![](\"https:\/\/varutra-1a3b6.kxcdn.com\/wp-content\/uploads\/2020\/12\/PRIVACY-now-to-be-a-fundamental-right-in-INDIA-1024x573.png\" "\\"PRIVACY")
\nElectronic data protection in India is currently governed by the Indian penal code, the information Technology Act 2000 \u2013 IT Act Amendment 2008, and therefore the Information Technology Rules, first introduced in 2011. The non-public Data Protection Act (PDPA) emerged from a Supreme Court ruling in 2017 that found privacy to be a fundamental right, and therefore the new changes replace an initial draft produced in 2018.<\/p>\n
In its latest version, the PDPA, which can govern how personal information is handled by business and government bodies within India, highlights, specifically, how technology companies must manage the information of Indian citizens and the way they collect and process the same. The bill, while requiring sensitive data to stay on servers within India\u2019s territory, at the same time permits non-sensitive data to be stored outside the country with certain conditions set by the PDPA. The scope of sensitive or critical data \u2013which is to be stored locally \u2013 is defined by the Indian government and ensured to be followed through out.<\/p>\n
<\/p>\n
Many new compliance requirements are imposed by the bill on most businesses in India for data protection. Almost every business in the India\u2019s economy should meet the bill\u2019s conditions set within the PDPA. This may include not just e-commerce, social media, and IT companies, but also property companies, hospitals, and pharmaceutical domains. The sole exceptions are going to be \u201csmall entities\u201d (businesses like small retailers that collect information manually and meet other conditions to be specified by the PDPA).<\/p>\n
Some financial and telecommunications firms are already subject to privacy and confidentiality requirements taken off by their sectoral regulators so that they already follow some practices required by the bill. Except for all other businesses, these rules would be new and a tug-of-war to make sure compliance for the same.<\/p>\n
<\/p>\n
The bill gives the PDPA the facility to fine any business that doesn’t adhere to the bill or the regulations made by either the PDPA or the govt of the Republic of India.<\/p>\n
A maximum of 150 million Indian rupees (which would be about $2.1 million) or 4 percent of the worldwide turnover of the firm can be the amount of penalty that may be imposed within the preceding twelve months as per the most recent revision.<\/p>\n
So far, the Indian Government has not imposed fines on any organization for the PDPA since the act is in pipeline.<\/p>\n
In case of GDPR, the French National Commission on Informatics and Liberty or CNIL on 21 January 2019 fined Google with a \u20ac50 million fine. This can be the largest GDPR fine ever collected to the current date issued for violation of:<\/p>\n
This fine was imposed on Google for the lack of transparency by the organization on the way how they were collecting and harvesting data.<\/p>\n
<\/p>\n
As time passes, we will see many countries turning out with their privacy laws to ensure data privacy and that they hold the monopoly for data of their citizens in transit and at rest. Few data protection laws are mentioned below.<\/p>\n
<\/p>\n
There are some major differences between the two. First, the bill gives India\u2019s central government the ability to exempt any administrative body from the bill\u2019s requirements. This exemption may be given on the grounds associated with national security, national sovereignty, and public order.<\/p>\n
While the GDPR offers EU member states similar escape clauses, they’re tightly regulated by other EU directives. Without these safeguards, India\u2019s bill potentially gives India\u2019s central government the facility to access individual data over and above existing Indian laws like the knowledge Technology Act of 2000, which prohibited cyber-crimes and e-commerce.<\/p>\n
Second, unlike the GDPR, the Indian bill enables the govt to ask organizations to share any non-personal data gathered by them with the govt. The bill says this is often to boost the delivery of state services. But it doesn’t explain how this data is going to be used, whether it’ll be shared with other private businesses or any compensation is going to be obtained using this data.<\/p>\n
Third, the GDPR doesn’t require businesses to keep EU citizens\u2019 data within the EU. They can transfer it overseas when they meet conditions like standard contractual clauses on data protection, codes of conduct, or certification systems that are approved before the transfer.<\/p>\n
The Indian bill allows the transfer of some personal data, but sensitive personal data can only be transferred outside India if it meets requirements that are kind of like those of the GDPR. What\u2019s more, this data can only be sent outside India to be processed; it can’t be stored outside India. This may create technical issues in delineating between categories of information that must meet this requirement and boost businesses\u2019 compliance costs.<\/p>\n
<\/p>\n
<\/p>\n
Author,<\/p>\n
Omkar Gaikwad,<\/strong><\/p>\n Audit & Compliance Team,<\/p>\n Varutra Consulting Pvt. Ltd.<\/p>","protected":false},"excerpt":{"rendered":" Electronic data protection in India is currently governed by the Indian penal code, the information Technology Act 2000 \u2013 IT Act Amendment 2008, and therefore…<\/p>\n","protected":false},"author":4,"featured_media":5982,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[277],"tags":[325,321,322,324,323],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t