Please click here to download the Prism as a PDF.

 

Beyond global compliance: Navigating additional obligations under the Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 (“DPDPA”), along with the Draft Digital Personal Data Protection Rules, 2025[1] (“Draft Rules”), introduce certain compliance requirements that are different from other global data protection laws. Although entities located outside India, may already be compliant with their geography’s laws, they will now have to go a step further to ensure alignment with the DPDPA’s specific obligations, particularly around consent, cross-border data transfers, grievance redressal, and accountability. In this edition of the Prism, we explore key compliance requirements to be taken into consideration by these entities.

 

Applicability

The DPDPA applies to entities outside India when they process data in India or when they process data of residents in India in connection with offering goods or services. This means that entities, that handle the digital personal data of Indian data principals must comply with DPDPA requirements.

 

Key considerations for entities operating outside India

Consent

1. Consent as the primary basis of processing personal data:

The primary basis for processing personal data under the DPDPA is consent. This is different from other global data protection laws like the General Data Protection Regulation (“GDPR”), under which consent is one of the bases for processing personal data and there are several other grounds for processing personal data like the performance of a contract, legitimate interests, etc, or the California Consumer Privacy Act (“CCPA”) which primarily relies on an opt-out model rather than requiring explicit consent for most data processing activities.

Entities that rely on any ground for processing personal data other than consent, under the other data protection laws, may now need to revisit their grounds for processing personal data to be compliant with their obligations under the DPDPA. These entities need to rely on consent for processing personal data unless their processing activity falls under any of the legitimate uses specified under the DPDPA such as voluntary submission of personal data or processing for government benefits, medical emergencies, processing for State functions, legal compliance, or for core employment functions.

2. Privacy notice to be published in english and the languages listed in the Eighth Schedule of the Indian Constitution:

When processing is based on consent, the data fiduciaries including such entities operating outside India, are required to provide a privacy notice that is independent, clear, and in plain language with an itemised description of the personal data processed for an itemised purpose and description of goods/services. Under the DPDPA the data fiduciaries are required to publish the privacy notice not only in English but also in the languages listed in the Eighth Schedule of the Indian Constitution. This might mean developing localised, legally compliant notices in multiple Indian languages, which requires additional resources and legal vetting for linguistic accuracy.

3. Verifiable consent for processing personal Data of children:

DPDPA mandates that the data fiduciaries ensure verifiable parental consent before processing any children’s data. Unlike the CCPA or the U.S. Children’s Online Privacy Protection Act (“COPPA”), which imposes parental consent for children aged between 13 (thirteen) and 16 (sixteen), the requirement of verifiable parental consent under the DPDPA applies to all children under the age of 18 (eighteen). The draft Rules also prescribe the means to obtain verifiable consent of the parents. The requirement of verifiable consent under the DPDPA is similar to the requirement under COPPA, however, the requirement under COPPA applies to only such entities providing services directed at children. The DPDPA adds an additional layer of complexity, even for entities providing services that are not directed at children, as they must still adhere to these requirements when handling any children’s data.

4. Verifiable consent for processing personal data of a person with disability:

The DPDPA has extended the requirement of verifiable consent to processing personal data of a person with a disability as well. The data fiduciary would need verifiable consent from a lawful guardian before processing personal data of a person with disability. The Draft Rules require the data fiduciary to also verify that such guardian is duly appointed under applicable laws. This would mean the data fiduciaries may need to have separate consent workflow mechanisms while processing the personal data of a person with disability.

5. Consent managers:

The concept of consent managers is very new in the global data protection regime. The option of providing, managing, and withdrawing consent via a third party is a novel concept provided for in the DPDPA. The DPDPA provides the option for the data principals to give, manage, and review their consent through a consent manager. The consent manager is an unrelated third party with an interoperable platform, that helps to manage the consent flow between the data principal and the data fiduciary. Even entities operating outside India could explore the possibility of integrating with consent managers while processing such data principals’ data who have decided to manage their consent through consent managers.

 

Data fiduciary obligations

1. No separate data processor obligation; data fiduciary to be solely responsible for its data processors’ compliance:

Unlike GDPR or Health Insurance Portability and Accountability Act (HIPAA) which places independent legal obligations on the processors or business associates respectively, the DPDPA does not impose any obligation directly on the data processors. This imposes additional obligations on the data fiduciaries to flow down all the required obligations contractually to the data processors to ensure data processors’ compliance with the DPDPA. The DPDPA also requires the data fiduciaries to implement reasonable security safeguards to protect the personal data both in its possession or under its control, including the personal data processed by a data processor. To ensure this it is important that data fiduciaries undertake extensive due diligence on the data processors including diligence on the security safeguards implemented by these processors before engaging them, negotiate appropriate contracts and audit their vendors periodically.

2. Ensure data accuracy and completeness:

Additionally, the DPDPA mandates that data fiduciaries ensure data accuracy and completeness before making decisions affecting individuals or sharing data with other fiduciaries.

3. Data Retention:

The Draft Rules have prescribed a definitive data retention period for certain classes of data fiduciaries, such as e-commerce entities, online gaming intermediaries, and social media platforms. This is not the case under other global data protection laws. GDPR or CCPA does not prescribe a specific retention period but rather mandates the entities to only retain the personal data as long as it is necessary for the collected purpose. The entities that fall under any of the classes of data fiduciaries specified under the Third Schedule of the Draft Rules, may now be required to re-evaluate their existing data retention policies to align with the requirements under the DPDPA.

 

Data principal rights

1. Right to nominate:

Most of the rights that data principals have under the DPDPA align with other global laws like the GDPR. Additionally, the DPDPA provides the data principals with the right to nominate, which is not present under the GDPR or the CCPA. This right enables the data principals to designate one or more individuals to exercise their data principal rights on their behalf in the event of their death or incapacity. The data fiduciaries including those entities that comply with GDPR or CCPA may need to update their technical and organisational measures to accommodate this nomination process, ensuring both the data principal and their nominee can be properly identified, and the right is exercised appropriately.

2. Grievance redressal:

The DPDPA mandates the data fiduciaries and consent managers to provide the data principals with the right to grievance redressal to address any act or omission of such data fiduciary or consent manager. While GDPR requires the entities to be transparent about how data principals can make requests exercise their rights and have processes in place to address data subject requests efficiently, the right to grievance redressal is not an explicit right under GDPR. CCPA is also similar to GDPR in this regard. The data fiduciaries to be compliant with DPDPA in addition to having processes to enable the data principals to exercise their rights like the right to access or erasure, now need to implement grievance redressal mechanisms.

 

New categories of data fiduciaries: Significant Data Fiduciaries

The DPDPA has introduced a new class of data fiduciaries i.e., the Significant Data Fiduciaries (“SDFs”). An entity might be classified as an SDF based on the volume and sensitivity of personal data processed, risk to the rights of the data principals, etc. While the GDPR and CCPA impose additional obligations based on the sensitivity of the data processed by an entity, the DPDPA categorises entities themselves into different classes. The DPDPA and the Draft Rules impose these additional obligations on the SDF:

1. Data Protection Impact Assessments (“DPIAs”) and audits:

The DPDPA mandates that SDFs conduct DPIAs and independent data audits annually. These reports must be submitted to the Data Protection Board of India (“Board”). While the GDPR mandates periodic DPIAs only when processing activities pose a high risk to the data subjects, the DPDPA requires all SDFs to conduct a DPIA annually. The independent data audit is mandated in addition to DPIAs, which differs from other laws like the GDPR or CCPA. For entities who are compliant with other global data protection laws, complying with DPDPA may mean additional compliance requirements.

2. Algorithmic due diligence:

Under the draft Rules, SDFs must do due diligence to ensure that any algorithmic software used for data processing does not pose risks to data principals’ rights. GDPR includes protections against automated decision-making, allowing individuals to opt out of decisions made solely by automated processing. However, GDPR does not mandate proactive due diligence of all algorithmic models before deployment, which the DPDPA requires. CCPA, while focused on data privacy, does not impose direct obligations on artificial intelligence or automated decision-making. This due diligence requirement under the DPDPA may involve additional compliance checks, periodic internal reviews, and implementation of transparency mechanisms for the SDFs using algorithmic software.

3. Data localisation:

The Draft Rules give the power to the Central Government to mandate personal data processed by SDFs to be processed and stored exclusively in India. This provision differs from GDPR, which does not mandate data localisation for any category of data and permits cross-border transfer to a country recognised by the adequacy decision or to a third country if adequate additional safeguards are in place. Similarly, while CCPA imposes restrictions on data sharing and data selling, does not require data localisation. SDFs that might process those categories of data identified by the Central Government, may need to explore the possibilities of having local data centres in India or restructuring data flows to comply with the new restrictions under the DPDPA.

4. Appointment of a Data Protection Officer (“DPO”) in India:

Under the DPDPA, SDFs are required to appoint a DPO in India. This would mean SDFs operating outside India who have a DPO outside India may need to evaluate appointing a DPO in India to be compliant with the DPDPA.

 

Cross-border data transfer

GDPR allows cross-border data transfer based on adequacy decisions, contractual safeguards, or Binding Corporate Rules (BCRs). The DPDPA takes a different approach by which the Central Government can restrict the transfer of personal data to specific countries or territories. Under the Draft Rules, the Central Government may also add other restrictions on transfer of personal data outside India. The data fiduciaries to be compliant with the cross-border transfer restrictions should reassess their data storage and processing strategies.

 

Prompt personal data breach notification to data principals and the Board

Under the DPDPA, a personal data breach must be reported both to the Board and to each affected data principal. The notification to data principals must be concise, clear, and in plain language, delivered without delay via their registered communication channels. Following the prompt initial notification to the data principal and the Board, the data fiduciaries must send a follow-up notice to the Board, providing a description of the breach and a detailed report, within 72 (seventy-two) hours, covering causes, impact, responsible parties, and remediation efforts. There may be a difference in the notification requirement under the DPDPA and other global data protection laws. GDPR for instance, requires the entities to notify the supervisory authority within 72 (seventy-two) hours, and such affected individuals only if the breach poses a high risk to their rights and freedoms and CCPA requires notification of breach involving unencrypted personal information. The DPDPA, however, mandates notification in all cases, regardless of a harm or risk threshold.

Entities to be compliant with DPDPA may now need to re-evaluate their incident management and response plans to ensure faster detection, response, and notification mechanisms.

 

Central Government directions

Under the DPDPA, the Central Government has the authority to request information from data fiduciaries in the interest of India’s sovereignty, integrity, or security, or to fulfil its legal obligations or perform specific functions. The DPDPA extends this power of the Central Government to all data fiduciaries, including entities that operate outside India but offer goods or services within India.

 

Non-monetary penalties

While the focus of the global data protection laws is primarily on imposing monetary compensation on the entities violating their data protection obligations, under the DPDPA, the Board apart from having the power to impose monetary penalties, also has the power to recommend to the Central Government to block access to information or services provided by such data fiduciary in the public interest.

This introduces an operational risk that goes beyond mere financial penalties. If the Central Government decides to block access to their services in India, entities could face disruptions in business operations including their ability to process transactions and provide services, or information within India.

 

This Prism has been prepared by:

Akshaya Suresh Partner

Drishya A. Kamath Associate

Tharusha Selvanambi Associate

 

For more details, please contact [email protected].

 

[1] The draft rules are open for public consideration until February 18, 2025.

 

Please click here to download the Prism as a PDF.

 

Navigating compliance under the Digital Personal Data Protection Act, 2023: Key considerations for Global Capability Centres

India stands as a pivotal destination for Global Capability Centres (“GCCs”), playing a significant role in supporting multinational corporations across a spectrum of industries such as information technology, finance, healthcare, and telecommunications. The Digital Personal Data Protection Act, 2023 (“DPDPA”) and the subsequent Draft Digital Personal Data Protection Rules, 2025 (“Draft Rules”) mark a transformative moment in India’s digital regulatory landscape, underscoring India’s vision to establish a robust digital economy while ensuring stringent privacy safeguards.

For GCCs, these regulatory developments bring unique challenges and opportunities. GCCs need to comply with the DPDPA while also navigating global laws like the General Data Protection Regulation (“GDPR”) that may apply to them. In this edition of the Prism, we examine these considerations, explore key compliance requirements, and discuss strategies for aligning with evolving regulatory landscapes.

 

Key Considerations for GCCs vis-a-vis the DPDPA

 

Handling employee data

GCCs handle extensive volumes of employee data as they serve as centralised hubs for managing critical business functions like human resource, payroll, finance, information technology, training, compliance, and workforce analytics on behalf of multinational organisations. Acting as the operational backbone for such functions, they process data to support global operations, enhance efficiency, and ensure compliance with local and international regulations.

Some of their core employment related operations include:

Under the DPDPA, processing personal data typically requires explicit consent from the data principal. However, the DPDPA recognises certain ‘legitimate uses’ that exempt organisations from obtaining consent, particularly in the context of employment.

However, if the processing of employee data goes beyond these legitimate uses – for purposes unrelated to core employment functions – explicit consent must be obtained from the employee. It thus becomes important for GCC to document what data is collected, the specific purposes for its use and the legal basis for its processing. This may be essential to demonstrate compliance with the DPDPA and to mitigate the risks associated with any unauthorised or non-compliant data processing.

 

Cross-border data transfers and data localisation

The DPDPA acknowledges the significance of cross-border data transfers, including for GCCs, while prioritising the protection of personal data. Under the DPDPA, the Central Government is empowered to restrict the transfer of personal data by data fiduciaries to specified countries or territories through notifications. Importantly, the legislation also establishes that its provisions do not override existing sectoral regulations that may impose stricter requirements on data transfers.

The Draft Rules add that the Central Government may prescribe certain requirements even for transfers to approved countries. GCCs must carefully evaluate where employee data is stored and accessed to ensure compliance with these rules.

For GCCs that may be classified as Significant Data Fiduciaries (“SDFs”) due to the volume or sensitivity of the data they process, the Draft Rules introduces additional obligations. The Draft Rules prescribe that the Central Government may mandate localisation of certain data, along with related traffic data in India. This makes it crucial for GCCs to be more careful if they are classified as SDFs

There are certain exemptions under the DPDPA that may potentially allow GCCs to be exempt from restrictions on cross-border data transfers. For instance, processing personal data may be exempt if it is necessary for enforcing legal rights or claims, or if it involves the processing of personal data related to a contract entered into with a person outside India. These exemptions could be particularly useful for GCCs, where data is frequently transferred across borders for operational purposes. However, GCCs must carefully evaluate each case to ensure they meet the specific conditions of these exemptions and mitigate any potential compliance risks.

 

Intra-group transfers

GCCs often perform intra-group transfers to centralise and streamline operations, ensuring efficient use of resources and expertise. Such intra-group transfers of data by GCCs must be conducted in compliance with the provisions laid out for data processing under the DPDPA.

When it comes to group transfers of data, key issues that may arise include maintaining clarity on the legal basis for processing, considering purposes for which personal data may be shared within the group and ensuring that data is transferred outside India in compliance with the DPDPA.

If GCCs already have group policies that align with global laws like the GDPR, these may need to be adapted to meet the DPDPA’s requirements, especially where the DPDPA affords more protection or adds restrictions for personal data. To ensure compliance, GCCs may need to review and enhance their internal group transfer policies.

 

Intersection of global laws and the DPDPA

The intersection of global privacy laws and the DPDPA presents a complex challenge for GCCs, which act as hubs for multinational organisations. As these centres of operations often handle data across various jurisdictions, GCCs are not only required to comply with the data protection regulations of the country they operate in, but also with international laws like the GDPR, United States’ Health Insurance Portability and Accountability Act of 1996, California Consumer Privacy Act etc. For example, when processing data of employees in the EU, the GDPR will apply in addition to the DPDPA. Navigating this intersection may require a strategic approach to harmonise policies across diverse legal frameworks while maintaining consistency and compliance. GCCs must carefully consider how global regulations intersect with the DPDPA, particularly in areas such as consent frameworks, data subject rights, data localisation requirements, accountability and cross-border data transfer mechanisms.

Creating globally aligned data policies that incorporate the DPDPA’s incremental obligations requires a dual approach:

GCCs may need to develop scalable data governance frameworks that include robust mechanisms for tracking legislative changes in India and abroad. Furthermore, these policies may need to incorporate dynamic compliance monitoring tools and employee training programs tailored to the DPDPA’s evolving regulatory landscape.

 

Third-party/vendor management

GCCs often provide shared services across their global operations, which may involve transferring data received from different countries to downstream vendors, both within India and abroad. As a result, it becomes crucial for GCCs to conduct thorough due diligence on their vendors, ensuring they not only comply with the DPDPA but also adhere to the requirements of relevant global privacy laws. This may include a unified due diligence approach, signing contracts with global protections, an integrated breach management policy and an audit strategy that’s globally aligned.

By ensuring that vendor relationships meet both DPDPA and global standards, GCCs can mitigate potential regulatory risks and maintain the integrity of their operations across borders.

 

The pathway forward for GCCs

GCCs operate in a complex environment shaped by diverse regulatory requirements and evolving data protection laws. From managing employee data and ensuring lawful cross-border transfers to maintaining oversight over third-party vendors, the challenges are multifaceted and demand careful attention. The DPDPA, Draft Rules, and global laws like GDPR add layers of accountability, requiring GCCs to align their practices with stringent global compliance standards. Navigating these intricate requirements is not just a regulatory necessity but a critical aspect of sustaining seamless operations. As GCCs continue to expand their roles, addressing these considerations will remain pivotal.

 

This Prism has been prepared by:

Akshaya Suresh Partner

Drishya A. Kamath Associate

 

For more details, please contact [email protected].

 

Please click here to download the Prism as a PDF.

 

Navigating privacy requirements for healthcare and pharmaceutical sectors

The healthcare and pharmaceutical sectors in India are at a critical juncture concerning data protection and privacy. Despite the growing reliance on digital health records and technology, the regulatory framework remains fragmented to address the complexities of modern healthcare data ecosystems. The Digital Personal Data Protection Act, 2023 (“DPDPA”) introduces a new paradigm for data protection, but its integration with the healthcare and pharmaceutical sector’s unique requirements presents challenges and opportunities. This edition of the Prism series evaluates the DPDPA’s impact on healthcare and pharmaceutical sectors, its interplay with existing sectoral guidelines, and the path forward for comprehensive health data governance in India.

 

The current regulatory landscape governing health data in India

India currently lacks a comprehensive law addressing healthcare or patient data, unlike the United States’ Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). Enacted to safeguard patient privacy, regulate the use and disclosure of protected health information, and promote efficiency and interoperability in healthcare, HIPAA serves as a robust framework for managing health information in the USA. In India, an attempt to introduce similar protections through the Digital Information Security in Healthcare Act, 2018 focused on regulating digital health data with strict security, consent, and accountability measures has failed to progress. Instead, the healthcare sector remains governed by a patchwork of sectoral regulations. Instead, there is a patchwork of regulations that apply to processing health and patient data.

 

Overview of key sectoral regulations applicable to this sector currently

1. The Health Data Management Policy (“HDM Policy”): The HDM Policy v.2, released in 2022, by the Ministry of Health and Family Welfare, sets the minimum standards for privacy and data protection within the Ayushman Bharat Digital Mission ecosystem. The HDM Policy mandates that no health data be shared with entities, including insurance and pharmaceutical companies, without the individual’s consent. It imposes purpose-based limitations on data sharing and requires health information users to refrain from further disclosing data without the data principal’s consent. Additionally, shared data must not be stored beyond the period necessary for the specified purpose, and the principle of data minimisation must be adhered to by entities receiving the data.
2. The Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 (“SPDI Rules”): The SPDI Rules, issued under Section 43A of the Information Technology Act, 2000, establish a framework for handling sensitive personal data, including health information. The SPDI Rules define Sensitive Personal Data or Information (“SPDI”) to include medical records, biometric information, and physical or mental health conditions. Organisations collecting SPDI are required to publish a privacy policy, clearly disclose their data collection and processing practices, and secure informed consent from individuals before collecting or sharing their data. The rules emphasise implementing stringent security measures, such as encryption and access controls, and require organisations to appoint a grievance officer to address complaints. Non-compliance can attract civil liability for negligence, underscoring the SPDI Rules’ role in ensuring accountability and data protection, particularly in sectors like healthcare that handle highly sensitive information. When the DPDPA comes into force, the SPDI Rules will automatically be repealed.
3. The Telemedicine Practice Guidelines of 2020: The Telemedicine Guidelines emphasise that Registered Medical Practitioners (“RMPs”) must adhere to the Indian Medical Council Act (“IMC Act”) and professional ethics regarding patient privacy and confidentiality. RMPs must also comply with relevant data protection laws, including the Information Technology Act, 2000 and take reasonable care when selecting services to prevent breaches of patient confidentiality. RMPs will not be held responsible for confidentiality breaches due to technology or third-party failures if proper care is exercised. Misconduct, including forcing teleconsultations when in-person is requested, misusing patient data, and violating privacy laws, is strictly prohibited. Penalties for violations are in line with the IMC Act and other applicable laws.
4. The New Drugs and Clinical Trial Rules, 2019 (“CTR”): CTR forms the core regulatory framework for conducting clinical trials in India. These rules govern the approval process, ethical considerations, and conduct of clinical trials. Key provisions include the need for ethics committee approval before initiating a trial and the submission of trial protocols to the Central Drugs Standard Control Organisation (“CDSCO”) for review. CTR also mandate compliance with international standards to ensure the integrity of data and the safety of trial participants. A critical requirement under the CTR is the obligation to obtain informed consent from participants, ensuring they are fully informed about the risks, benefits, and purpose of the trial before their participation.
5. CDSCO – Good Clinical Practices Guidelines (“CDSCO – GCP Guidelines”): The CDSCO – GCP Guidelines outline the ethical and scientific quality standards for clinical trials. These CDSCO – GCP Guidelines are in line with international best practices and focus on protecting the rights and safety of participants while ensuring the reliability of trial data. The CDSCO – GCP guidelines emphasise the need for strict adherence to safety protocols, confidentiality, and transparency in reporting trial results. They also reinforce the requirement for informed consent to ensure participants understand the potential risks and benefits associated with their involvement in clinical trials.
6. Indian Council of Medical Research Guidelines for Biomedical and Health Research Involving Human Participants, 2017(“ICMR Guidelines”): ICMR Guidelines provides additional ethical guidance for biomedical research in India. The ICMR Guidelines focus on the protection of human participants and emphasise the need for informed consent before any research is conducted. They ensure that participants are not coerced or misled and that their rights are upheld throughout the research process. The ICMR Guidelines also establish standards for research ethics committees, data management, and the dissemination of results, all while ensuring compliance with national and international ethical standards in health research.

With the DPDPA now in place, healthcare and pharmaceutical entities must navigate these fragmented regulations and the broader obligations under the DPDPA.

 

Transformative implications of the DPDPA on the healthcare and pharmaceutical sectors

The DPDPA introduces comprehensive provisions to strengthen data protection across sectors, including healthcare. The DPDPA mandates a higher degree of accountability for Significant Data Fiduciaries (“SDFs”) which may include entities processing large volumes of sensitive data such as health data. Health data, while not explicitly classified as sensitive personal data under the DPDPA, may be treated with the same level of protection due to the context provided by the SPDI Rules. This ensures stricter regulations on its processing, storage, and sharing.

The following points outline the key provisions of the DPDPA that influence the regulation of health and patient data in India.

1. Consent

A central feature of the DPDPA is its requirement of specific, informed, affirmative consent, which places the patient at the core of its protections. The DPDPA requires explicit, informed consent from individuals for the collection and processing of their health data. This empowers patients to make well-informed decisions about how their data is used and shared. The DPDPA also provides individuals with the right to withdraw their consent at any time, further reinforcing their control over personal information. For healthcare entities, this means establishing patient-centric mechanisms for obtaining and managing consent, which ensure that data collection aligns with lawful, specific purposes.

2. Processing for legitimate uses

The DPDPA provides for the processing of personal data without explicit consent in certain situations.

In the context of healthcare, the DPDPA permits data processing during medical emergencies involving threats to life or health. It also allows processing to provide medical treatment or health services during public health crises, such as epidemics or disease outbreaks.  These provisions enable delivering lifesaving care without the requirement of going through a consent mechanism.

3. Security obligations for data fiduciaries

The DPDPA requires data fiduciaries to implement measures to protect personal data from breach. The draft DPDP Rules 2025 (“Draft Rules”) enumerate some security measures including encryption, obfuscation, or virtual tokens to secure personal data, access control mechanisms maintaining logs and monitoring access patterns and reviewing them to detect unauthorised access. In the event of a breach or compromise, data fiduciaries must have measures in place to continue processing data, such as data backups, and ensure that the breach does not hinder the ongoing availability or integrity of the data.

The DPDPA and Draft Rules also make it the data fiduciary’s responsibility to ensure that data processors also implement appropriate technical and organisational measures for data protection and comply with the same high standards of data protection.

4. Enhanced obligations for SDFs

A key feature of the DPDPA is the introduction of a class of SDFs, which is likely to include entities handling such sensitive data like health or patient data. These SDFs have enhanced obligations under the DPDPA and must implement stringent safeguards to protect patient privacy.

SDFs are required to conduct annual data protection impact assessments to identify and mitigate risks associated with their processing operations, particularly in scenarios involving high-risk data usage. Annual audits are also mandatory, with significant findings required to be reported to the Data Protection Board of India (“Board”), thereby enhancing regulatory oversight. To promote fairness, SDFs are obligated to ensure algorithmic transparency, which includes measures to detect and prevent biases in automated decision-making processes. Data localisation measures may also apply, requiring critical or SPDI to be stored within India to strengthen data security and uphold sovereignty. Furthermore, SDFs must establish efficient grievance redressal mechanisms to address data principals’ complaints in a timely manner and appoint a Data Protection Officer in India to oversee compliance and act as a liaison with the Board. These obligations reflect the DPDPA’s focus on safeguarding personal data, promoting transparency, and ensuring accountability.

5. Processing data of children and persons with disability

As a rule, the DPDPA requires data fiduciaries to obtain verifiable consent from a child’s parent or lawful guardian before processing the child’s personal data. This consent must be acquired with due diligence to verify the identity of the parent or guardian, using reliable identity and age details or government issued ID. For the healthcare and pharma sectors, this means that any collection or processing of children’s personal health data will require parental consent protocols that can be verified. Additionally, the DPDPA also prevents tracking and behavioural monitoring of children.

In view of any imminent threats to the health of a child, the Draft Rules do provide for exceptions to the rule of consent and bar on tracking and behavioural monitoring. A data fiduciary who is a clinical establishment, mental health establishment, healthcare professional or an allied healthcare professional like a trained individual supporting diagnosis, treatment, and healthcare plans, does not need parental consent and may undertake behavioural monitoring of children or targeted advertising directed at children to the extent necessary for the protection of her health. What will be considered ‘necessary’ and ‘for the protection of health’ will need to be justified by the data fiduciaries. It will thus become important to have internal protocols identifying situations where the rule on consent and behavioural monitoring/tracking can be ignored by the healthcare establishment or health professionals.

 

Addressing operational challenges in privacy in healthcare

The healthcare sector may face some unique challenges in aligning with the DPDPA’s compliance requirements.

1. Overcollection of data and data minimisation

One of the key concerns in the healthcare sector is the over-collection of data, particularly during patient onboarding or diagnostic processes. Historically, healthcare providers may have collected large volumes of data to ensure comprehensive coverage of potential medical needs. However, under the DPDPA, healthcare providers must reassess their data collection practices to ensure that only the data necessary for the intended medical purpose is collected and processed.  Healthcare providers and allied providers will need to establish clear criteria for data collection, map it to certain diagnostic or treatment plans, limit unnecessary data requests, and ensure that any additional data collected is strictly essential for patient care. This shift will require continuous training, updates to internal processes, and close monitoring to ensure that data minimisation is adhered to at every stage of patient interaction.

2. Data localisation and cross-border transfers

Additionally, healthcare providers may have to navigate the operational complexities of cross-border data transfers. Many providers depend on global systems for storing, analysing, and sharing patient data, leveraging international expertise to enhance healthcare delivery. For SDFs, the Central Government can restrict the transfer of personal data to countries or territories outside India and in some cases even mandate data localisation. It will thus become important for all providers in the healthcare ecosystem to understand where data is flowing and have mechanisms to flow down transfer restrictions, if needed.  Localisation mandates also necessitate substantial investment in local infrastructure, reassessment of global partnerships, and the establishment of India-based storage and processing systems. By aligning operations with these localisation requirements, healthcare providers can balance regulatory compliance with operational efficiency in a rapidly evolving data governance landscape.

3. Vendor Management

In addition to the challenges of data protection compliance and cross-border data transfers, vendor management is another crucial operational consideration for healthcare providers. Healthcare organisations often collaborate with partners and third-party vendors for a variety of services, such as data storage, software solutions, insurance and analytics. These third parties may have access to sensitive patient data, raising the need for stringent data protection measures in contracts with them.

The DPDPA requires that when a healthcare provider, as a data fiduciary, engages a data processor, they remain responsible for the processor’s acts and omissions. Vendors are only allowed to process personal data under the instructions of the data fiduciary in an appropriate contract. The data fiduciary also has the responsibility to ensure that their processors are keeping data safe and following the instructions of the fiduciary for erasure. The Draft Rules also emphasise the need for proper contracts and compliance checks to ensure third-party vendors meet the required data security standards. This makes it crucial for healthcare providers to implement robust vendor management practices from due diligence to efficient contracts to audits.

 

Challenges and opportunities in privacy in the pharmaceutical sector

DPDPA presents some challenges for the pharmaceutical sector too, particularly in handling sensitive patient data and data relating to clinical trials. Pharmaceutical companies process large volumes of patient data, including health records and clinical trial data. With the DPDPA, companies must adapt their existing processes and technologies to ensure compliance, especially in patient consent management.

1. Legitimate grounds for processing

Under the DPDPA, several legitimate grounds for processing personal data without consent are explicitly applicable to delivering healthcare, such as responding to medical emergencies, providing treatment during epidemics or disease outbreaks, and ensuring safety during disasters. These provisions allow healthcare providers to process data directly related to patient care and public health without explicit consent. However, the pharmaceutical sector operates differently, often focusing on clinical trials, drug development, and long-term data collection rather than immediate healthcare delivery. These activities typically do not fall under the same exemptions. For instance, while a pharmaceutical company may process data during a government-mandated vaccination program under the public health exception, ongoing clinical trials or pharmacovigilance activities may still require explicit consent from individuals. The distinction lies in the scope of application i.e., healthcare providers directly deliver care, whereas pharmaceutical companies are often a step removed. This creates a complex compliance landscape for pharma companies, requiring them to carefully evaluate which legal grounds apply to their operations and implement robust consent management systems to address activities that fall outside the scope of healthcare exemptions. Failure to do so risks non-compliance with the DPDPA’s stringent requirements.

2. Research as an exception to provisions of DPDPA

Under the DPDPA, personal data being processed for research, archiving, or statistical purposes, is exempted from the provisions of the DPDPA, provided the processing is carried out in accordance with some standards that the Draft Rules prescribe.

In the pharmaceutical sector, this exemption is crucial for activities such as clinical trials and medical research, where data usage often extends beyond the scope of initial collection. Pharmaceutical companies can process sensitive health data for research purposes, but they must ensure compliance with the standards the Draft Rules lay down, including ensuring data accuracy, notifying data principals of their rights, safeguarding the data through robust security measures, implementing grievance redressal and ensuring that the processing remains proportionate and necessary for the research objectives.

3. Vendor management

Vendor management is a key operational concern for pharmaceutical companies too. Pharma organisations regularly collaborate with external vendors, distributor or partners for marketing or manufacturing services.

The DPDPA requires that when a healthcare provider, as a data fiduciary, engages a data processor, they remain responsible for the processor’s acts and omissions. Vendors are only allowed to process personal data under the instructions of the data fiduciary in an appropriate contract. The data fiduciary also has the responsibility to ensure that their processors are keeping data safe and following the instructions of the fiduciary for erasure. The Draft Rules also emphasise the need for proper contracts and compliance checks to ensure third-party vendors meet the required data security standards. This makes it crucial for healthcare providers to implement robust vendor management practices from due diligence to efficient contracts to audits.

4. Data localisation requirements

The DPDPA specifies that the Central Government may proscribe personal data transfer to certain countries or regions. The Draft Rules go a step further and lay down that the Central Government may also prescribe certain requirements for transfer of data. Additionally, for SDFs that Central Government may also mandate that all data, including the traffic data be localised only in India.

Localisation mandates necessitate substantial investment in local infrastructure, reassessment of global partnerships, and the establishment of India-based storage and processing systems.

It thus becomes critical for pharma companies to understand and map their data flow, not only across their systems but also those of their partners and vendors.

 

Privacy issues in deploying Artificial Intelligence in the healthcare and pharmaceutical sectors

In the healthcare and pharmaceutical sectors, Artificial Intelligence (“AI”) holds great promise for enhancing patient care, improving operational efficiencies, and advancing medical research. AI is being utilised in drug discovery, diagnostics, clinical decision-making, supply chain management, and clinical trials, among other areas. By analysing large datasets, AI accelerates research, aids in the identification of potential drug candidates, and optimises clinical trial designs, ensuring safer and more effective treatments.

However, as AI’s role in processing personal health data expands, it raises significant data privacy concerns. A primary issue is the sheer volume of personal health data being processed by AI systems. This not only increases the risk of data breaches but also raises compliance challenges. The DPDPA emphasises data minimisation, a principle that requires that personal data collected be limited to what is necessary for the intended purpose. The growing use of AI in healthcare intensifies the need to ensure that only relevant data is processed and retained, in compliance with this core principle.

AI algorithms, especially those deployed for processing personal health data, must also be scrutinised to ensure they do not pose a risk to data principals’ rights. The Draft Rules require SDFs to carry out due diligence and verify that the algorithmic software used for processing personal data—whether for storage, transmission, or sharing—does not create unintended risks, such as discriminatory outcomes or breaches of privacy.

These rules necessitate that companies employ strict oversight to mitigate any harm to individuals and ensure compliance with the DPDPA’s provisions on data protection and privacy. This may require carrying out an impact assessment before AI is deployed for any use.

 

Consumer health-tech

The use of consumer health technologies, such as wearables and mobile health apps, presents different privacy challenges, particularly in terms of data overcollection and the frequent transfer of data across various platforms. These technologies often collect continuous, real-time health information, which, if not properly safeguarded, can be vulnerable to unauthorised access, misuse, or breaches. Furthermore, as the data is typically processed or shared with multiple third-party vendors and platforms, the risk of data leakage, especially in cross-border scenarios, becomes more pronounced.

Under the DPDPA, data fiduciaries hold primary responsibility for ensuring compliance with the DPDPA, even in instances where data processing is carried out by third-party processors. According to the provisions of the DPDPA, a data fiduciary must ensure that any processing undertaken by its processors on its behalf complies with the law. The fiduciary remains accountable for the actions of these processors, irrespective of any agreements made or the failure of the data principal to uphold their duties under the DPDPA. This legal responsibility necessitates thorough oversight and due diligence by data fiduciaries, requiring them to ensure that processors adhere to data protection principles such as data minimisation, purpose limitation, and safeguarding sensitive health data from unauthorised access or misuse.

 

The path forward for health and pharma data governance

The DPDPA provides a comprehensive framework for data protection and its true effectiveness will depend on its harmonious integration with existing sectoral regulations. While sectoral regulations currently address important aspects of health and patient data management, they lack the detailed requirements outlined in the DPDPA.

Organisations will need to invest time, resources, and expertise to adapt their processes and meet the stringent data protection standards set by the DPDPA. Additionally, the Draft Rules introduce further refinements to these requirements, requiring continuous assessment and adjustment by healthcare and pharmaceutical entities to ensure full compliance.

 

This Prism has been prepared by:

Akshaya Suresh Partner

Drishya A. Kamath Associate

 

For more details, please contact [email protected].

 

Please click here to download the Prism as a PDF.

 

Privacy and data protection in Artificial Intelligence

In the era of Artificial Intelligence (“AI”), the use of big data including personal data is considered to be indispensable in the training, development and deployment of AI systems. Personal data is leveraged at various stages, such as during the training of AI models, where vast datasets are processed to enable the AI model or system to identify patterns, and during the working of the AI system, where personal data may be continuously collected, analysed, and processed for the AI system to generate outputs. However, this extensive use of personal data raises significant privacy concerns, particularly regarding data protection, transparency, and accountability. In this edition of the Prism, we explore the intersection of AI and personal data, focusing on how specific provisions of the Digital Personal Data Protection Act, 2023 (“DPDPA”) may apply to using personal data to develop, train, deploy or use AI systems.

 

Applicability of the DPDPA

In cases where entities outside India profile data principals located in India only for the purpose of training AI models, and the resulting systems are subsequently not made available in India, there could be enforcement issues as the DPDPA does not apply to processing of personal data outside India that is not in connection with offering goods or services to data principals in India.

 

Training on publicly available data

The DPDPA exempts publicly available data from its scope, allowing unrestricted use for training Machine Learning/AI models, including through data scraping. Unlike Singapore’s Personal Data Protection Act (“PDPA”), which maintains some safeguards, the DPDPA imposes no obligations if the data is made public by the data principal or through legal mandates. This contrasts sharply also with the European Union’s General Data Protection Regulation (“GDPR”), which applies to all personal data, including public data. The European Data Protection Board’s ChatGPT Taskforce has warned that scraping publicly available data, especially sensitive data, risks individual rights and requires safeguards to prevent misuse. The Belgian Data Protection Authority aligns with this perspective by requiring proportionality and data minimisation when personal data is processed.

In the United Kingdom, the Information Commissioner’s Office highlights the need to adhere to GDPR principles even when processing publicly available data, stressing that such data is not exempt from privacy laws. This includes complying with lawful bases for processing, transparency, and ensuring data subjects’ rights are protected

The ability to process publicly available personal data without any legislative oversight will give rise to ‘invisible processing’ where the data principals are not aware of the purpose for which their personal data is processed.

Where the AI model is trained on anonymised data, the DPDPA is not applicable as it does not qualify as ‘personal data’.

Scraping publicly available data may not be covered under the DPDPA but could still result in other violations like breach of intellectual property rights, breach of contract, or unauthorised access under other applicable laws.

 

Legitimate uses for processing

Under the DPDPA, ‘legitimate use’ serves as a lawful basis for processing personal data without explicit consent, provided the processing aligns with certain specific, predefined purposes in the DPDPA. Legitimate use comprises processing for functions such as State operations, health emergencies, medical purposes, employment, and other uses listed under Section 7 of the DPDPA. The application of legitimate use, however, requires compliance with the principle of purpose limitation. It is common practice to repurpose personal data obtained for a primary purpose to train AI models. However, post the implementation of the DPDPA, the data fiduciaries will have to reassess the grounds for processing to either obtain specific consent to process personal data or rely on the legitimate use for training or working of AI models. Where AI is used to automate decision-making or make inferences about an individual, such processing may also generate new personal data. The data fiduciaries should ensure that they rely on a ground for the processing of this newly generated personal data as well.

 

AI in law enforcement and State functions

1. DPDPA allows the State or its instrumentalities to process personal data to provide or issue various benefits, services, or permits to data principals based, as a legitimate use. This enables the State and its instrumentalities to process citizen data to develop or deploy AI to augment administrative capacity. For example, states like Tamil Nadu, Telangana, and Andhra Pradesh are leveraging AI to improve public service delivery – such as water body management, pensioner authentication, and real-time beneficiary identification. These applications demonstrate how AI can not only streamline administrative functions but also create a more inclusive and responsive system of governance, reflecting a broader trend in AI-driven public services. The DPDPA does not create a bar on such use cases.
2. It is also, not uncommon for AI tools, particularly Automated Facial Recognition Technology (AFRT), to be integrated into law enforcement for tasks such as identifying criminals or locating missing persons. In some instances, AI is also used in predictive policing, helping authorities allocate resources effectively by predicting where crimes may occur. Similarly, AI applications are being tested for disaster management, ensuring the safety of citizens during calamities. However, such tools can facilitate constant monitoring of individuals in public spaces, posing risks to privacy rights, especially since, the processing of personal data in the interest of prevention, detection, investigation or prosecution of crimes or any contravention of any law in India is exempted from certain provisions of Chapter II of the DPDPA. Without proper policy or regulation, such surveillance can lead to an adverse effect on free expression and create an environment of pervasive monitoring.
3. Another significant concern is the potential for bias in AI systems. If AI models are trained on biased historical crime data, they may unintentionally reinforce existing prejudices. This can lead to discriminatory outcomes, such as unfairly targeting specific communities or perpetuating stereotypes. Furthermore, the lack of transparency in how AI algorithms process data can make it challenging to identify and address such biases, amplifying the risk of systemic inequities.

 

Processing of personal data belonging to children/persons with disabilities

If the training dataset contains personal data belonging to either children or persons with disabilities, or if an AI system processes such personal data, the data fiduciary must obtain verifiable consent of the parent or legal guardian (as may be applicable), in the manner as may be prescribed by the rules to the DPDPA.

• Although the DPDPA prohibits the processing of personal data to undertake behavioural monitoring of children or advertisements targeting children, such a similar prohibition is not present for processing of adults’ personal data. The DPDPA should recognise the principles of Responsible AI and allow adult data principals to either object or restrict the processing of personal data for automated decision making, profiling or targeted advertising. This right is provided under the GDPR, where the processing is undertaken by relying on the legitimate interest or if the processing is necessary for the performance of a task carried out in the public interest.
• The Central Government can notify classes of data fiduciaries who may not be required to obtain verifiable consent or who can undertake behavioural monitoring or target advertising on children.

 

Research and innovation

The DPDPA provides specific exemptions to support innovation and research while balancing privacy rights. These include:

• Startup exemptions: Startups notified by the Central Government are exempt from certain provisions to foster innovation and reduce compliance burdens during their growth phase, including in areas like AI and emerging technologies.
• Research: Personal data may be processed for research, archiving, or statistical purposes if it is not used to make decisions specific to a data principal, and such processing is carried out in accordance with the prescribed standards to be set by the rules to the DPDPA.

 

This Prism has been prepared by:

Akshaya Suresh Partner

Drishya A. Kamath Associate

 

For more details, please contact [email protected].

 

Please click here to download the Prism as a PDF.

 

Processing of employees’ personal data

In this edition of the Prism, we analyse what employers would need to keep in mind while processing the personal data of their workforce. Any information about an individual collected or used even in the course of their employment is personal data under the Digital Personal Data Protection Act, 2023 (“DPDPA”). We also discuss the legal basis for processing an employee’s personal data, an employer’s key obligations, the exemptions provided in some circumstances and the challenges that employers may face in certain kinds of processing.

 

Transition from the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 to the DPDPA

The transition to the DPDPA marks a significant shift from the previous Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (“SPDI Rules”), bringing a more rigorous data protection framework that requires employers to update their data management practices. Employers will need to revise internal data protection policies to align with the DPDPA, especially in areas such as employee rights and data breach management. As the SPDI Rules phase out, employers should also prepare for mandatory reporting of data breaches and ensure that internal response protocols are aligned with the DPDPA’s requirements.

 

Roles under the DPDPA

 

Legal basis for processing the personal data of employees under the DPDPA

The DPDPA provides certain legitimate uses under which the processing of personal data can be undertaken, without consent. One of the legitimate uses is processing personal data for the purposes of employment.

1. It remains to be seen if, in line with international laws, the scope of ‘purposes for employment’ under the DPDPA include processing of personal data both before and after employment. This interpretation would encompass activities such as background verification prior to employment, as well as retaining employment records post-tenure for compliance with applicable laws.
2. The processing of personal data for service or benefit sought by a data principal may include employee training programs, employee stock option plans, medical facilities, etc.

 

Legal basis for processing personal data of data principals who are not considered to be ‘employees’

The DPDPA does not define ‘employees’, creating uncertainty about the applicability of the law to other individuals working for an organisation, such as independent contractors, freelancers, consultants, temporary/part-time workers, interns, and apprentices. In the absence of a clear definition, some parallels can be drawn to interpretations in other data protection laws, where the concept of ‘employment’ is often understood to extend beyond traditional employment relationships. For example, some global laws treat individuals working under contractual arrangements, such as freelancers and consultants, similarly to employees when processing personal data for work-related purposes. This broad interpretation of ‘employment’ could influence the scope of data processing obligations under the DPDPA, even if no direct guidance is provided in the Indian context.

Relying on ‘consent’ to process the personal data of the above-mentioned individuals may not be meaningful since the individuals may not be able to provide ‘free’, and ‘unconditional’ consent due to the nature of the relationship between the individual and the data fiduciary.

 

Key considerations for employers under the DPDPA

Employer obligations under the DPDPA

Under the DPDPA, employers must adhere to several key obligations to ensure responsible data handling and protect employee personal data. First, they are required to assess processors who may be processing employee data for the DPDPA compliance before engagement and enter into a valid written contract to formalise these arrangements. Employers must also establish an internal mechanism that allows employees to exercise their rights under the DPDPA, including a grievance system to resolve concerns effectively. Additionally, implementing appropriate technical, organisational, and reasonable security measures is essential to prevent data breaches, along with a mechanism to promptly inform employees in case of such breaches. For employers classified as ‘Significant Data Fiduciaries,’ additional responsibilities may apply, such as appointing a data protection officer, engaging an independent data auditor, and conducting data protection impact assessments to mitigate risks.

 

Data retention post-employment

The employer must erase personal data once it is reasonable to conclude that the specified purpose has been fulfilled, unless retention is required to comply with any legal obligations.

Employers in India must adhere to statutory compliance by retaining specific records and employee data for mandated periods, either in original or electronic form, as outlined in various labour laws. For example, the Employees’ Provident Funds and Miscellaneous Provisions Act, 1952 does not specify a clear retention period but suggests retaining records for 7 (seven) to 10 (ten) years, while the Employees’ State Insurance Act, 1948 mandates 5 (five) years.

 

Processing of personal data of employees with disabilities

The DPDPA requires data fiduciaries, including employers, to adopt heightened safeguards when processing the personal data of employees who are persons with disabilities. The data fiduciary’s responsibilities are amplified in these cases, as information related to disabilities may inherently include sensitive personal data. Such data, if disclosed or misused, has the potential to lead to discrimination or other adverse effects for the employee. Employers are therefore advised to establish specific protocols that ensure compliance with the DPDPA’s mandates on data protection while also upholding principles of equality and non-discrimination.

 

Processing of employee data for background verification

The DPDPA does not definitively state whether ‘purposes of employment’ includes data collection for recruitment, such as pre-employment background checks, where an employer-employee relationship isn’t yet formalised. However, the DPDPA’s broad framework could reasonably support background verification as an essential step in employment, allowing employers to filter suitable candidates and manage future workforce needs. To ensure compliance, employers should clearly document the purpose of this data processing, provide necessary notifications to candidates, and follow the DPDPA requirements, minimising compliance risks. Employers frequently rely on third-party providers for high-risk data processing tasks, such as background checks, behaviour analytics, health insurance, and financial benefits. Under the DPDPA, employers should implement a thorough due diligence process and ensure that third parties processing employee data operate under formal data processor agreements with stringent security and privacy safeguards.

 

Managing international employee data

The DPDPA introduces specific cross-border data transfer exemptions that can reduce compliance burdens for certain fiduciaries, including employers, when handling data of non-Indian employees. These exemptions allow eligible employers more flexibility in transferring data across borders, though they must still adhere to core accountability and data security obligations under the DPDPA. Employers invoking these cross-border exemptions need to balance operational needs with ongoing compliance, as the exemptions are context-specific and require clear substantiation of eligibility. Additionally, the DPDPA grants the Central Government authority to restrict transfer of data of Indian residents to designated countries via notifications, meaning that employers must stay vigilant to ensure alignment with both the DPDPA standards and any stricter requirements imposed by other applicable laws.

Under the DPDPA, the Central Government has the authority to impose restrictions on data transfers to certain countries, which will be specified through notifications. It is crucial to note that if any other applicable law imposes stricter restrictions on an employer regarding such transfers, those restrictions will take precedence.

 

Startups under the DPDPA

The DPDPA has introduced a distinct category for startups, recognising the unique position they occupy within the economy and the challenges they may face in terms of compliance. A ‘startup’, as per the DPDPA, is a private limited company, partnership firm, or limited liability partnership that has been incorporated within India and meets specific criteria established by the Central Government’s relevant department. By categorising eligible entities as startups, the DPDPA allows certain relaxations in data processing obligations, offering a more proportionate regulatory approach. For employers in this category, these relaxations aim to mitigate compliance burdens during the early stages of business growth. Nonetheless, it remains incumbent upon startups to prioritise compliance with accountability and security safeguards, as these obligations form the core of responsible data fiduciary practices under the DPDPA.

 

Processing of employee data to safeguard employer’s interests

The processing of personal data to safeguard the employer from loss or liability is allowed under the DPDPA. The DPDPA provides a wide definition for ‘loss’, therefore instances such as processing of personal data for prevention of financial fraud or corporate espionage, or misuse of resources, prevention of reputational damage, or processing personal data for enforcement of legal claims, could be some of the examples for processing for safeguarding from loss or liability.

The processing of personal data to protect the employer’s trade secrets, intellectual property and classified information is allowed under the DPDPA. Some of the instances for maintenance of confidentiality could include implementing access control mechanisms, to enter into non-disclosure agreements with the employees, tracking of company’s information technology assets with the employees, etc.

 

This Prism has been prepared by:

Akshaya Suresh Partner

Drishya A. Kamath Associate

 

For more details, please contact [email protected].