When you share your name, address, and phone number with a vendor while completing an online transaction, you share your private data with them. Have you considered what happens to your personal data? How is it stored, or is it shared with other parties?
As India’s digital economy continues to grow at a staggering pace—thanks to the government’s growth initiatives and increasing internet penetration—data privacy and protection are matters of national concern. The enactment of the Digital Personal Data Protection Act (DPDPA) in 2023 is a remarkable step towards this direction.
In this blog, we will get into the details of the DPDPA, to tell you how you can protect your data and how companies should be more responsible towards your data’s protection.
The Evolution of Data Protection and Privacy in India
Before DPDPA, the Information Technology Act, of 2000 addressed consumer privacy concerns. However, it had specific loopholes that led to the DPDPA’s enactment. In this part of the blog, we will trace the early days of privacy laws, the loopholes, and the steps executed for more comprehensive coverage of privacy concerns.
Early Days of Privacy Laws
The Information Act, 2000 laid the groundwork for cyber laws. However, its biggest limitation was its inability to provide comprehensive protection to individual private data. Case in point: Section 43A addressed how companies should handle sensitive data but lacked enforcement mechanisms. What exactly are enforcement mechanisms? Here’s an example.
Imagine a health management platform that stores sensitive customer information like medications and health conditions, and experiences a data breach due to improper security measures. Hackers gain access to the personal data of 10 million users. Under the section 43A, the health platform could be penalized for not having “reasonable security systems” in place. However, there was no formal definition of these reasonable security systems. Because these guidelines were not provided it was challenging to impose penalties on the company.
A turning point came in 2017 when the Supreme Court passed the landmark judgement that an individual’s privacy is a fundamental right under the Constitution of India. This judgment set the stage for stronger protections and more comprehensive legislation.
Steps Toward Comprehensive Legislation
The Personal Data Protection Bill (PDP) was introduced in 2019 to address the growing concern related to data privacy. The bill’s goal was to build a framework equivalent to the global standards. However, it was a slow and arduous process as it became a hot topic in many debates. Finally, after a long series of refinements, the Digital Personal Data Protection Act (DPDPA) was passed outlining the clear responsibilities of companies handling an individual’s personal data.
What is Data Privacy and Data Protection?
We have set the stage to understand why passing the DPDPA was necessary and how it’s more advanced than the Information Act 2000. Before we get to the features of DPDPA, it’s important to have a clear understanding of the difference between data privacy and data protection. You might hear people use these terms interchangeably, however, they have differences.
Data Privacy
Data privacy is about rights related to your personal data. It covers how your personal data is collected, used, and shared. Additionally, it emphasises the need to obtain your consent before collecting your data and your control over the data collected by companies. In India, there have been instances of privacy issues with systems like Aadhar and other mobile apps and online platforms.
Data Protection
Data protection is a blanket term for all the technical measures and protocols implemented to safeguard data from breaches, theft, and misuse. For example, an e-commerce company employs data encryption methods and multi-factor authentication to protect customer data.
Key Features of India’s Digital Personal Data Protection Act 2023
We mentioned DPDPA’s framework before, so let’s talk about the features of DPDPA that build the framework.
Applicability
DPDPA applies to:
- Protecting the personal data of individuals residing in India
- Any business operating in India and processing personal data
- It regulates how personal data is transferred overseas to protect it from misuse
Key provisions
- Data Principal Rights: Here is the list of rights DPDPA empowers individuals with:
- Consent: As an individual, you must give your explicit consent to a company or a website before your data is collected or processed
- Access: Individuals have the right to access data stored by organizations
- Correction: If you find inaccuracies in data, you have the right to request corrections from the organization
- Grievance Redressal: Grievance redressal is a mechanism where individuals can raise complaints about data handling practices
- Duties of Data Fiduciaries: Data fiduciaries are organizations that store and manage individual’s personal data. Here is a list of duties they must perform:
- Implement sufficient security measures to protect personal data
- Always maintain transparency about how they process private information
- Respect individual rights as outlined in DPDPA
- Accountability mechanisms: Accountability mechanisms are like watchdogs that oversee the compliance of DPDPA rules and address grievances. The Data Protection Board of India is in charge of this and has the authority to impose penalties on companies that violate the provisions of the act.
DPDPA Comparisons With Global Regulations
The DPDPA is based on global regulations protecting individual data privacy:
General Data Protection Regulation (GDPR): GDPR shares similarities with DPDPA as it emphasizes individual rights and consent in Europe. However, it has more strict rules for organizations about processing individual data and penalties for non-compliance. For example, GDPR imposes fines of up to 4% of global annual turnover or Euro 20 million. DPDPA imposes up to 5% on the annual turnover or Rs. 500 crore whichever is higher.
California Consumer Privacy Act (CCPA): CCPA and DPDPA also share certain similarities like both of them give individuals the right to access and delete their data from a company’s database. However, both follow a different consent model. CCPA allows users to “opt-out” of data sales whereas DPDPA follows the “opt-in” model requiring clear consent from individuals before processing their data.
Why Is Data Privacy and Protection Critical in India?
Data privacy and data protection have the power to reshape economies and societies. Here are the key reasons why it’s critical:
Economic Context
- Global Outsourcing Hub: India is the leading outsourcing hub for IT and data-related services. Many companies trust and rely on Indian firms to store and process the private data of individuals. Ensuring the implementation of stringent data security and protection measures will attract more global companies and help to build competitiveness in the global market.
- Rising Digital Payments and E-commerce: Digital payments grew in India at a CAGR of 44% from the financial year 2017-18 to the financial year 2023-24. The story is similar to e-commerce transactions. Due to the high volume of online transactions, individuals share more personal information online. Therefore, in the case of a data breach, many individuals will face the loss of personal data. A robust protection mechanism is the need of the hour to keep such sensitive information protected at all times.
Risks and Challenges
- Notable Breaches: India has witnessed several high-profile data breach incidents highlighting the vulnerabilities in our data security infrastructure. The Aadhar data breach is one such prominent example. Due to the incident, the private data of 815 million Indians were compromised. In addition to the Aadhar data breach, there have been Credit Card scams where hackers got access to data of individuals.
- Impact on Consumer Trust: Data breaches have devastating effects on consumer trust and business reputation. When consumers get the feeling that their Personally Identifiable Information (PII) has been exposed, they feel threatened and hesitate to use digital mediums for transactions. This has a snowballing effect on various sectors ultimately leading to stunted growth of the economy.
Practical Steps to Enhance Data Privacy and Protection in India
Enhancing data privacy and data protection in India will require concentrated efforts from individuals, organizations, and the government. Here are some practical steps to get started:
For Individuals
- Awareness of Rights: While DPDPA is a powerful act towards data protection, it’s individual responsibility to be aware of the rights covered in the act. This includes knowing how to get access to data, correct inaccuracies, and exercise the right to erase data from the company database. Moreover, becoming more familiar with the privacy settings on the apps and websites will help us control our sensitive data better.
- Safeguarding Sensitive Personal Information: When carrying out any transactions online, individuals must be very careful about where they share sensitive information. Being wary of unsecured platforms and suspicious apps and using strong passwords and multi-factor authentication will enhance data privacy.
For Businesses
- Compliance with DPDPA Requirements: The first step companies must follow is to align their data handling practices with the DPDPA requirements. The best way to do that is by asking for explicit consent from their customers before processing their data. In addition to that, maintaining a high level of transparency about data usage and setting up grievance mechanisms proactively will go a long way in building trust.
- Invest in Secure Technologies: Secure technologies like blockchain and encryption will protect secure data from breaches. Companies must also invest in regular data audits and vulnerability assessments to identify potential risks early on.
For Government
Promoting Awareness Campaigns: The government must plan awareness campaigns to encourage individuals to learn about their rights under DPDPA. Promoting such campaigns on digital media will ensure that the target audience becomes aware of these campaigns and takes active steps to have better control over their data.
Strengthening Law Enforcement Against Cybercrimes: To squash cyber crimes, the government will have to spend considerable time and budget on training law enforcement agencies. Special cybercrime units must be set up to train them on handling data breaches and cyber incidents.
Challenges in Enforcing Data Privacy and Protection in India
Enforcing data privacy and protection in India is challenging due to the following reasons:
Cultural and behavioural aspects
- Low Public Awareness of Data Privacy: The Indian consumer has very little understanding of data privacy. This was proved by a PwC survey which highlighted that only 16% of Indian consumers are aware of the DPDPA and 565% don’t understand their rights related to personal information. Protecting their information effectively will be a major roadblock unless this substantial gap is filled.
- Acceptance of Data Misuse as a Norm: Data misuse has also emerged as a cultural norm in India. Indian consumers have developed the mentality that their personal data is getting compromised and misused by companies. This reason for such thinking can be attributed to their lack of awareness towards the serious implications of data breaches. Prioritizing data privacy in this type of culture is a colossal challenge.
Business Concerns
Compliance Costs for Startups and SMEs: For startups and Small and Medium Enterprises (SMEs), investing in security systems like data encryption tools will demand substantial investment. Due to the lack of resources, employing a system and conducting regular audits will be prohibitive towards their growth plans.
Balancing Innovation with Regulation: Innovation is at the centre of activities for organizations especially if they sell on digital platforms. However, implementing new innovations might not be conducive to data security regulations. Balancing both of them will be key for organizations.
Policy Challenges
Ambiguities in Cross-Border Data Flow Rules: Provisions for cross-border data transfers are mentioned in DPDPA. But which countries could be trusted for data transfers is not clearly mentioned. This uncertainty is a challenge for companies operating internationally and could lead to a fall in foreign investments.
Implementation and Monitoring Hurdles: DPDPA will only be successful if a robust mechanism is set up to ensure compliance among organizations. However, there is a lack of clarity about the roles and responsibilities of regulatory bodies leading to inconsistent enforcement.
The Future of Data Privacy and Protection in India
The future of data privacy and protection in India will be driven by several factors including growing public awareness. As consumers become more concerned about the safety of personal data, companies have to prioritize transparency and data security.
The potential amendments to DPDPA to keep pace with technologies like AI and IoT will further tighten the ropes around the data handling procedures of organizations. The other significant factor that will contribute to building a brighter future for data privacy is the strategic collaboration between government, businesses, and international bodies. This will be a decisive step in building a strong ecosystem for the protection of individual rights.
In this evolving environment, solutions like HyperTrust will play a crucial role in helping businesses be compliant with data protection laws and regulations. HyperTrust is designed to enhance data privacy and protection for organizations operating in India’s dynamic digital economy.
Visit the website, to learn more about Hypertrust.
FAQs
What is the difference between Data Privacy and Data Protection?
Data privacy is individuals’ right to control how their personal information is collected, used, and shared. Data protection is safeguarding data from unauthorized access, breaches, or misuse through technical measures and policies.
What are the penalties for non-compliance with DPDPA?
Non-compliance with the Digital Personal Data Protection Act (DPDPA) can result to organizations facing fines up to 5% of their annual turnover or ₹500 crore, whichever is higher. Additionally, the Data Protection Board of India has the authority to impose penalties for violations of the act
How does the DPDPA compare with GDPR?
The DPDPA shares similarities with the General Data Protection Regulation (GDPR) in terms of protecting individual rights and requiring consent for data processing. However, GDPR has stricter enforcement mechanisms and higher penalties (up to 4% of global annual turnover). The DPDPA focuses more on local context and may have different stipulations regarding cross-border data transfers
What are the key challenges in implementing data protection laws in India?
Key challenges include low public awareness of data privacy rights, high compliance costs for startups and SMEs, and ambiguities in regulations regarding cross-border data flows. Additionally, there are hurdles related to monitoring and enforcing compliance effectively across various sectors
