --> 00:59:37.519
Look at what you have in place for the GDPR and identify the gaps and get a plan in place and like um the GDPR, start rolling it out and making sure that you're filling those gaps as you go forward.
00:59:38.159 --> 00:59:45.920
So, so yeah, so but rest assured that you're 60-70% there, so you're in a good place if you're already compliant with the GDPR.
00:59:46.800 --> 00:59:51.920
So we're finally at the last question, and this took a little bit longer than we anticipated.
00:59:52.079 --> 00:59:55.199
I thought it would take about 20 minutes, but it's taking a bit longer.
00:59:55.440 --> 01:00:08.800
Um so, Katie, for the last question, what is the big takeaway for you regarding the difference between the DPDP Act of 2025 or 2023, sorry, and the GDPR?
01:00:10.480 --> 01:00:36.960
Okay, so I'd say in a nutshell, the GDPR is principle-based, rights-driven, detailed obligations, strong independent DPAs, a long list of individual rights, and it's noteworthy that those DPAs are also in each individual member state within Europe.
01:00:38.239 --> 01:00:50.079
Whereas the DPDP Act is a more centralized legal framework and it applies to a lot more individuals than the GDPR at the end of the day.
01:00:50.239 --> 01:00:53.119
Um, it focuses on digital personal data.
01:00:53.599 --> 01:01:11.920
It does give a smaller bundle of rights, but I think that those rights are really meaningful, as we were saying earlier, that they've just given a couple of tweakments here and there that we really like, like the nominations and in relations to children's rights.
01:01:12.079 --> 01:01:20.159
Like I think that just because there's less rights doesn't mean there are it has less protections for the individual.
01:01:20.559 --> 01:01:37.760
Um it leans hard on consent and legitimate uses and the central board is quite powerful, and the fines, it's very it is enforcement focused because the fines are not you know something to just be brushed off your shoulder.
01:01:38.079 --> 01:01:38.960
Absolutely, yeah.
01:01:39.199 --> 01:01:51.440
Um so basically, I would although you said you're 60 to 70 percent there, I still wouldn't treat them as the same thing at the end of the day.
01:01:51.760 --> 01:02:01.360
It has its own model, it's only inspired to a certain extent by the GDPR, it's not completely based off it.
01:02:01.920 --> 01:02:03.119
Yeah, I agree.
01:02:03.280 --> 01:02:14.239
Yeah, and as well, I think a big takeaway that we have discussed throughout the podcast is that I think it has benefited from the fact that it is later than the GDPR.
01:02:14.400 --> 01:02:30.239
Um, and like you say, those eight years of legal kind of discussions and so on, it's quite a thoughtful act, and um, yeah, there's a lot of good kind of protections in there, um, not only for the data principles, but also for the data fiduceries.
01:02:30.320 --> 01:02:39.039
So I think the balance is very, very good between obligations and rights, which uh which maybe the GDPR needs to be revised slightly.
01:02:39.119 --> 01:02:39.679
Yeah.
01:02:40.800 --> 01:02:46.320
Yeah, I could there definitely is a few things we could take back today.
01:02:47.119 --> 01:02:49.199
Yeah, yeah, absolutely.
01:02:49.519 --> 01:02:50.000
Great.
01:02:50.239 --> 01:02:52.639
So um I just want to wrap up here then.
01:02:52.719 --> 01:03:04.960
Um this kind of completes our um discussion on um, and it's the first in uh a series of um podcasts that we'll be doing, and we'll be looking at international data protection rights.
01:03:05.039 --> 01:03:14.639
So I hope you enjoyed the the podcast, and hopefully very soon you'll see myself and Katie back again um with the second second episode in the series.
01:03:14.800 --> 01:03:18.159
So thank you very much for joining us and uh have a great day.
01:03:20.719 --> 01:03:21.280
Bye.
