Please click here to download the Prism as a PDF.

 

Navigating privacy requirements for healthcare and pharmaceutical sectors

The healthcare and pharmaceutical sectors in India are at a critical juncture concerning data protection and privacy. Despite the growing reliance on digital health records and technology, the regulatory framework remains fragmented to address the complexities of modern healthcare data ecosystems. The Digital Personal Data Protection Act, 2023 (“DPDPA”) introduces a new paradigm for data protection, but its integration with the healthcare and pharmaceutical sector’s unique requirements presents challenges and opportunities. This edition of the Prism series evaluates the DPDPA’s impact on healthcare and pharmaceutical sectors, its interplay with existing sectoral guidelines, and the path forward for comprehensive health data governance in India.

 

The current regulatory landscape governing health data in India

India currently lacks a comprehensive law addressing healthcare or patient data, unlike the United States’ Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). Enacted to safeguard patient privacy, regulate the use and disclosure of protected health information, and promote efficiency and interoperability in healthcare, HIPAA serves as a robust framework for managing health information in the USA. In India, an attempt to introduce similar protections through the Digital Information Security in Healthcare Act, 2018 focused on regulating digital health data with strict security, consent, and accountability measures has failed to progress. Instead, the healthcare sector remains governed by a patchwork of sectoral regulations. Instead, there is a patchwork of regulations that apply to processing health and patient data.

 

Overview of key sectoral regulations applicable to this sector currently

1. The Health Data Management Policy (“HDM Policy”): The HDM Policy v.2, released in 2022, by the Ministry of Health and Family Welfare, sets the minimum standards for privacy and data protection within the Ayushman Bharat Digital Mission ecosystem. The HDM Policy mandates that no health data be shared with entities, including insurance and pharmaceutical companies, without the individual’s consent. It imposes purpose-based limitations on data sharing and requires health information users to refrain from further disclosing data without the data principal’s consent. Additionally, shared data must not be stored beyond the period necessary for the specified purpose, and the principle of data minimisation must be adhered to by entities receiving the data.
2. The Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 (“SPDI Rules”): The SPDI Rules, issued under Section 43A of the Information Technology Act, 2000, establish a framework for handling sensitive personal data, including health information. The SPDI Rules define Sensitive Personal Data or Information (“SPDI”) to include medical records, biometric information, and physical or mental health conditions. Organisations collecting SPDI are required to publish a privacy policy, clearly disclose their data collection and processing practices, and secure informed consent from individuals before collecting or sharing their data. The rules emphasise implementing stringent security measures, such as encryption and access controls, and require organisations to appoint a grievance officer to address complaints. Non-compliance can attract civil liability for negligence, underscoring the SPDI Rules’ role in ensuring accountability and data protection, particularly in sectors like healthcare that handle highly sensitive information. When the DPDPA comes into force, the SPDI Rules will automatically be repealed.
3. The Telemedicine Practice Guidelines of 2020: The Telemedicine Guidelines emphasise that Registered Medical Practitioners (“RMPs”) must adhere to the Indian Medical Council Act (“IMC Act”) and professional ethics regarding patient privacy and confidentiality. RMPs must also comply with relevant data protection laws, including the Information Technology Act, 2000 and take reasonable care when selecting services to prevent breaches of patient confidentiality. RMPs will not be held responsible for confidentiality breaches due to technology or third-party failures if proper care is exercised. Misconduct, including forcing teleconsultations when in-person is requested, misusing patient data, and violating privacy laws, is strictly prohibited. Penalties for violations are in line with the IMC Act and other applicable laws.
4. The New Drugs and Clinical Trial Rules, 2019 (“CTR”): CTR forms the core regulatory framework for conducting clinical trials in India. These rules govern the approval process, ethical considerations, and conduct of clinical trials. Key provisions include the need for ethics committee approval before initiating a trial and the submission of trial protocols to the Central Drugs Standard Control Organisation (“CDSCO”) for review. CTR also mandate compliance with international standards to ensure the integrity of data and the safety of trial participants. A critical requirement under the CTR is the obligation to obtain informed consent from participants, ensuring they are fully informed about the risks, benefits, and purpose of the trial before their participation.
5. CDSCO – Good Clinical Practices Guidelines (“CDSCO – GCP Guidelines”): The CDSCO – GCP Guidelines outline the ethical and scientific quality standards for clinical trials. These CDSCO – GCP Guidelines are in line with international best practices and focus on protecting the rights and safety of participants while ensuring the reliability of trial data. The CDSCO – GCP guidelines emphasise the need for strict adherence to safety protocols, confidentiality, and transparency in reporting trial results. They also reinforce the requirement for informed consent to ensure participants understand the potential risks and benefits associated with their involvement in clinical trials.
6. Indian Council of Medical Research Guidelines for Biomedical and Health Research Involving Human Participants, 2017(“ICMR Guidelines”): ICMR Guidelines provides additional ethical guidance for biomedical research in India. The ICMR Guidelines focus on the protection of human participants and emphasise the need for informed consent before any research is conducted. They ensure that participants are not coerced or misled and that their rights are upheld throughout the research process. The ICMR Guidelines also establish standards for research ethics committees, data management, and the dissemination of results, all while ensuring compliance with national and international ethical standards in health research.

With the DPDPA now in place, healthcare and pharmaceutical entities must navigate these fragmented regulations and the broader obligations under the DPDPA.

 

Transformative implications of the DPDPA on the healthcare and pharmaceutical sectors

The DPDPA introduces comprehensive provisions to strengthen data protection across sectors, including healthcare. The DPDPA mandates a higher degree of accountability for Significant Data Fiduciaries (“SDFs”) which may include entities processing large volumes of sensitive data such as health data. Health data, while not explicitly classified as sensitive personal data under the DPDPA, may be treated with the same level of protection due to the context provided by the SPDI Rules. This ensures stricter regulations on its processing, storage, and sharing.

The following points outline the key provisions of the DPDPA that influence the regulation of health and patient data in India.

1. Consent

A central feature of the DPDPA is its requirement of specific, informed, affirmative consent, which places the patient at the core of its protections. The DPDPA requires explicit, informed consent from individuals for the collection and processing of their health data. This empowers patients to make well-informed decisions about how their data is used and shared. The DPDPA also provides individuals with the right to withdraw their consent at any time, further reinforcing their control over personal information. For healthcare entities, this means establishing patient-centric mechanisms for obtaining and managing consent, which ensure that data collection aligns with lawful, specific purposes.

2. Processing for legitimate uses

The DPDPA provides for the processing of personal data without explicit consent in certain situations.

In the context of healthcare, the DPDPA permits data processing during medical emergencies involving threats to life or health. It also allows processing to provide medical treatment or health services during public health crises, such as epidemics or disease outbreaks.  These provisions enable delivering lifesaving care without the requirement of going through a consent mechanism.

3. Security obligations for data fiduciaries

The DPDPA requires data fiduciaries to implement measures to protect personal data from breach. The draft DPDP Rules 2025 (“Draft Rules”) enumerate some security measures including encryption, obfuscation, or virtual tokens to secure personal data, access control mechanisms maintaining logs and monitoring access patterns and reviewing them to detect unauthorised access. In the event of a breach or compromise, data fiduciaries must have measures in place to continue processing data, such as data backups, and ensure that the breach does not hinder the ongoing availability or integrity of the data.

The DPDPA and Draft Rules also make it the data fiduciary’s responsibility to ensure that data processors also implement appropriate technical and organisational measures for data protection and comply with the same high standards of data protection.

4. Enhanced obligations for SDFs

A key feature of the DPDPA is the introduction of a class of SDFs, which is likely to include entities handling such sensitive data like health or patient data. These SDFs have enhanced obligations under the DPDPA and must implement stringent safeguards to protect patient privacy.

SDFs are required to conduct annual data protection impact assessments to identify and mitigate risks associated with their processing operations, particularly in scenarios involving high-risk data usage. Annual audits are also mandatory, with significant findings required to be reported to the Data Protection Board of India (“Board”), thereby enhancing regulatory oversight. To promote fairness, SDFs are obligated to ensure algorithmic transparency, which includes measures to detect and prevent biases in automated decision-making processes. Data localisation measures may also apply, requiring critical or SPDI to be stored within India to strengthen data security and uphold sovereignty. Furthermore, SDFs must establish efficient grievance redressal mechanisms to address data principals’ complaints in a timely manner and appoint a Data Protection Officer in India to oversee compliance and act as a liaison with the Board. These obligations reflect the DPDPA’s focus on safeguarding personal data, promoting transparency, and ensuring accountability.

5. Processing data of children and persons with disability

As a rule, the DPDPA requires data fiduciaries to obtain verifiable consent from a child’s parent or lawful guardian before processing the child’s personal data. This consent must be acquired with due diligence to verify the identity of the parent or guardian, using reliable identity and age details or government issued ID. For the healthcare and pharma sectors, this means that any collection or processing of children’s personal health data will require parental consent protocols that can be verified. Additionally, the DPDPA also prevents tracking and behavioural monitoring of children.

In view of any imminent threats to the health of a child, the Draft Rules do provide for exceptions to the rule of consent and bar on tracking and behavioural monitoring. A data fiduciary who is a clinical establishment, mental health establishment, healthcare professional or an allied healthcare professional like a trained individual supporting diagnosis, treatment, and healthcare plans, does not need parental consent and may undertake behavioural monitoring of children or targeted advertising directed at children to the extent necessary for the protection of her health. What will be considered ‘necessary’ and ‘for the protection of health’ will need to be justified by the data fiduciaries. It will thus become important to have internal protocols identifying situations where the rule on consent and behavioural monitoring/tracking can be ignored by the healthcare establishment or health professionals.

 

Addressing operational challenges in privacy in healthcare

The healthcare sector may face some unique challenges in aligning with the DPDPA’s compliance requirements.

1. Overcollection of data and data minimisation

One of the key concerns in the healthcare sector is the over-collection of data, particularly during patient onboarding or diagnostic processes. Historically, healthcare providers may have collected large volumes of data to ensure comprehensive coverage of potential medical needs. However, under the DPDPA, healthcare providers must reassess their data collection practices to ensure that only the data necessary for the intended medical purpose is collected and processed.  Healthcare providers and allied providers will need to establish clear criteria for data collection, map it to certain diagnostic or treatment plans, limit unnecessary data requests, and ensure that any additional data collected is strictly essential for patient care. This shift will require continuous training, updates to internal processes, and close monitoring to ensure that data minimisation is adhered to at every stage of patient interaction.

2. Data localisation and cross-border transfers

Additionally, healthcare providers may have to navigate the operational complexities of cross-border data transfers. Many providers depend on global systems for storing, analysing, and sharing patient data, leveraging international expertise to enhance healthcare delivery. For SDFs, the Central Government can restrict the transfer of personal data to countries or territories outside India and in some cases even mandate data localisation. It will thus become important for all providers in the healthcare ecosystem to understand where data is flowing and have mechanisms to flow down transfer restrictions, if needed.  Localisation mandates also necessitate substantial investment in local infrastructure, reassessment of global partnerships, and the establishment of India-based storage and processing systems. By aligning operations with these localisation requirements, healthcare providers can balance regulatory compliance with operational efficiency in a rapidly evolving data governance landscape.

3. Vendor Management

In addition to the challenges of data protection compliance and cross-border data transfers, vendor management is another crucial operational consideration for healthcare providers. Healthcare organisations often collaborate with partners and third-party vendors for a variety of services, such as data storage, software solutions, insurance and analytics. These third parties may have access to sensitive patient data, raising the need for stringent data protection measures in contracts with them.

The DPDPA requires that when a healthcare provider, as a data fiduciary, engages a data processor, they remain responsible for the processor’s acts and omissions. Vendors are only allowed to process personal data under the instructions of the data fiduciary in an appropriate contract. The data fiduciary also has the responsibility to ensure that their processors are keeping data safe and following the instructions of the fiduciary for erasure. The Draft Rules also emphasise the need for proper contracts and compliance checks to ensure third-party vendors meet the required data security standards. This makes it crucial for healthcare providers to implement robust vendor management practices from due diligence to efficient contracts to audits.

 

Challenges and opportunities in privacy in the pharmaceutical sector

DPDPA presents some challenges for the pharmaceutical sector too, particularly in handling sensitive patient data and data relating to clinical trials. Pharmaceutical companies process large volumes of patient data, including health records and clinical trial data. With the DPDPA, companies must adapt their existing processes and technologies to ensure compliance, especially in patient consent management.

1. Legitimate grounds for processing

Under the DPDPA, several legitimate grounds for processing personal data without consent are explicitly applicable to delivering healthcare, such as responding to medical emergencies, providing treatment during epidemics or disease outbreaks, and ensuring safety during disasters. These provisions allow healthcare providers to process data directly related to patient care and public health without explicit consent. However, the pharmaceutical sector operates differently, often focusing on clinical trials, drug development, and long-term data collection rather than immediate healthcare delivery. These activities typically do not fall under the same exemptions. For instance, while a pharmaceutical company may process data during a government-mandated vaccination program under the public health exception, ongoing clinical trials or pharmacovigilance activities may still require explicit consent from individuals. The distinction lies in the scope of application i.e., healthcare providers directly deliver care, whereas pharmaceutical companies are often a step removed. This creates a complex compliance landscape for pharma companies, requiring them to carefully evaluate which legal grounds apply to their operations and implement robust consent management systems to address activities that fall outside the scope of healthcare exemptions. Failure to do so risks non-compliance with the DPDPA’s stringent requirements.

2. Research as an exception to provisions of DPDPA

Under the DPDPA, personal data being processed for research, archiving, or statistical purposes, is exempted from the provisions of the DPDPA, provided the processing is carried out in accordance with some standards that the Draft Rules prescribe.

In the pharmaceutical sector, this exemption is crucial for activities such as clinical trials and medical research, where data usage often extends beyond the scope of initial collection. Pharmaceutical companies can process sensitive health data for research purposes, but they must ensure compliance with the standards the Draft Rules lay down, including ensuring data accuracy, notifying data principals of their rights, safeguarding the data through robust security measures, implementing grievance redressal and ensuring that the processing remains proportionate and necessary for the research objectives.

3. Vendor management

Vendor management is a key operational concern for pharmaceutical companies too. Pharma organisations regularly collaborate with external vendors, distributor or partners for marketing or manufacturing services.

The DPDPA requires that when a healthcare provider, as a data fiduciary, engages a data processor, they remain responsible for the processor’s acts and omissions. Vendors are only allowed to process personal data under the instructions of the data fiduciary in an appropriate contract. The data fiduciary also has the responsibility to ensure that their processors are keeping data safe and following the instructions of the fiduciary for erasure. The Draft Rules also emphasise the need for proper contracts and compliance checks to ensure third-party vendors meet the required data security standards. This makes it crucial for healthcare providers to implement robust vendor management practices from due diligence to efficient contracts to audits.

4. Data localisation requirements

The DPDPA specifies that the Central Government may proscribe personal data transfer to certain countries or regions. The Draft Rules go a step further and lay down that the Central Government may also prescribe certain requirements for transfer of data. Additionally, for SDFs that Central Government may also mandate that all data, including the traffic data be localised only in India.

Localisation mandates necessitate substantial investment in local infrastructure, reassessment of global partnerships, and the establishment of India-based storage and processing systems.

It thus becomes critical for pharma companies to understand and map their data flow, not only across their systems but also those of their partners and vendors.

 

Privacy issues in deploying Artificial Intelligence in the healthcare and pharmaceutical sectors

In the healthcare and pharmaceutical sectors, Artificial Intelligence (“AI”) holds great promise for enhancing patient care, improving operational efficiencies, and advancing medical research. AI is being utilised in drug discovery, diagnostics, clinical decision-making, supply chain management, and clinical trials, among other areas. By analysing large datasets, AI accelerates research, aids in the identification of potential drug candidates, and optimises clinical trial designs, ensuring safer and more effective treatments.

However, as AI’s role in processing personal health data expands, it raises significant data privacy concerns. A primary issue is the sheer volume of personal health data being processed by AI systems. This not only increases the risk of data breaches but also raises compliance challenges. The DPDPA emphasises data minimisation, a principle that requires that personal data collected be limited to what is necessary for the intended purpose. The growing use of AI in healthcare intensifies the need to ensure that only relevant data is processed and retained, in compliance with this core principle.

AI algorithms, especially those deployed for processing personal health data, must also be scrutinised to ensure they do not pose a risk to data principals’ rights. The Draft Rules require SDFs to carry out due diligence and verify that the algorithmic software used for processing personal data—whether for storage, transmission, or sharing—does not create unintended risks, such as discriminatory outcomes or breaches of privacy.

These rules necessitate that companies employ strict oversight to mitigate any harm to individuals and ensure compliance with the DPDPA’s provisions on data protection and privacy. This may require carrying out an impact assessment before AI is deployed for any use.

 

Consumer health-tech

The use of consumer health technologies, such as wearables and mobile health apps, presents different privacy challenges, particularly in terms of data overcollection and the frequent transfer of data across various platforms. These technologies often collect continuous, real-time health information, which, if not properly safeguarded, can be vulnerable to unauthorised access, misuse, or breaches. Furthermore, as the data is typically processed or shared with multiple third-party vendors and platforms, the risk of data leakage, especially in cross-border scenarios, becomes more pronounced.

Under the DPDPA, data fiduciaries hold primary responsibility for ensuring compliance with the DPDPA, even in instances where data processing is carried out by third-party processors. According to the provisions of the DPDPA, a data fiduciary must ensure that any processing undertaken by its processors on its behalf complies with the law. The fiduciary remains accountable for the actions of these processors, irrespective of any agreements made or the failure of the data principal to uphold their duties under the DPDPA. This legal responsibility necessitates thorough oversight and due diligence by data fiduciaries, requiring them to ensure that processors adhere to data protection principles such as data minimisation, purpose limitation, and safeguarding sensitive health data from unauthorised access or misuse.

 

The path forward for health and pharma data governance

The DPDPA provides a comprehensive framework for data protection and its true effectiveness will depend on its harmonious integration with existing sectoral regulations. While sectoral regulations currently address important aspects of health and patient data management, they lack the detailed requirements outlined in the DPDPA.

Organisations will need to invest time, resources, and expertise to adapt their processes and meet the stringent data protection standards set by the DPDPA. Additionally, the Draft Rules introduce further refinements to these requirements, requiring continuous assessment and adjustment by healthcare and pharmaceutical entities to ensure full compliance.

 

This Prism has been prepared by:

Akshaya Suresh Partner

Drishya A. Kamath Associate

 

For more details, please contact [email protected].

 

Please click here to download the Prism as a PDF.

 

Privacy and data protection in Artificial Intelligence

In the era of Artificial Intelligence (“AI”), the use of big data including personal data is considered to be indispensable in the training, development and deployment of AI systems. Personal data is leveraged at various stages, such as during the training of AI models, where vast datasets are processed to enable the AI model or system to identify patterns, and during the working of the AI system, where personal data may be continuously collected, analysed, and processed for the AI system to generate outputs. However, this extensive use of personal data raises significant privacy concerns, particularly regarding data protection, transparency, and accountability. In this edition of the Prism, we explore the intersection of AI and personal data, focusing on how specific provisions of the Digital Personal Data Protection Act, 2023 (“DPDPA”) may apply to using personal data to develop, train, deploy or use AI systems.

 

Applicability of the DPDPA

In cases where entities outside India profile data principals located in India only for the purpose of training AI models, and the resulting systems are subsequently not made available in India, there could be enforcement issues as the DPDPA does not apply to processing of personal data outside India that is not in connection with offering goods or services to data principals in India.

 

Training on publicly available data

The DPDPA exempts publicly available data from its scope, allowing unrestricted use for training Machine Learning/AI models, including through data scraping. Unlike Singapore’s Personal Data Protection Act (“PDPA”), which maintains some safeguards, the DPDPA imposes no obligations if the data is made public by the data principal or through legal mandates. This contrasts sharply also with the European Union’s General Data Protection Regulation (“GDPR”), which applies to all personal data, including public data. The European Data Protection Board’s ChatGPT Taskforce has warned that scraping publicly available data, especially sensitive data, risks individual rights and requires safeguards to prevent misuse. The Belgian Data Protection Authority aligns with this perspective by requiring proportionality and data minimisation when personal data is processed.

In the United Kingdom, the Information Commissioner’s Office highlights the need to adhere to GDPR principles even when processing publicly available data, stressing that such data is not exempt from privacy laws. This includes complying with lawful bases for processing, transparency, and ensuring data subjects’ rights are protected

The ability to process publicly available personal data without any legislative oversight will give rise to ‘invisible processing’ where the data principals are not aware of the purpose for which their personal data is processed.

Where the AI model is trained on anonymised data, the DPDPA is not applicable as it does not qualify as ‘personal data’.

Scraping publicly available data may not be covered under the DPDPA but could still result in other violations like breach of intellectual property rights, breach of contract, or unauthorised access under other applicable laws.

 

Legitimate uses for processing

Under the DPDPA, ‘legitimate use’ serves as a lawful basis for processing personal data without explicit consent, provided the processing aligns with certain specific, predefined purposes in the DPDPA. Legitimate use comprises processing for functions such as State operations, health emergencies, medical purposes, employment, and other uses listed under Section 7 of the DPDPA. The application of legitimate use, however, requires compliance with the principle of purpose limitation. It is common practice to repurpose personal data obtained for a primary purpose to train AI models. However, post the implementation of the DPDPA, the data fiduciaries will have to reassess the grounds for processing to either obtain specific consent to process personal data or rely on the legitimate use for training or working of AI models. Where AI is used to automate decision-making or make inferences about an individual, such processing may also generate new personal data. The data fiduciaries should ensure that they rely on a ground for the processing of this newly generated personal data as well.

 

AI in law enforcement and State functions

1. DPDPA allows the State or its instrumentalities to process personal data to provide or issue various benefits, services, or permits to data principals based, as a legitimate use. This enables the State and its instrumentalities to process citizen data to develop or deploy AI to augment administrative capacity. For example, states like Tamil Nadu, Telangana, and Andhra Pradesh are leveraging AI to improve public service delivery – such as water body management, pensioner authentication, and real-time beneficiary identification. These applications demonstrate how AI can not only streamline administrative functions but also create a more inclusive and responsive system of governance, reflecting a broader trend in AI-driven public services. The DPDPA does not create a bar on such use cases.
2. It is also, not uncommon for AI tools, particularly Automated Facial Recognition Technology (AFRT), to be integrated into law enforcement for tasks such as identifying criminals or locating missing persons. In some instances, AI is also used in predictive policing, helping authorities allocate resources effectively by predicting where crimes may occur. Similarly, AI applications are being tested for disaster management, ensuring the safety of citizens during calamities. However, such tools can facilitate constant monitoring of individuals in public spaces, posing risks to privacy rights, especially since, the processing of personal data in the interest of prevention, detection, investigation or prosecution of crimes or any contravention of any law in India is exempted from certain provisions of Chapter II of the DPDPA. Without proper policy or regulation, such surveillance can lead to an adverse effect on free expression and create an environment of pervasive monitoring.
3. Another significant concern is the potential for bias in AI systems. If AI models are trained on biased historical crime data, they may unintentionally reinforce existing prejudices. This can lead to discriminatory outcomes, such as unfairly targeting specific communities or perpetuating stereotypes. Furthermore, the lack of transparency in how AI algorithms process data can make it challenging to identify and address such biases, amplifying the risk of systemic inequities.

 

Processing of personal data belonging to children/persons with disabilities

If the training dataset contains personal data belonging to either children or persons with disabilities, or if an AI system processes such personal data, the data fiduciary must obtain verifiable consent of the parent or legal guardian (as may be applicable), in the manner as may be prescribed by the rules to the DPDPA.

• Although the DPDPA prohibits the processing of personal data to undertake behavioural monitoring of children or advertisements targeting children, such a similar prohibition is not present for processing of adults’ personal data. The DPDPA should recognise the principles of Responsible AI and allow adult data principals to either object or restrict the processing of personal data for automated decision making, profiling or targeted advertising. This right is provided under the GDPR, where the processing is undertaken by relying on the legitimate interest or if the processing is necessary for the performance of a task carried out in the public interest.
• The Central Government can notify classes of data fiduciaries who may not be required to obtain verifiable consent or who can undertake behavioural monitoring or target advertising on children.

 

Research and innovation

The DPDPA provides specific exemptions to support innovation and research while balancing privacy rights. These include:

• Startup exemptions: Startups notified by the Central Government are exempt from certain provisions to foster innovation and reduce compliance burdens during their growth phase, including in areas like AI and emerging technologies.
• Research: Personal data may be processed for research, archiving, or statistical purposes if it is not used to make decisions specific to a data principal, and such processing is carried out in accordance with the prescribed standards to be set by the rules to the DPDPA.

 

This Prism has been prepared by:

Akshaya Suresh Partner

Drishya A. Kamath Associate

 

For more details, please contact [email protected].

 

Please click here to download the Prism as a PDF.

 

Processing of employees’ personal data

In this edition of the Prism, we analyse what employers would need to keep in mind while processing the personal data of their workforce. Any information about an individual collected or used even in the course of their employment is personal data under the Digital Personal Data Protection Act, 2023 (“DPDPA”). We also discuss the legal basis for processing an employee’s personal data, an employer’s key obligations, the exemptions provided in some circumstances and the challenges that employers may face in certain kinds of processing.

 

Transition from the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 to the DPDPA

The transition to the DPDPA marks a significant shift from the previous Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (“SPDI Rules”), bringing a more rigorous data protection framework that requires employers to update their data management practices. Employers will need to revise internal data protection policies to align with the DPDPA, especially in areas such as employee rights and data breach management. As the SPDI Rules phase out, employers should also prepare for mandatory reporting of data breaches and ensure that internal response protocols are aligned with the DPDPA’s requirements.

 

Roles under the DPDPA

 

Legal basis for processing the personal data of employees under the DPDPA

The DPDPA provides certain legitimate uses under which the processing of personal data can be undertaken, without consent. One of the legitimate uses is processing personal data for the purposes of employment.

1. It remains to be seen if, in line with international laws, the scope of ‘purposes for employment’ under the DPDPA include processing of personal data both before and after employment. This interpretation would encompass activities such as background verification prior to employment, as well as retaining employment records post-tenure for compliance with applicable laws.
2. The processing of personal data for service or benefit sought by a data principal may include employee training programs, employee stock option plans, medical facilities, etc.

 

Legal basis for processing personal data of data principals who are not considered to be ‘employees’

The DPDPA does not define ‘employees’, creating uncertainty about the applicability of the law to other individuals working for an organisation, such as independent contractors, freelancers, consultants, temporary/part-time workers, interns, and apprentices. In the absence of a clear definition, some parallels can be drawn to interpretations in other data protection laws, where the concept of ‘employment’ is often understood to extend beyond traditional employment relationships. For example, some global laws treat individuals working under contractual arrangements, such as freelancers and consultants, similarly to employees when processing personal data for work-related purposes. This broad interpretation of ‘employment’ could influence the scope of data processing obligations under the DPDPA, even if no direct guidance is provided in the Indian context.

Relying on ‘consent’ to process the personal data of the above-mentioned individuals may not be meaningful since the individuals may not be able to provide ‘free’, and ‘unconditional’ consent due to the nature of the relationship between the individual and the data fiduciary.

 

Key considerations for employers under the DPDPA

Employer obligations under the DPDPA

Under the DPDPA, employers must adhere to several key obligations to ensure responsible data handling and protect employee personal data. First, they are required to assess processors who may be processing employee data for the DPDPA compliance before engagement and enter into a valid written contract to formalise these arrangements. Employers must also establish an internal mechanism that allows employees to exercise their rights under the DPDPA, including a grievance system to resolve concerns effectively. Additionally, implementing appropriate technical, organisational, and reasonable security measures is essential to prevent data breaches, along with a mechanism to promptly inform employees in case of such breaches. For employers classified as ‘Significant Data Fiduciaries,’ additional responsibilities may apply, such as appointing a data protection officer, engaging an independent data auditor, and conducting data protection impact assessments to mitigate risks.

 

Data retention post-employment

The employer must erase personal data once it is reasonable to conclude that the specified purpose has been fulfilled, unless retention is required to comply with any legal obligations.

Employers in India must adhere to statutory compliance by retaining specific records and employee data for mandated periods, either in original or electronic form, as outlined in various labour laws. For example, the Employees’ Provident Funds and Miscellaneous Provisions Act, 1952 does not specify a clear retention period but suggests retaining records for 7 (seven) to 10 (ten) years, while the Employees’ State Insurance Act, 1948 mandates 5 (five) years.

 

Processing of personal data of employees with disabilities

The DPDPA requires data fiduciaries, including employers, to adopt heightened safeguards when processing the personal data of employees who are persons with disabilities. The data fiduciary’s responsibilities are amplified in these cases, as information related to disabilities may inherently include sensitive personal data. Such data, if disclosed or misused, has the potential to lead to discrimination or other adverse effects for the employee. Employers are therefore advised to establish specific protocols that ensure compliance with the DPDPA’s mandates on data protection while also upholding principles of equality and non-discrimination.

 

Processing of employee data for background verification

The DPDPA does not definitively state whether ‘purposes of employment’ includes data collection for recruitment, such as pre-employment background checks, where an employer-employee relationship isn’t yet formalised. However, the DPDPA’s broad framework could reasonably support background verification as an essential step in employment, allowing employers to filter suitable candidates and manage future workforce needs. To ensure compliance, employers should clearly document the purpose of this data processing, provide necessary notifications to candidates, and follow the DPDPA requirements, minimising compliance risks. Employers frequently rely on third-party providers for high-risk data processing tasks, such as background checks, behaviour analytics, health insurance, and financial benefits. Under the DPDPA, employers should implement a thorough due diligence process and ensure that third parties processing employee data operate under formal data processor agreements with stringent security and privacy safeguards.

 

Managing international employee data

The DPDPA introduces specific cross-border data transfer exemptions that can reduce compliance burdens for certain fiduciaries, including employers, when handling data of non-Indian employees. These exemptions allow eligible employers more flexibility in transferring data across borders, though they must still adhere to core accountability and data security obligations under the DPDPA. Employers invoking these cross-border exemptions need to balance operational needs with ongoing compliance, as the exemptions are context-specific and require clear substantiation of eligibility. Additionally, the DPDPA grants the Central Government authority to restrict transfer of data of Indian residents to designated countries via notifications, meaning that employers must stay vigilant to ensure alignment with both the DPDPA standards and any stricter requirements imposed by other applicable laws.

Under the DPDPA, the Central Government has the authority to impose restrictions on data transfers to certain countries, which will be specified through notifications. It is crucial to note that if any other applicable law imposes stricter restrictions on an employer regarding such transfers, those restrictions will take precedence.

 

Startups under the DPDPA

The DPDPA has introduced a distinct category for startups, recognising the unique position they occupy within the economy and the challenges they may face in terms of compliance. A ‘startup’, as per the DPDPA, is a private limited company, partnership firm, or limited liability partnership that has been incorporated within India and meets specific criteria established by the Central Government’s relevant department. By categorising eligible entities as startups, the DPDPA allows certain relaxations in data processing obligations, offering a more proportionate regulatory approach. For employers in this category, these relaxations aim to mitigate compliance burdens during the early stages of business growth. Nonetheless, it remains incumbent upon startups to prioritise compliance with accountability and security safeguards, as these obligations form the core of responsible data fiduciary practices under the DPDPA.

 

Processing of employee data to safeguard employer’s interests

The processing of personal data to safeguard the employer from loss or liability is allowed under the DPDPA. The DPDPA provides a wide definition for ‘loss’, therefore instances such as processing of personal data for prevention of financial fraud or corporate espionage, or misuse of resources, prevention of reputational damage, or processing personal data for enforcement of legal claims, could be some of the examples for processing for safeguarding from loss or liability.

The processing of personal data to protect the employer’s trade secrets, intellectual property and classified information is allowed under the DPDPA. Some of the instances for maintenance of confidentiality could include implementing access control mechanisms, to enter into non-disclosure agreements with the employees, tracking of company’s information technology assets with the employees, etc.

 

This Prism has been prepared by:

Akshaya Suresh Partner

Drishya A. Kamath Associate

 

For more details, please contact [email protected].

 

Please click here to download the Prism as a PDF.

 

Enforcement and penalties under the Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 (“DPDPA”) establishes a multi-tier oversight mechanism and a penalty framework to enforce accountability among data fiduciaries. In the eighth edition of the Prism series, we delve into the enforcement mechanisms and penalties for non-compliance under DPDPA. DPDPA requires that the data principal must first exhaust the grievance redressal mechanism provided by the data fiduciary or consent manager and then approach the Data Protection Board of India (“Board”), if not resolved by the data fiduciary/consent manager. We analyse the powers and functions of the Board, its complaints resolution procedure and factors for imposing penalties. In the latter section of the Prism, we compare enforcement and penalty provisions across major data protection laws, such as the General Data Protection Regulation (“GDPR”), California Consumer Protection Act (“CCPA”) and Singapore’s Personal Data Protection Act (“PDPA”).

 

Data Protection Board of India

The Board under DPDPA, will be an independent corporate entity empowered to enforce the DPDPA, adjudicate on complaints related to data protection violations, impose penalties, and provide guidance on the implementation of data protection laws.

The Board members serve renewable 2 (two) year terms, and post-tenure employment with any data fiduciaries previously overseen is restricted to avoid conflicts of interest. The chairperson holds administrative authority, including assigning responsibilities, managing administrative matters, and delegating functions among members. In the chairperson’s absence, the senior-most member assumes these duties.

The members, officers, and employees of the Board are classified as public servants under the Bharatiya Nyaya Sanhita, 2023, which subjects them to specific accountability standards while discharging their regulatory duties. Its core responsibilities include:

1. Response to personal data breaches: remedial and mitigation measures: On receiving notification of a personal data breach, the Board is empowered to direct urgent remedial or mitigation measures to address the breach immediately. Following this, the Board may conduct an inquiry into the breach and, if warranted, impose penalties.
2. Handling complaints and references:
   • Data principal complaints: If a data principal submits a complaint about a personal data breach, or a failure by a data fiduciary to meet its obligations, the Board is authorised to conduct an inquiry and, where appropriate, impose penalties.
   • Consent manager complaints: The Board may also inquire into and penalise any breach by a consent manager regarding its obligations towards a data principal’s personal data.
   • Breach of registration conditions: In the event of a breach of any registration condition by a consent manager, the Board has the authority to investigate and impose penalties as it is vested with the powers of a civil court.
   • Intermediary breaches: The Board may investigate breaches of Section 37 (2) (Power of Central Government to issue directions) by an intermediary based on a reference from the Central Government and impose penalties as stipulated in DPDPA.
3. Issuance and modification of directions; directive powers: For effective enforcement, the Board may issue directions necessary for compliance. These directions are binding, and the Board must provide an opportunity for the concerned party to be heard, along with documented reasons for the directive.

Upon receiving a representation from an affected party or a referral from the Central Government, the Board holds the power to modify, suspend, withdraw, or cancel issued directions. In doing so, the Board can impose conditions it deems appropriate, specifying the terms under which the modification or cancellation is effective.

This consolidated framework establishes the Board as a pivotal entity in the enforcement of data protection compliance, enabling prompt responses to breaches, robust oversight of obligations, and clear mechanisms for modifying and enforcing compliance directives.

 

Complaints and Resolution

The procedural framework of the Board is structured to allow for systematic handling of data breaches and complaints. Below is a step-by-step breakdown:

Additional factors:

• The Board functions as a digital office, managing the receipt, hearing, and resolution of complaints entirely online, implementing techno-legal measures as necessary.
• During the inquiry, the Board abides by principles of natural justice, meticulously documenting each action taken to ensure transparency.
• To effectively discharge its responsibilities, the Board is vested with the powers of a civil court. Additionally, the Board has the authority to inspect relevant documents and records.
•  The Board avoids impeding daily business activities, refraining from seizing premises or equipment essential for operations during inquiries.
• The Board may request assistance from police or government officers to carry out its investigations, and such officers are legally obliged to comply.
• To discourage abuse of the complaint process, the Board may issue warnings or impose costs on complainants if a complaint is deemed false or frivolous.
• “Appellate Tribunal” means the Telecom Disputes Settlement and Appellate Tribunal established under Section 14 of the Telecom Regulatory Authority of India Act, 1997.

 

Alternative Mechanisms

1. Mediation: The Board may recommend mediation if it believes a complaint can be resolved amicably. Parties are encouraged to engage with mutually agreed mediators or follow relevant Indian mediation laws, promoting collaborative solutions to disputes.

Mediation is an alternative dispute resolution process where a neutral third party, known as a mediator, assists the disputing parties in reaching a mutually acceptable agreement. The mediator does not make a decision but facilitates communication, helping parties find common ground and solutions voluntarily. The Code of Civil Procedure, 1908 allow courts to refer cases for mediation when they see the potential for an amicable settlement. Since the Board is vested with powers similar to that of civil courts, the Board may also refer cases to mediation where it deems fit.

2. Voluntary Undertakings: The Board can accept voluntary undertakings from individuals to ensure compliance with the DPDPA at any stage of a proceeding. These undertakings may include commitments to take specific actions or refrain from certain behaviours. The Board can modify the terms with mutual consent. While a voluntary undertaking can halt further proceedings on the related issues, failure to comply is treated as a breach of DPDPA, allowing the Board to initiate enforcement actions after giving the individual a chance to be heard. This process fosters compliance and accountability among stakeholders.

 

Penalties under DPDPA

Under the DPDPA, if the Board determines that a significant breach of DPDPA or its rules has occurred, it may impose a monetary penalty after providing the individual with an opportunity to be heard. In assessing the appropriate penalty, the Board considers several factors to ensure that penalties are proportional and effective in deterring future violations.

These factors include:

The penalties for specific breaches are as follows:

Breach of provisions of the DPDPA or rules made thereunder	Penalty
Breach of security safeguards under Section 8(5)	Up to INR 250,00,00,000
Failure to notify the Board or affected data principal of a breach under Section 8(6)	Up to INR 200,00,00,000
Breach of obligations concerning children under Section 9	Up to INR 200,00,00,000
Breach of obligations for significant data fiduciaries under Section 10	Up to INR 150,00,00,000
Breach of duties of data principal under Section 15	Up to INR 10,000
Breach of voluntary undertakings accepted by the Board under Section 32	Penalties vary based on the breach
Any other violations of the DPDPA or its rules	Up to INR 50,00,00,000

Under Section 37 of the DPDPA, the Central Government is empowered to block public access to information held by a Data Fiduciary that has been subject to monetary penalties for violations of data protection regulations, in 2 (two) or more instances. This action is initiated upon a formal recommendation from the Board. Importantly, the data fiduciary is afforded an opportunity to respond before any blocking order is issued, ensuring a degree of procedural fairness. Compliance with such directives is mandatory for intermediaries, with terms clearly defined in alignment with the Information Technology Act, 2000, highlighting the intersection of data protection and regulatory enforcement.

All sums collected as penalties will be credited to the Consolidated Fund of India.

The Consolidated Fund of India is the main fund of the Indian Government, where all revenues received (like taxes), loans raised, and money received in repayment of loans are deposited. It’s essentially the government’s primary financial reservoir, set up under Article 266(1) of the Indian Constitution.

 

Comparison with Global Data Protection Laws

The table below compares enforcement and penalty provisions across the DPDPA, GDPR, CCPA, and PDPA, highlighting key differences in penalty scope, criteria for fines, appeal mechanisms, and revenue allocation.

CONCEPT	DPDPA	GDPR	CCPA	PDPA
Enforcement body	Data Protection Board of India	Data Protection Authorities in each European Union member State (supervisory authorities)	Direct CCPA/ (California Consumer Privacy Act) issues will be referred to the California Privacy Protection Agency as the main enforcement authority. The California Attorney General’s office is involved mainly in data breach consumer suits or significant oversight cases	Personal Data Protection Commission
Maximum penalty amount	Up to INR 250,00,00,000 for security breaches, unauthorised processing, and non-compliance (per the DPDPA’s Schedule)	Up to Euro 20,000,000 or 4% of global annual turnover, whichever is higher	Fines up to USD 7,500 per intentional violation and USD 2,500 per unintentional violation	Up to SGD1,000,000 for each breach
Appeal process	Appeals against Board’s decisions can be made to the Appellate Tribunal, with further appeal options under the Telecom Regulatory Authority of India Act, 1997 for unresolved cases	Right to judicial appeal against penalties before national courts	No specific provision mentioning the appeal process.	Appeals against penalties may be submitted to the Data Protection Appeal Committee
Alternate dispute resolution	The Board may recommend mediation for complaints that may be resolved without further litigation	Alternative dispute resolution (“ADR”) mechanisms available at the discretion of national supervisory authorities	Does not specify ADR mechanisms directly within its provisions	No specific ADR; enforcement handled by the Personal Data Protection Commission

 

This Prism has been prepared by:

Akshaya Suresh Partner

Drishya A. Kamath Associate

 

For more details, please contact [email protected].