Turn data protection compliance
into competitive advantage.

The new data protection law of India (DPDP Act) that was passed in August 2023 will affect every business entity in India, and affect every aspect of a business in India. At its core, it states the need for lawful processing and the right to protect personal data. Therefore, all of the data collected ‐ of prospects, customers, employees, partners, suppliers etc ‐ will need to be collected with explicit and clear consent and provide full rights to the data owners to update or revoke processing of data beyond the most essential within the ambit of the data protection laws of India.

Any data about an individual, when used alone or in conjunction with other relevant information, can identify that individual.

Much like the GDPR there are four key pillars to the data protection law:

Data Principal ‐ The data owner (or data subject as in GDPR) who has ultimate control over their personal data and how its processed.

Data Fiduciary ‐ The data controller takes ultimate responsibility for usage and processing of personal data strictly in accordance with the consent received from the data principal.

Data Processor ‐ The data processor helps with the processing and storage of personal data. In most cases the data processer will be data fiduciary themselves but can appoint a third-party organisation to process data on their behalf.

Informed Consent ‐ A clear, unambiguous consent presented to customers before collecting and processing data. Note that the consent can be corrected or revoked at any time by the data principal.

Data processing refers to all things that can be done with data such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction. In short it refers to anything you do with personal data in your hands.

While this will take an organisation wide change, at the most fundamental level, the key questions that every business need to ask when collecting personal data is:

• What data are we capturing?
• How do we use and process data?
• Where is data getting stored?
• Who has access to data?
• Is the consent plain and clear?
• Do we provide a way to address grievances?

Atlas Data Registry is a set of APIs, SDKs and no code GUI to help you get started on your data protection journey without any delays. You can add your systems and the data they collect and data they share into the data registry. You can create consent pages and enable them during onboarding of your customers across all your channel touch points. Every system capturing personal data will make a registry entry of the consent and the system capturing personal data. Note that no personal PII data is ever stored in the Data Registry. Your systems can query the Data Registry for the consent provided prior to processing data legally. All the requests raised by Data Principals can also be viewed and approved in a single place. In addition, you will have comprehensive reports to ensure you are fully compliant with the data protection law.
Read the step-by-step DPDP implementation guide here.

While this will take an organisation wide change, at the most fundamental level, the key questions that every business need to ask when collecting personal data is:

• What data are we capturing?
• How do we use and process data?
• Where is data getting stored?
• Who has access to data?
• Is the consent plain and clear?
• Do we provide a way to address grievances?

A clear set of answers to the above will keep the organisations compliant with the digital personal data protection law. And the Atlas Dashboard Data Registry helps with the process to get started immediately.

Atlas Data Registry is a set of APIs, SDKs and no code GUI to help you get started on your data protection journey without any delays. You can add your systems and the data they collect and data they share into the data registry. You can create consent pages and enable them during onboarding of your customers across all your channel touch points. Every system capturing personal data will make a registry entry of the consent and the system capturing personal data. Note that no personal PII data is ever stored in the Data Registry. Your systems can query the Data Registry for the consent provided prior to processing data legally. All the requests raised by Data Principals can also be viewed and approved in a single place. In addition, you will have comprehensive reports to ensure you are fully compliant with the data protection law.
Read the step-by-step DPDP implementation guide here.

NO. The Data Registry simply registers the metadata (data about data) when capturing personal data. Your data will reside where they normally reside. The Data Registry will ensure that all of the data processing is done as per the consent given by the customer. So systems registered in the Registry can request for permission to enrol and query the registry to obtain the permission granted prior to processing data. For instance, if a System wants to send you personalised advertisement to your mobile, the system can first query the Registry for the permission granted by you. If you have denied permission for advertisement, the system cannot use your data for the same. Simple as that.

This is poised to be the most challenging task for businesses in India. Nonetheless, we have significantly simplified the process. Utilize our consent designer in the Atlas Dashboard to easily create consent pages for various stakeholders—customers, employees, vendors, etc. Simply share the link via email or registered mobile to obtain their informed consent. The consent page allows users to review the collected and processed data shared with third parties. Users can provide informed consent, and this information will be securely stored in the data registry. It's essential to note that this is a one-time exercise to ensure ongoing compliance. And then you use our APIs for real time consent capture.

Absolutely. The law to protect personal data is not only meant for large organisations such as Banks, Insurance and Telecoms. It applies to every company, big or small, that collect personal data from anyone such as customers, employees, suppliers and so on. If the data is held digitally, then it is incumbent on you to comply with the law. The good news is, it is not scary to get started. With some simple steps, you can get started for free using our Atlas Dashboard. Book a demo to see how you can be on your way to turn compliance into competitive advantage.

If you are a very small entity with few customers and few employees then you can manage with simple email-based consent letters. However, if you are a growing company with many new customers, then its best to use a technology solution such as ours right from the start.

The simple answer is: You must send a notice ‘and’ obtain consent from the data principal. Let's analyse this by diving into the DPDP Act.

Section 5(2) states: “Where a Data Principal has given her consent for the processing of her personal data before the date of commencement of this Act,— (a) the Data Fiduciary shall, as soon as it is reasonably practicable, give to the Data Principal a notice informing her,–– (i) the personal data and the purpose for which the same has been processed; (ii) the manner in which she may exercise her rights under sub-section (4) of section 6 and section 13; and (iii) the manner in which the Data Principal may make a complaint to the Board, in such manner and as may be prescribed”.

This is pretty clear that Data Fiduciaries ‘should’ provide a consent notice. But what is not clear here is just sending a notice enough or should the Fiduciary get a response? What if the details are incorrect and doesn’t reach the User (expired emails, phone numbers etc).

Section 5 (2) (b) also states: the Data Fiduciary may continue to process the personal data until and unless the Data Principal withdraws her consent.

Closely associated with this is Section 7(a) “A Data Fiduciary may process personal data of a Data Principal for any of following uses, namely — (a) for the specified purpose for which the Data Principal has voluntarily provided her personal data to the Data Fiduciary, and in respect of which she has not indicated to the Data Fiduciary that she does not consent to the use of her personal data”.

This adds to the confusion. One interpretation is so long as the Data Principal has not withdrawn the consent (already) given, the Data Fiduciary can continue to process the data.

Hang in there until the gavel comes down in Section 6 (10): “Where a consent given by the Data Principal is the basis of processing of personal data and a question arises in this regard in a proceeding, the Data Fiduciary shall be obliged to prove that a notice was given by her to the Data Principal and consent was given by such Data Principal to the Data Fiduciary in accordance with the provisions of this Act and the rules made thereunder”.

It is clear that sending a notice alone is not enough. The Fiduciary must prove that consent has been explicitly given. If the Data Principal raises this as a concern with the Data Protection Board, it is incumbent upon the Fiduciary to prove that such consent or legal basis has been established to process the data.

This begs the question of what happens when customers go incommunicado. This is a different matter covered as part of Periodic Updation in the Master KYC directive. If customers don’t provide consent, or there isn't a legal basis to process, Data Fiduciaries ‘must’ stop processing their data. Period.

Organisations will be judged not just for their brand value and instead judged by how they safeguard their privacy without the ad bombs and SMS hinderances and more recently wading into our private WhatsApp communications disrupting every aspect of our lives from getting life done.

• What data does the organisation collect?
• Is the consent provided to me clear?
• Is the data collected only for the purposes informed in the consent?
• Is the data adequate (not more) for the product/service I am choosing?
• How does the organisation secure my data?
• What data does the organisation share with others for legitimate processing?
• Is my data sold to third parties (other than the purpose for which it was obtained)?
• What rights do I have to my data?
• Can I control the use of my data? ‐ e.g. restrict access to third parties, erase etc
• Can I download use of my data?
• How easy it is for me to control my data?
• Is there a grievance officer that I can complain if my queries are not heard?

This is poised to be the most challenging task for businesses in India. Nonetheless, we have significantly simplified the process. Utilize our consent designer in the Atlas Dashboard to easily create consent pages for various stakeholders—customers, employees, vendors, etc. Simply share the link via email or registered mobile to obtain their informed consent. The consent page allows users to review the collected and processed data shared with third parties. Users can provide informed consent, and this information will be securely stored in the data registry. It's essential to note that this is a one-time exercise to ensure ongoing compliance. And then you use our APIs for real time consent capture.

Migrating to the new DPDP regime is not easy. While a reasonable amount of effort was added to protect data, the DPDP law mandates user consent at the centre of data processing which is a step change in how data was handled thus far. Migrating to DPDP regime requires a concerted effort to identify all of the source systems collecting PII data, storage systems, data processors handling PII data, purpose for which PII data is handled and fresh data consent from data owners. A massive effort is needed to get the required consent before going ahead with processing of data from here on which will impact every system handling PII data at the moment. We have largely simplified the process with the system enrolment, consent designer and simple plug and play APIs. Please book a demo so you can see for yourself how you can begin the journey towards lifelong data protection compliance.

Citizens ‐ data principals, have ultimate right to view how their data is being processed and change or revoke their preferences anytime. In particular, data principals have the following rights under the current data protection law.

• Right of access
• Right to correction
• Right to erasure
• Right to withdraw consent
• Right to grievance redressal
• Right to nominate any other individual who, in the event of death or incapacity of the data principal, can exercise their rights under the Act.

If you are a business, then you must be collecting customer data and processing it, at the very least to add them to your billing and support systems. Now, here’s where some confusion arises. Suppose we are onboarding a customer (let’s call them Future Bank). We collect the name, email, and phone number of a few technical and business contacts from Future Bank as part of our order form, and then register them in our CRM (System 1), Billing (System 2), and Support (System 3). Incidentally, Systems 1, 2, and 3 happen to be third-party platforms (read Saas), which brings us to the key question - how do we handle this situation with respect to consent?

Technically (and to an extent, our interpretation of the law), when we store or process someone’s personal data on a third-party platform (say Tally, Zoho, AWS, Azure etc), it counts as sharing data with a third party (or data processor). We believe this applies under every privacy law in its strict interpretation of data sharing.

Now, the interesting part is that we are not actually sharing data with third parties to process on our behalf. They are simply technical/software platforms enabling us to process the customer data we obtained directly. Therefore, consent depends on the purpose of processing and on who the data belongs to. Let’s break this down a bit.

We are collecting the name, email, and phone number of an employee of Future Bank (remember, our customer here). This is definitely personal data, even if the email and phone number are work specific.

We create a new customer in our systems (CRM, Billing, and Support). While the account registered with the third-party systems belongs to us (takes the meaning of data fiduciary), we still add the customer details to a third-party managed system (takes the meaning of data processor).

Now, we can apply Section 4(1) of the DPDP Act — this data is used for a lawful purpose and is necessary to serve the customer as part of the contractual agreement between us and the customer. Adding them to the third-party systems is necessary for us to fulfil that contractual obligation. Therefore, the contract itself will suffice without the need for explicit consent from the employees whose data we are collecting. The risks still remain, however, as how the third party adheres to the law. It is, to an extent, outside our control (despite having a DPA in place).

Of course, if you plan to use this data to send newsletters or other optional marketing information, sell or share with third parties other than for lawful purposes, you must obtain explicit consent before doing so and allow them to exercise their right to change or withdraw consent at any time.

To summarise again, our interpretation is that you are fully compliant even if you use third-party systems to serve customers and fulfil contractual obligations. As a best practice, though, ensure that you disclose this information as part of the consent notice you issue to customers (perhaps as a list of third-party processors), and ensure there is a DPA with the third-party platform provider. The best way to earn trust is to disclose as many details as legally permissible.

As a customer (or referred to as Data Principal, that is, you and I) under India's Digital Personal Data Protection Act (equivalent to a Data Subject in GDPR terms), what are your rights?

Chapter 3 of the DPDPA specifically addresses the rights and duties of a data principal. Let's break it down into simpler language here.

As a customer, you have the right to ask the organisation with whom you have shared your personal data how they have used (or the tech term is processed) your data from the moment you have signed up to use their products/services.

You also have the right to ask the same organisation to disclose the names of people or companies with whom they have shared your data (known as data processors). The law mandates that this must be a simple request in a prescribed form to get to know how the organisation – you entrusted your data with in the first place – is treating your data.

For example, if you have booked a flight ticket or enquired about an insurance proposal on an online portal in the past, you can simply raise a request asking them to share the details of how they have processed your data and if they are still processing your data and also show all the other companies with whom they have shared your data. This is pretty powerful because you now have the power to stop them from sharing it outright and provide selective consent if you wish to allow them to continue processing your data.

Of course, it is worth noting the riders such as clause 11(2), which allows sharing your data without your consent for lawful purposes such as fraud investigations or the prosecution of offences. Also, you have the right to make corrections to your data, change your consent or messaging preferences anytime, and if you are done with an organisation for good, you can even ask them to delete your data from all their systems. Of course, your deletion request does not override prevailing regulations on record-keeping for regulated entities (for example, bank records will have to be maintained for 10 years even after you close your account or ask them to delete it).

If organisations dilly-dally or make you run from pillar to post or do not honour your legal requests under the #DPDP law, you can raise a grievance request to the data protection officer (the names and emails should be available freely in organisation’s website). And if that doesn't help, you can write to the Data Protection Board (much like the RBI ombudsman to help ensure that the law is enforced).