India introduces new Data Protection Act
The Digital Personal Data Protection Act, 2023 (DPDP Act), India’s inaugural legislation dedicated to data protection, is set to become effective in June 2024. Having received presidential approval on August 11, 2023, the enactment marks the culmination of a five-year endeavor to establish a dedicated data protection law in the country.
As per the DPDP Act, personal data is defined as “any data about an individual who is identifiable by or in relation to such data.” Furthermore, processing is characterized as “wholly or partially automated operation or set of operations performed on digital personal data,” encompassing activities like collection, recording, organization, storage, retrieval, use, sharing, disclosure, restriction, erasure, or destruction.
Ankita Sabharwal, a Senior Associate at Chadha and Chadha in Bengaluru, emphasizes that the act not only outlines consent requirements but also addresses the grounds for processing digital personal data, the rights and responsibilities of data principals, and the obligations of data fiduciaries.
“To comply with the DPDP Act, businesses must engage in data sharing agreements (DSAs),” explained Sabharwal. “These are legally binding contracts governing data sharing between parties, irrespective of whether the data is shared domestically or internationally.”
The legislation imposes stringent measures for obtaining consent before collecting, using, or sharing personal data, stressing the importance of robust security protocols to thwart unauthorized data sharing. Additionally, it introduces provisions for transferring personal data outside India, specifying compliance measures and granting authority to the central government to restrict transfers to certain countries.
The DPDP Act is anticipated to significantly benefit India’s intellectual property (IP) ecosystem, particularly businesses heavily reliant on IP monetization. Sabharwal highlights the act’s focus on transparency and data security, mandating businesses to seek customer consent. While acknowledging additional compliance responsibilities, she underscores their role in enhancing transparency and accountability among users, brands, and platforms.
In the realm of IP assets, Sabharwal underscores the importance of companies ensuring compliance to ward off potential threats or attacks compromising sensitive information. Non-compliance may erode trust, leading to diminished revenues and a shrinking customer base. Despite appearing burdensome, the act’s compliance measures are viewed as instrumental in fostering a safer business environment.
The importance to have a law on personal data safety
Having a law on personal data safety is crucial for several reasons, as it helps protect individuals, businesses, and society at large in the increasingly digital and interconnected world. Here are some key reasons why having laws on personal data safety is important:
- Privacy Protection: Personal data safety laws are designed to safeguard individuals’ privacy rights. They establish boundaries on how organizations and entities can collect, use, and share personal information. This helps prevent unauthorized access to sensitive data, ensuring that individuals have control over their own information.
- Preventing Identity Theft and Fraud: Laws on personal data safety aim to prevent identity theft and fraudulent activities. When personal data falls into the wrong hands, it can be exploited for financial gain or used to commit crimes. Regulations help establish security measures to mitigate these risks.
- Building Trust: Clear and enforceable laws create a foundation of trust between individuals and the organizations that collect and process their data. Knowing that their personal information is being handled responsibly and legally fosters confidence in online and offline transactions.
- Data Breach Response and Notification: Laws often require organizations to promptly notify individuals in the event of a data breach. This allows affected individuals to take necessary actions, such as changing passwords or monitoring their financial accounts, to minimize potential harm.
- Promoting Responsible Data Handling: Regulations set standards for responsible data handling practices. Organizations are required to implement security measures to protect personal information from unauthorized access, disclosure, alteration, and destruction.
- Global Interoperability: With the increasing globalization of data flows, having consistent laws on personal data safety helps facilitate international data exchanges. Many countries and regions are adopting or updating their data protection laws to align with global standards, such as the General Data Protection Regulation (GDPR) in the European Union.
- Encouraging Innovation: Clear regulations provide a framework that encourages responsible innovation. When individuals feel confident that their privacy is protected, they may be more willing to engage with new technologies and services that rely on the collection and processing of personal data.
- Legal Accountability and Penalties: Laws establish legal accountability for organizations that fail to comply with data protection regulations. Penalties for non-compliance serve as a deterrent and incentivize entities to prioritize the security and privacy of personal data.
***Other Articles***
– You could see Procedure of Trademark in India here.
– You could visit here to see Required documents of filing trademark in India.
Contact AAA IPRIGHT: Email: [email protected]
Or sending your inquiry by filling the form:
