Thread by @BiIndia

#Datacracy | Being #GDPR compliant doesn't necessarily make companies ready for India's upcoming data protection laws

businessinsider.in/tech/news/indi…

#dataprotection

By @pabsgill

@pabsgill India is ready to take a stab at formulating its first laws to govern data & it is using the European Union’s General Data Protection Regulations (#GDPR) as the template. For companies operating in India, this could end up being a stick in the mud.

#Datacracy #dataprotection

@pabsgill While #GDPR and India’s Personal Data Protection Bill (#PDP) are similar in many ways, the differences between them mean that a company which is compliant in Europe may not necessarily be compliant under the PDP.

#Datacracy #dataprotection

@pabsgill “The #PDP scope of application is broader than that of the #GDPR as an entity will fall within scope merely by processing personal data in India when compared to that of GDPR,” Neeraj Dubey, a partner of corporate law at Singh & Associates (@SA_LawFirm) told Business Insider.

@pabsgill @SA_LawFirm Unlike the #GDPR, the #PDP has divided data into three categories — personal data, sensitive personal data, and critical personal data.

#Datacracy #dataprotection

@pabsgill @SA_LawFirm Moreover, India has thrown a wider net over what constitutes sensitive personal data as compared to the #GDPR. A company may have to comply even if it merely processes personal data in India, & doesn’t collect the data locally, according to law firm Covington and Burling.

#PDP

@pabsgill @SA_LawFirm Not only is critical personal data a new category altogether, companies have to make sure that it is exclusively stored and processed in India.

#Datacracy #dataprotection

@pabsgill @SA_LawFirm In order to transfer any data that falls into that category outside of India, firms will need additional approval from the Data Protection Authority (DPA) and the Supervisory Authority.

#Datacracy #dataprotection

@pabsgill @SA_LawFirm Government intervention doesn’t stop there. The #GDPR doesn’t lay out any terms and conditions to monitor anonymised data. The #PDP, however, allows the central government to access non-personal data as long as it’s to frame policies in the interest of the ‘digital economy’.

@pabsgill @SA_LawFirm Under the #GDPR, all breaches are to be reported to supervisory authority and to the users as well. India, however, won’t require users to be informed by law. In the case of a data breach, a data company will only have to inform the end users if the DPA deems it so.

#Datacracy