印度 2023 年数字个人数据保护法

India’sDigitalPersonalDataProtectionAct2023

vs.theGDPR:AComparison

December2023

OrganisationsdoingbusinessinIndiashouldnotedifferencesbetweenGDPRandDPDPArequirements,includingpotentialprogrammesthatmayneeduplifttoensurecompliance.

TheIndianparliamentenactedIndia’sfirstcomprehensivedataprotectionlawon11August2023,namelytheDigitalPersonalDataProtectionAct2023(theDPDPA).TheDPDPAwillreplaceIndia’sexistingpatchworkofdataprotectionrules

1

andisexpectedtotriggersignificantchangesinhowcompaniessubjecttoIndiandataprotectionlawsprocesspersonaldata.However,thelawisnotyetoperational;noeffectivedatehasbeenestablishedandthereisnoofficialtimelinefortheoverallimplementation.Stakeholdersexpectthelawtocomeintoforceinaphasedmannerinthenextsixto12months,after:(i)anindependentagencyresponsibleforenforcingtheDPDPA—theDataProtectionBoardofIndia(theDataProtectionBoard)—isestablished;and(ii)theIndiangovernmenthasframedthesubordinaterules(whichareexpectedtoprovideinterpretativeguidanceonproceduralstepsandenforcementmethodology).TheDPDPAis“umbrella”legislation,asitsetsoutonlyahigh-levelframeworkforIndia’snewdataprotectionregime,withsupplementaryrulesexpectedinduecourse.Thoughthenewlawisnotyetoperational,companiessubjecttothenewlawareadvisedtobeginassessingpotentialpracticalimplicationsatanearlystage.

TheDPDPAistriggeredwhendigitalpersonaldataisprocessedwithinIndia.ThelawalsohasanextraterritorialeffectinthatitappliestodigitalpersonaldataprocessingoutsideofIndiaifsuchprocessingrelatestotheofferingofgoodsorservicestoindividuals(knownas“dataprincipals”,whichareequivalentto“datasubjects”undertheEUandUKGeneralDataProtectionRegulations(theGDPR))withinIndia.TheDPDPAfollowsbroadlysimilarprinciplestothosesetoutintheGDPRandspecifiesrulesfordatafiduciaries(equivalentto“controllers”undertheGDPR)anddataprocessors,andrightsfordataprincipals(equivalentto“datasubjects”undertheGDPR).Penaltiesfornon-complianceundertheDPDPArangefromINR500million(€5.7million)toINR2.5billion(€28million).TheDataProtectionBoardisalsoempoweredtoimposeurgentremedialormitigationmeasuresintheeventofapersonaldatabreach.

PracticalImpactonExistingPrivacyComplianceProgrammes

TheDPDPAsignalsamajorchangeinthewaypersonaldataisprocessedinIndia.OrganisationsoperatinginortargetingindividualsinIndiashouldconsiderpreemptivestepstobringtheirprivacycomplianceinlinewiththeDPDPA,includingasregardsdatacollectionandconsentmappingpractices.KeydifferencesbetweentheDPDPAandtheGDPRinclude:

Scope:TheDPDPAregulatestheprocessingofdigitalpersonaldata,i.e.,personaldatacollectedindigitalform,orcollectedinnon-digitalformandsubsequentlydigitised.WhilsttheDPDPA’spersonaldatadefinitionissimilartothatprovidedundertheGDPR,itexcludesfromitsscopepersonaldatamadepubliclyavailablebythedataprincipalorbyanyotherpersonunderalegalobligationtomakethatdatapubliclyavailable.

Legalbasisforprocessingofpersonaldata:TheDPDPAprovidesthatdatafiduciariesmaylawfullyprocesspersonaldataonlywiththeconsentofthedataprincipalsorforcertainspecified“legitimateuses”.Suchlegitimateusesinclude:processingofpersonaldatavoluntarilysharedbythedataprincipalforaspecifiedpurpose(providedthatthedataprincipaldoesnotobject);processingtocomplywiththelaworcourtorders;foremploymentpurposes;ortorespondtomedicalemergencies,epidemics,ordisasters.TheDPDPA’sconsentstandardissimilartothatoftheGDPR,requiringconsenttobe“free,

specific,informed,unconditionalandunambiguouswithaclearaffirmativeaction”and,unliketheGDPR,itdoesnotpermitprocessingunderthelawfulbasesofcontractualnecessityorlegitimateinterests.

Dataprincipalrights:WhilstdataprincipalswillhavecertainrightssimilartothoseundertheGDPRfordatasubjects(i.e.,rightsofaccess,correction,orerasure),theywillalsobenefitfromanumberofnewrightswhichareuniquetotheDPDPA,i.e.,therighttoareadilyavailableandeffectivemeansof

PAGE

10

grievanceredressal(e.g.,viaagrievanceredressalofficer),andtherighttonominateanindividualwhowillbeabletoexercisetherightsofthedataprincipalintheeventofdeathorincapacityofthedataprincipal.

Cross-borderdatatransfers:TheDPDPApermitscross-borderdatatransferstojurisdictionsoutsideofIndiaotherthanthosejurisdictionsspecificallyidentifiedbytheIndiangovernmentonitslistofcountriestowhichdatatransfersarerestricted(tobepublished);otherwise,theDPDPAdoesnotrequiretheimplementationofatransfermechanism.

Databreachnotification:DatafiduciariesarerequiredtonotifypersonaldatabreachestothenewlycreatedDataProtectionBoardandtoimpacteddatasubjects,regardlessofthemagnitudeofthebreachorriskofharm.Further,theDPDPAdoesnotprescribespecificdeadlinesforreporting.

Significantdatafiduciaries:TheIndiangovernmentwillhavethepowertoclassifycertaindatafiduciariesassignificantdatafiduciariesbasedonfactorssuchasthesensitivityandvolumeofdataprocessed,theimpactofprocessingontherightsofdataprincipals,andtheimpactonthesovereignty,security,andintegrityofIndia.Thesesignificantdatafiduciarieswillhaveadditionalobligations,includingtheappointmentofanindependentauditorandundertakingdataprotectionimpactassessments.

ThetablebelowcomparestherequirementsoftheGDPRandtheDPDPAinfurtherdetail,highlightingpotentialgapsinGDPR-basedcomplianceprogrammesandoutliningpossiblestepstoupliftsuchprogrammesforDPDPAcompliancepurposes.AsadditionalrulestosupplementtheDPDPAprovisionsareissued,organisationsmayneedtoadjusttheircomplianceapproachesaccordingly.

Thetableiscolour-codedasbelow,foreaseofreference:

Minimaldifference:TherequirementundertheDPDPAismateriallyconsistentwiththerequirementundertheGDPR—nofurtheractionrequiredtocomplywiththeDPDPA.

No-actiongaps:DPDPAisgenerallyconsistentwithGDPR,butwithnoticeabledifferences/GDPRstandardishigherormorecomprehensive—additionalcomplianceactionswillnotberequiredtocomplywiththeDPDPA.

Manageablegaps:DPDPAisgenerallyconsistentwithGDPR,butwithnoticeabledifferences—minoradditionalcomplianceactionswillneedtobetakentocomplywiththeDPDPA.

Materialgaps:DPDPAismateriallydifferentfromGDPR/thereareelementsunderonelawthatarenotfoundundertheother—significantadditionalcomplianceactionswillneedtobetakentocomplywiththeDPDPA.

#

Issue

DoestheGDPRcoverthisissue?

Scope

DoestheDPDPAcoverthisissue?

Scope

Keygaps

2

Potentialstep(s)forDPDPAcompliance

ScopeofApplication

1.

PersonalData

Anyinformationrelatingtoanidentifiedoridentifiablenaturalperson.

Anydataaboutanindividual,whoisidentifiableby,orinrelationto,suchdata.

TheDPDPAappliesonlyto“digitalpersonaldata”,whichmeanspersonaldatacollectedindigitalformandpersonaldatacollectedorstoredinanon-digitalformthatissubsequentlydigitised.

PersonaldatathatismadepubliclyavailablebythedataprincipalsorpursuanttoalegalrequirementisoutofscopeoftheDPDPA.

No-actiongaps:TheDPDPAappliesonlyto“digitalpersonaldata”,whereastheGDPRappliestopersonaldataevenifthatdataisnon-digital.Inaddition,personaldatathatismadepubliclyavailableisexemptfromDPDPAobligations.

N/A.

2.

Sensitive/SpecialCategoryData

Personaldatarevealingracialorethnicorigin,politicalopinions,religiousorphilosophicalbeliefs,ortradeunionmembership,andtheprocessingofgeneticdata,biometricdataforthepurposeofuniquelyidentifyinganaturalperson,dataconcerninghealth,ordataconcerninganaturalperson’ssexlifeorsexualorientation.

TheDPDPAdoesnotdifferentiatebetweenpersonaldataandsensitivepersonaldata/specialcategoriesofdata.

No-actiongaps:NoadditionalcomplianceobligationswillneedtobeundertakentocomplywiththeDPDPA.GDPR-

compliantcontrollersarelikelytomeettherequirementsundertheDPDPA,asahigherdegreeofprotectionisofferedto“specialcategoriesofpersonaldata”undertheGDPR.

N/A.

#

Issue

DoestheGDPRcoverthisissue?

Scope

DoestheDPDPAcoverthisissue?

Scope

Keygaps

2

Potentialstep(s)forDPDPAcompliance

3.

DataSubjects

Theidentifiedoridentifiablenaturalperson,towhompersonaldatarelates.

DataPrincipal:Theindividualtowhomthepersonaldatarelates,and,ifsuchindividual:

(i)isachild,theconceptincludestheparent/lawfulguardianofsuchchild;and(ii)isapersonwithadisability,theconceptincludesthelawfulguardianactingonbehalfofsuchanindividual.

Minimaldifference

N/A.

4.

DataController

Thenaturalorlegalperson,publicauthority,agency,orotherbodythat,aloneorjointlywithothers,determinesthepurposesandmeansofprocessingpersonaldata.

DataFiduciary(i.e.,datacontroller):Anyperson/entitywho,aloneorinconjunctionwithotherpersons,determinesthepurposeandmeansofprocessinganindividual’spersonaldata.

Minimaldifference

N/A.

5.

SignificantDataFiduciary(SDF)

ThereisnoequivalentconceptundertheGDPR.

AdatafiduciaryorclassofdatafiduciariesdesignatedbytheIndiangovernmentbasedon:(a)volumeandsensitivityofpersonaldataprocessed;

(b)risktotherightsofthedataprincipal;(c)potentialimpactonthesovereigntyandintegrityofIndia;(d)risktoelectoraldemocracy;(e)securityoftheState;and(f)publicorder.

Materialgaps:TheDPDPAidentifiesaclassofdatafiduciariesasSDFsbasedontheaforesaidparameters,andappliesadditionalobligationstothoseSDFs.ThereisnoequivalentconceptundertheGDPR.

IfclassifiedasanSDFbytheIndiangovernment,additionalcomplianceobligationswillapply,suchasappointingaresidentdataprotectionofficer(DPO)whoreportstotheboardofdirectors,conductsperiodicaudits,carriesoutperiodicDPIAs,anddeploysriskmitigationmeasures.

#

Issue

DoestheGDPRcoverthisissue?

Scope

DoestheDPDPAcoverthisissue?

Scope

Keygaps

2

Potentialstep(s)forDPDPAcompliance

6.

DataProcessor

Anaturalorlegalperson,publicauthority,agency,orotherbodythatprocessespersonaldataonbehalfofthecontroller.

Apersonwhoprocessespersonaldataonbehalfofthedatafiduciary.

Minimaldifference

N/A.

7.

ConsentManager

ThereisnoequivalentconceptundertheGDPR.

ConsentmanagersareentitiesregisteredwiththeDataProtectionBoardundertheDPDPAandactonbehalfofdataprincipalstoreview,provide,manage,andwithdrawconsent.

Materialgaps:ThereisnoequivalentconceptundertheGDPR.

Organisationsmayberequiredtoeither:(i)registerasconsentmanagers(subjecttoadditionalguidanceprovidedbytherulesframedpursuanttotheDPDPA),or(ii)givedataprincipalstheoption(throughtheiruserinterface)tonominatearegisteredconsentmanagerontheirplatform,app,website,etc.

8.

Processing

Anyoperationorsetofoperationsthatisperformedonpersonaldataoronsetsofpersonaldata,whetherornotbyautomatedmeans,suchascollection,recording,organisation,structuring,storage,adaptationoralteration,retrieval,consultation,use,disclosurebytransmission,dissemination,orotherwisemakingavailable,alignmentorcombination,restriction,erasure,ordestruction.

Awhollyorpartlyautomatedoperationorsetofoperationsperformedondigitalpersonaldataandincludesoperationssuchascollection,recording,organisation,structuring,storage,adaptation,retrieval,use,alignment,combination,indexing,sharing,disclosurebytransmission,dissemination,orotherwisemakingavailable,restriction,erasure,ordestruction.

Minimaldifference

N/A.

#

Issue

DoestheGDPRcoverthisissue?

Scope

DoestheDPDPAcoverthisissue?

Scope

Keygaps

2

Potentialstep(s)forDPDPAcompliance

9.

ProcessingChildren’sData

TheGDPRcontainsprovisionstoenhancetheprotectionofchildren’spersonaldata:

iftransparencyinformationisintendedtobereadbyachild,itshouldbeinclearandplainlanguagethatiseasilycomprehensibleforthechild;and

ifaninformationsocietyserviceisofferedtoachild,consentshouldbeobtainedfromaparent/guardian,subjecttocertainagecriteria.

TheageofmajorityisnotdefinedundertheGDPR,anditvariesacrossEUMemberStates.However,certainprovisionsareapplicabletochildrenundertheageof16.

Whenprocessingachild’spersonaldata(personundertheageof18)orapersonwithadisability,verifiableconsentoftheparentorthelawfulguardianofsuchchild/personwithadisabilitymustbeobtained.

Withrespecttochildren’spersonaldata:

donotundertakeprocessingofpersonaldatathatislikelytocauseanydetrimentaleffecttothewell-beingofachild;and

donottrackorengageinbehaviouralmonitoringofchildrenorusetargetedadvertisingdirectedatchildren.

Materialgaps:TheDPDPAprescribesadditionalobligationswithrespecttoprocessingchildren’sdata.ItisalsopertinentthattherelevantageofthechildvariesundertheGDPRandnationalEUMemberStatelawandUKlawimplementations(i.e.,16yearsorless)andtheDPDPA(18years).

ToensurecompliancewiththeDPDPA’sobligationsforprocessingchildren’sdata,nodataprocessingthatisdetrimentaltochildren,orprocessingofdatathatinanymannerwouldaidtargetedadvertisingdirectedatchildrenshouldbeundertaken.Tothisend,topreventinadvertentprocessingofchildren’sdata,methodsthatinvolveverifiableparentalconsenttoprocesschildren’sdata(suchasage-gatingormulti-factorauthentication)arerecommended.

DoestheGDPR

DoestheDPDPA

Potentialstep(s)for

#

Issue

coverthisissue? Scope

coverthisissue?

Scope

Keygaps

2

DPDPAcompliance

Transparency

10.

PrivacyPolicyDisclosures

Datasubjectsmustbeinformedofthefollowingatthetimeofcollectionofpersonaldata:

nameandcontactdetailsofthedatacontrollerandlocalrepresentative(ifapplicable);

contactdetailsoftheDataProtectionOfficer;

purposesofprocessing;

lawfulbasisforprocessingandlegitimateinterestsforprocessing(ifapplicable);

categoriesofpersonaldataobtained;

recipientsofpersonaldata;

detailsoftransfersofpersonaldatatoanythirdcountriesorinternationalorganisations;

retentionperiodsforpersonaldata;

datasubjectrights;

righttowithdrawconsent(ifapplicable);

righttolodgeacomplaintwithasupervisoryauthority;

Anoticemustbeprovidedtodataprincipalsforobtainingtheirpersonaldataeitheratthetimeoforbeforeseekingsuchconsent.Thenoticemustinclude:

thepersonaldataandthepurposeforwhichitisbeingprocessed;

themannerinwhichtheymayexercisetheirrightsundertheDPDPAwithrespecttothepersonaldata;and

themannerinwhichtheymaymakeacomplainttotheDataProtectionBoardestablishedundertheDPDPA.

No-actiongaps:TheGDPRprovidesamoredetailedsetofrequirementsregardingnotice.

Generally,theDPDPAmakesiteasierforGDPR-compliantcontrollerstoprocesspersonaldatawithnoticeforconsent.

N/A.

#

Issue

DoestheGDPRcoverthisissue?

Scope

DoestheDPDPAcoverthisissue?

Scope

Keygaps

2

Potentialstep(s)forDPDPAcompliance

sourceofpersonaldata(ifpersonaldataisnotobtainedfromtheindividualitrelatesto);

detailsofwhetherindividualsareunderastatutoryorcontractualobligationtoprovidethepersonaldata(ifapplicable,andifthepersonaldataiscollectedfromtheindividualitrelatesto);and

thedetailsoftheexistenceofautomateddecision-making,includingprofiling(ifapplicable).

11.

LanguageRequirements

Informationprovidedtodatasubjectsmustbeinclearandplainlanguage(includingthenativelanguageofthedatasubject,whenrequired).

DataprincipalsmustbeprovidedwithanoptiontoaccessthecontentsofaconsentrequestinEnglishorinanyofthe

22languages

specifiedintheEighthScheduleoftheConstitutionofIndia.

Manageablegaps:BoththeGDPRandtheDPDPArequireinformationprovidedtodatasubjectstobeinalanguagetheyunderstand.

WhilstthelanguagerequirementsundertheGDPRandtheDPDPAarebroadlysimilar,giventhepotentialforalargenumberoflanguages(i.e.,22languagesspecifiedintheIndianConstitution),thepracticalimplicationsofprovidingmanylanguageoptionscouldbesignificant.

#

Issue

DoestheGDPRcoverthisissue?

Scope

DoestheDPDPAcoverthisissue?

Scope

Keygaps

2

Potentialstep(s)forDPDPAcompliance

LegalBasisofProcessing

12.

Consent

Consent

Anyfreelygiven,specific,informed,andunambiguousindicationofthedatasubject’swishesbywhichheorshe,byastatementorbyclearaffirmativeaction,signifiesagreementtotheprocessingofpersonaldatarelatingtohimorher.

Explicitconsent

Undefined,butmustbeaffirmedinaclearstatementandneedstospecificallyrefertotheelementoftheprocessingthatrequiresexplicitconsent.

Consentgivenbythedataprincipalmustbe:

duress-free;

specific;

informed;

unconditional;

unambiguous;

withaclearaffirmativeactionsignifyinganagreementtotheprocessingofpersonaldataforthespecifiedpurpose;and

presentedinclearandplainlanguagewiththeoptiontoacceptsuchrequestsasperLanguageRequirements(see#

11

).

Minimaldifference

N/A.

13.

Contract

Processingisnecessaryfortheperformanceofacontracttowhichthedatasubjectispartyorinordertotakestepsattherequestofthedatasubjectpriortoenteringintoacontract.

Processingpersonaldatafortheperformanceofacontractisnotrecognisedasa“legalbasisforprocessing”undertheDPDPA,whichreferstolegitimateuses.Theseusesincludecompliancewithlaws,ensuringthesafetyofaperson,performanceofstatutoryduties/functions,andemploymentpurposes.

CertainobligationsofthedatafiduciaryundertheDPDPAwillnotapplyifthedata

Materialgaps:ProcessingpersonaldatafortheperformanceofacontractisnotalegalbasisundertheDPDPA.Unlessanexemptionisgrantedbythesubordinaterulesthatareyettobeframed,thisexclusiondifferssignificantlyfromtheGDPR.

DeterminewhenpersonaldataisprocessedaccordingtoacontractandensurethatstepsaretakentocomplywithaDPDPAstatutorilyrecognisedlegalbasisforprocessing(i.e.,legitimateuseorconsent).

#

Issue

DoestheGDPRcoverthisissue?

Scope

DoestheDPDPAcoverthisissue?

Scope

Keygaps

2

Potentialstep(s)forDPDPAcompliance

subjectsarenotwithintheterritoryofIndiaandtheirpersonaldataisprocessedpursuanttoacontractenteredintowithanypersonoutsidetheterritoryofIndia,byanypersoninIndia.

14.

LegalObligation

Processingisnecessaryforcompliancewithalegalobligationtowhichthecontrollerissubject.

UndertheDPDPA,adatafiduciaryoranSDFispermittedtoprocesspersonaldatawithoutdataprincipals’explicitconsentif:

thedataisrequiredtocomplywithanyjudgment,decree,ororderissuedunderIndianlaw,oranycontractualorcivilclaim-relatedjudgmentororderunderanylawinforceoutsideIndia.

Minimaldifference

N/A.

15.

PublicHealthEmergency/VitalInterests

Processingisnecessarytoprotectthevitalinterestsofthedatasubjectorofanothernaturalperson.

UndertheDPDPA,adatafiduciaryoranSDFispermittedtoprocesspersonaldatawithoutdataprincipals’explicitconsentif:

thedataisrequiredforrespondingtoamedicalemergencyinvolvingathreattolifeoranimmediatethreattothehealthofthedataprincipaloranyotherindividual.

Minimaldifference

N/A.

#

Issue

DoestheGDPRcoverthisissue?

Scope

DoestheDPDPAcoverthisissue?

Scope

Keygaps

2

Potentialstep(s)forDPDPAcompliance

16.

MedicalTreatmentorHealthServicesinanEpidemic

Processingisnecessaryinordertoprotectthevitalinterestsofthedatasubjectorofanothernaturalperson;

or

Processingisnecessaryfortheperformanceofataskcarriedoutinthepublicinterestorintheexerciseofofficialauthorityvestedinthecontroller.

UndertheDPDPA,adatafiduciaryoranSDFispermittedtoprocesspersonaldatawithoutdataprincipals’explicitconsentif:

thedataisrequiredtoprovidemedicaltreatmentorhealthservicestoanindividualduringanepidemic,outbreakofdisease,orthreattopublichealth.

No-actiongaps:TheDPDPAspecificallyprovidesthatconsentisnotrequiredtoprocesspersonaldatatoprovidemedicaltreatment/healthservicestoindividualsduringanepidemic.ThereisnoexactequivalentundertheGDPR,buttheclosestlegalbasiswouldbe

foranindividual’svitalinterestsorforpublicinterestpurposes.

N/A.

17.

PublicInterest

Processingisnecessaryfortheperformanceofataskcarriedoutinthepublicinterestorintheexerciseofofficialauthorityvestedinthecontroller.

UndertheDPDPA,adatafiduciaryoranSDFispermittedtoprocesspersonaldatawithoutdataprincipals’explicitconsentif:

thedataisrequiredtoensurethesafetyofpersons,orprovideassistanceorservicestoanypersonduringanydisasteroranybreakdownofpublicorder.

Minimaldifference

N/A.

#

Issue

DoestheGDPRcoverthisissue?

Scope

DoestheDPDPAcoverthisissue?

Scope

Keygaps

2

Potentialstep(s)forDPDPAcompliance

18.

VoluntaryDisclosure

TheGDPRdoesnothaveaspecificlegalbasisforvoluntarydisclosure.

UndertheDPDPA,adatafiduciaryoranSDFispermittedtoprocesspersonaldatawithoutdataprincipals’explicitconsentif:

thedataprincipalprovidestheirpersonaldatavoluntarilytothedatafiduciaryforaspecifiedpurposeanddoesnotobjecttotheprocessingofsuchpersonaldata.

No-actiongaps:TheGDPRdoesnothavetheequivalentlegalbasisforprocessing.However,asthisisanadditionallegalbasisandthereforeGDPR-compliantcontrollersarebetterabletoprocesspersonaldatawithoutconsent,noadditionalcompliancestepsareneeded.

N/A.

19.

LegitimateInterests

Processingisnecessaryforthepurposesoflegitimateinterestspursuedbythecontrollerorbyathirdparty,exceptwhensuchinterestsareoverriddenbytheinterestsorfundamentalrightsandfreedomsofthedatasubjectthatrequiresprotectionofpersonaldata,inparticularifthedatasubjectisachild.

TheDPDPAdoesnothavealegitimateinterestlegalbasis(theonlyavailablelegalbasesare“consent”orthe

“legitimateuses”setoutin#

14,

#

18,

and#

20

).

Materialgaps:TheDPDPAdoesnotrecognisetheequivalentexemptionforlegitimateinterestsforprocessingwithoutconsent.

Determinewhenthepersonaldataprocessingisconductedunder“legitimateinterest”andensurethatstepsaretakentoprocesspersonaldataaccordingtoanavailablelegalbasisforprocessingpersonaldataundertheDPDPA.

#

Issue

DoestheGDPRcoverthisissue?

Scope

DoestheDPDPAcoverthisissue?

Scope

Keygaps

2

Potentialstep(s)forDPDPAcompliance

20.

Employment

TheGDPRdoesnothaveaspecificlegalbasisforprocessingpersonaldatainanemploymentcontext(exceptforspecialcategoriesofpersonaldata).Instead,potentiallegalbasesthatcouldberelevantforprocessingnon-specialcategorydatainanemploymentcontextincludeprocessingfortheperformanceofacontract,necessitytocomplywithalegalobligation,orlegitimateinterests.

UndertheDPDPA,adatafiduciaryoranSDFispermittedtoprocesspersonaldatawithoutdataprincipals’explicitconsentif:

thedataisneededforemployment,orrelatedtosafeguardingtheemployerfromlossorliabilitysuchasofcorporateespionage,tomaintainconfidentialityoftradesecrets;intellectualproperty,classifiedinformation,orprovisionofanyserviceorbenefitsoughtbyadataprincipalwhoisanemployee.

No-actiongaps:TheGDPRdoesnothavetheequivalent“employment”legalbasisforprocessing.

N/A.

#

Issue

DoestheGDPRcoverthisissue?

Scope

DoestheDPDPAcoverthisissue?

Scope

Keygaps

2

Potentialstep(s)forDPDPAcompliance

DataProcessingAgreements

21.

DataProcessingAgreements

Processorsmustprocesspersonaldatainaccordancewithacontractthatrequiresthattheprocessor:

processespersonaldatainaccordancewithagreedpurpose(s);

returnsordestroyspersonaldataupontermination;

obtainsconsentpriortocontractingwithsub-processors;

implementsnecessarymeasurestoensurethesecurityofpersonaldata;

submitstoauditsandinspections;

providesassistancetothecontrollertofulfilobligationsundertheGDPR;and

notifiesthedatacontrollerassoonasreasonablypossibleupondiscoveringasecuritybreach.

TheDPDPArequiresthatifadatafiduciaryistoemployadataprocessorforundertakinganyprocessingactivityonitsbehalf,thensuchengagementshouldbethroughavalidcontractualrelationshipwiththedataprocessor.

Datafiduciariesarerequiredtoensurethattheengageddataprocessors:

complywiththeDPDPAandrulesthereunder;

ceaseprocessingof,anderasepersonaldataonceconsentiswithdrawn;and

takereasonablesecuritysafeguardstopreventdatabreach.

Minimaldifference

N/A.

#

Issue

DoestheGDPRcoverthisissue?

Scope

DoestheDPDPAcoverthisissue?

Scope

Keygaps

2

Potentialstep(s)forDPDPAcompliance

InternationalDataTransfers

22.

AdequacyDecision

TransfersofpersonaldatafromtheEuropeanEconomicArea(theEEA)towhitelistedcountries

3

subjecttoanadequacydecisionbytheEuropeanCommissiondonothavetocomplywithadditionalsafeguardrequirementsundertheGDPR.

Currently,theDPDPAprovidesonlyforthegovernment’sabilitytoprovidealistofcountrieswheredatatransfersarerestricted.

Manageablegaps:SubjecttoadditionalguidanceintheformofrulesfromtheIndiancentralgovernment,theDPDPAdoesnotprovideforanadequacydecision.

Ifandwhensuchlistofcountriesarepublish