Collection and processing in India
Legal basis for processing personal data
Under the DPDP Act, a Data Fiduciary can only process personal data for a lawful purpose and, barring limited exceptions as prescribed, is required to do so either on the basis of consent of a Data Principal or for certain ‘legitimate uses.’
Consent and notice
The DPDP Act requires Data Fiduciaries to provide notice and obtain consent from Data Principals on or before processing personal data. At the time of collecting the consent, a notice is required to be given to the Data Principal, conveying the following information:
- the personal data intended for processing and the purpose for such processing;
- the manner in which Data Principals can exercise their rights under the DPDP Act;
- the manner for filing a complaint with the Board; and
- the contact details of the Data Protection Officer or any other person responsible for responding to a Data Principal’s requests to exercise their rights under the DPDP Act.
Data Fiduciaries are required to give an option to Data Principals to access the request for consent and the notice in English or any of the twenty-two (22) languages specified in the Eighth Schedule to the Constitution of India. The Government of India may prescribe the specific manner and form of the notice in subsequent legislations.
Under the DPDP Act, Data Fiduciaries may process personal data based on consent from Data Principals which is required to be:
- free, specific, informed, unconditional, and unambiguous;
- provided through clear affirmative action; and
- limited to the personal data that is necessary for the specified purpose.
The DPDP Rules require that the notice given by a Data Fiduciary to the Data Principal:
- be presented and be understandable independently of any other information that has been, is or may be made available by such Data Fiduciary;
- give, in clear and plain language, a fair account of the details necessary to enable the Data Principal to give specific and informed consent for the processing of her personal data, which shall include, at the minimum:
- an itemised description of such personal data; and
- the specified purpose of, and an itemised description of the goods or services to be provided or uses to be enabled by, such processing;
- include the particular communication link for accessing the website or app, or both, of such Data Fiduciary, and a description of other means, if any, using which such Data Principal may:
- withdraw her consent, with the ease of doing so being comparable to that with which such consent was given;
- exercise her rights under the DPDP Act; and
- make a complaint to the Board.
Where a Data Principal has given consent to processing of their personal data prior to the commencement of the DPDP Act, the Data Fiduciary is required to provide notice containing the above details “as soon as it is reasonably practicable”.
Legitimate uses
The DPDP Act permits the processing of personal data for certain legitimate uses and, in such cases, Data Fiduciaries are not required to provide prior or post-facto notice to or obtain consent from the Data Principals. The legitimate uses are as follows:
- where a Data Principal voluntarily provides their personal data to a Data Fiduciary and has not indicated to the Data Fiduciary that they do not consent to the use of their personal data;
- for the State or any of its instrumentalities to provide or issue benefits or services to Data Principals where:
- the Data Principals have previously consented to the processing of their personal data for availing any benefits or services from the State or any of its instrumentalities; or
- such personal data is available in digital form or in non-digital form and digitized subsequently from any database, register, book or other document maintained by the State or any of its instrumentalities;
- for the performance of any function by the State or any of its instrumentalities under any law currently in force in India or in the interest of sovereignty and integrity of India or security of the State;
- for compliance with any judgment or order issued under the law in force in India, or any judgement or order relating to contractual claims of a civil nature under any law in force outside India;
- responding to a medical emergency involving threat to life or immediate threat to health;
- for taking measures to ensure safety of, or provide assistance or services to, any individual during disaster, or any breakdown of public order; and
- for purposes relating to employment or those related to safeguarding the employer from loss or liability.
Retention of personal data
Data Fiduciaries are required to cease to retain personal data as soon as:
- it is reasonable to assume that the purpose for which personal data was collected is no longer being served;
- the Data Principal withdraws their consent; or
- upon a request for erasure by the Data Principal, unless retention of personal data is necessary under any other laws.
The DPDP Rules prescribe specific data erasure requirements for certain classes of Data Fiduciaries: e-commerce entities or social media intermediaries having 2,000,000 registered users in India or more and online gaming intermediaries with 50,00,000 registered users in India or more. Further, the DPDP Rules require the Data Fiduciary to retain such personal data, associated traffic data and other logs of the processing for a minimum period of one year from the date of such processing for the following purposes (i) sovereignty or State security, (ii) functions or disclosures required under Indian law, and (ii) assessments to notify Significant Data Fiduciaries (SDFs), as designated by the Central Government or relevant authority.
Processing of personal data of certain classes of individuals
The DPDP Act and the DPDP Rules impose additional obligations and responsibilities on Data Fiduciaries when they are processing the personal data of children and individuals with legal guardians. Data Fiduciaries, before processing the personal data of children or persons with disabilities, are required to obtain verifiable consent from a parent or legal guardian, as may be applicable.
The DPDP Act explicitly defines a child as an individual below the age of eighteen years.
The DPDP Rules define a person with disability as an individual who (i) has long term physical, mental, intellectual or sensory impairment which, in interaction with barriers, hinders their full and effective participation in society equally with others and who, despite being provided adequate and appropriate support, is unable to take legally binding decisions; and (ii) an individual who is suffering from any of the conditions relating to autism, cerebral palsy, mental retardation or a combination of any two or more of such conditions and includes an individual suffering from severe multiple disability and who, despite being provided adequate and appropriate support, is unable to take legally binding decisions.
Specifically for children’s data, a Data Fiduciary is required to refrain from:
- undertaking any processing that is likely to have a detrimental effect on the well-being of a child; and
- tracking, monitoring the behaviour of, or directing targeted advertisements at children.
Under the DPDP Rules, Data Fiduciaries in obtaining verifiable consent of a parent of a child or from an individual identifying themselves as the lawful guardian of a person with disability are required to observe due diligence and verify that the person is the child’s parent or person with disability’s legal guardian, and that the parent or guardian is identifiable. For a child, the Data Fiduciary must verify that the parent is an adult by using reliable identity details or a virtual token mapped to such details.
These obligations related to children’s data may be exempted by the Government under certain circumstances for prescribed purposes, class of Data Fiduciaries and for certain prescribed ages (further detailed in the section on Exemptions).
The DPDP Rules prescribe that the obligation to obtain verifiable consent of a parent or guardian, and to not undertake tracking or behavioural monitoring or targeted advertising at children, does not apply to the processing of the data of a child by (for certain prescribed purposes) clinical establishments, mental health establishments, healthcare professionals, allied healthcare professionals, educational institutions, an individual in whose case infants and children in a creche or child day care centres are entrusted and persons engaged by an educational institution, crèche or child care centre for transport of children enrolled with such institution, crèche or centre and generally, to all Data Fiduciaries where the purposes of processing is for inter alia, creating a user account for communicating by email, for ensuring information likely to cause any detrimental effect on the well being of a child is not accessible to them, for confirmation that the Data Principal is not a child, etc.
With respect to the processing of an employee’s personal data, the DPDP Act considers it as a legitimate use wherein an employer will not have to obtain express consent in order to process personal data as long as the processing is carried out for employment purposes, or to protect employers from loss or liability, or to provide a benefit to an employee.
Obligations of data fiduciaries
The DPDP Act prescribes certain obligations on Data Fiduciaries in collecting and processing personal data:
- complying with the DPDP Act in respect of any processing undertaken by a Data Fiduciary or on their behalf by a Data Processor, irrespective of any agreement to the contrary or failure of the Data Principal to carry out their duties provided under the DPDP Act;
- engaging a Data Processor to process personal data on its behalf only under a valid contract;
- implementing appropriate technical and organizational measures to ensure effective adherence with the provisions of the DPDP Act and any rules which may be notified;
- ensuring accuracy, completeness and consistency of the personal data when such personal data is processed to make a decision that affects the Data Principal or if the personal data is likely to be disclosed to another Data Fiduciary;
- protecting all personal data in its possession or under its control by taking reasonable security safeguards to prevent personal data breach;
- in the event of a personal data breach, notifying the Board and each affected Data Principal;
- publishing the business contact information of the Data Protection Officer in the case of Significant Data Fiduciary, or the contact person who is able to answer Data Principals’ questions regarding processing of their personal data;
- subject to compliance with other laws, deleting personal data by itself and ensuring such deletion by the Data Processor (if applicable), either when the Data Principal withdraws their consent or when it is reasonably assumed that the specified purpose is no longer being served, whichever is earlier; and
- establishing an effective grievance redressal mechanism to redress Data Principals’ grievances.
Obligations of significant data fiduciaries
The Government of India may classify a Data Fiduciary, or a class of Data Fiduciaries as a Significant Data Fiduciary (SDF) based on certain factors like the volume and sensitivity of personal data processed, the risk posed to the rights of a Data Principal, the potential impact on the sovereignty and integrity of India, the risk to electoral democracy, security of the State, and public order. Upon being notified as an SDF, entities are required to follow additional obligations:
- to designate a Data Protection Officer situated in India to serve as the SDF’s representative for compliance with the DPDP Act and the primary point of contact for addressing grievances. The appointed person should be an individual responsible to the board of directors or a similar governing body of the SDFs.
- to appoint an independent data auditor to assess the SDF's compliance with the DPDP Act. The Government of India through orders or notifications under the DPDP Act and the DPDP Rules may specify the technical and operational qualifying criteria for auditors.
- to undertake Data Protection Impact Assessments, periodic audits, and other measures that will be prescribed by the Government of India.
The DPDP Rules further require SDFs to (once, in a period of 12 months from the date of being notified as an SDF), undertake a Data Protection Impact Assessment and an audit to ensure it is observing the provisions of the DPDP Act. The person carrying out the Data Protection Impact Assessment and the audit is required, under the DPDP Rules, to furnish a report to the Board containing significant observations in the Data Protection Impact Assessment and the audit.
In addition, the DPDP Rules require that SDFs:
- observe due diligence in verifying that the algorithmic software deployed by it for hosting, displaying, uploading modification, publishing, transmission, storage, updating or sharing of personal data processed by it are not likely to pose a risk to the rights of Data Principals.
- undertake measures to ensure that personal data specified by the Central Government is processed in a manner such that the personal data and the traffic data pertaining to its flow is not transferred outside India.
Rights and duties of data principals
Under the DPDP Act, Data Principals have been given certain rights which include:
- Right to access information about personal data: A Data Principal has the right to request a Data Fiduciary for a summary of their personal data being processed and the processing activities being undertaken by the Data Fiduciary. A Data Principal also has the right to request the Data Fiduciary for the identities of other Data Fiduciaries and Data Processors with whom their personal data is being shared and a description of the personal data being shared. The Government of India may prescribe any other information which a Data Principal has the right to request from a Data Fiduciary in subsequent legislations.
- Right to correction of personal data: A Data Principal has the right to request for correction of personal data that may be inaccurate or misleading, completion of personal data that is incomplete and updating of their personal data.
- Right to erasure: A Data Principal has the right to request for erasure of their personal data, the processing of which was previously consented to, unless retention is necessary for compliance with any laws.
- Right to withdraw consent: A Data Principal has the right to withdraw consent from processing of their personal data at any time after they have provided their consent to a Data Fiduciary.
- Right of grievance redressal: A Data Principal has the right to grievance redressal provided by a Data Fiduciary or a Consent Manager, which is exercisable in respect to a Data Fiduciary’s obligations and a Data Principal’s rights under the DPDP Act. The time period within which a Data Fiduciary or Consent Manager is required to respond to the grievances will be prescribed in subsequent legislations.
- Right to nominate: A Data Principal has the right to nominate any other individual to exercise the rights of a Data Principal on their behalf, in the event of their death or incapacity.
The right to access information, correction and erasure will apply only in cases where the Data Principal has given consent or voluntarily provided their personal data to a Data Fiduciary for processing. These rights will not be available where personal data is being processed under the grounds of legitimate use. The manner in which these rights are to be exercised by a Data Principal will be prescribed by the Government of India.
The DPDP Rules require Data Fiduciaries and Consent Managers to publish on their websites / apps the following:
- the details of the means using which a Data Principal may make a request for the exercise of their rights;
- the particulars, if any, such as the username or other identifier of such a Data Principal, which may be required to identify her under its terms of service; and
- the period under its grievance redressal system for responding to the grievances of Data Principals.
Under the DPDP Act, certain duties have also been assigned to Data Principals, which include:
- complying with all applicable laws while exercising their rights under the DPDP Act;
- prohibition of impersonation of others while providing their personal data for a specified purpose;
- not suppressing any material information while providing their personal data for any document, unique identifier, proof of identity or proof of address issued by the State or any of its instrumentalities;
- not registering false or frivolous grievances or complaints with a Data Fiduciary or the Board; and
- furnishing information that is verifiably authentic while exercising the right to correction or erasure.
