The Data Protection Bill covers diverse aspects of personal and sensitive data protection

Once the Data Privacy Bill mandates certain requirement, it is bound to shake up the existing ecosystem and customers will ask of simpler ways to implement the security requirements as asked for by the Data Privacy Bill. It is expected that in longer term it shall simplify the adoption of security practices by nudging the organizations to build privacy by design rather than thinking of it as an after-thought.

Says Jayant Saran, Partner, Forensic – Financial Advisory, Deloitte India, “The Bill covers diverse aspects of data protection including collection, processing and analysing of personal data. It also lays emphasis on protection of personal and sensitive data of children. The bill has placed emphasis on defining various stakeholders and participants such as fiduciary (entity requesting processing of personal data), processor (analyser of said personal data), and principal (individual to whom the personal data belongs). This is a welcome move considering several other developed economies already have stringent data protection laws.

The Bill also proposes significant financial penalties for noncompliance which will compel organisations to relook at how they treat personal data and take appropriate measures to remain compliant. Specifically, in the context of corporate fraud investigation and related scrutiny of transactions, the Bill covers the rights of data principals even during allegations of fraud and subsequent investigations. For example,

•    In order for the data fiduciary (the client) to forensically preserve data of the company issued IT assets (laptops/desktops/mobile phones etc.) of the data principal (suspect/target/custodian) to conduct the investigation, consent and prior intimation for collecting the data of said data principal will be required as these devices may contain personal information relating to the data principal.
•    The data fiduciary will also have to disclose the reason for collecting the data and the proposed retention period of the collected data to a competent Authority as defined by the bill.