India Considering New Data Privacy Law

The Indian government is currently considering a landmark data privacy law dubbed the Personal Data Protection Bill of 2018. The PDPB has some similarities to the European Union’s GDPR, and would significantly impact U.S. companies’ decisions on whether to use Indian data processors and whether to utilize and maintain the personal data of Indian consumers.

Key provisions include:

• The right to know how data is being used;
• The ability to correct misleading data;
• Data portability rights; and
• The right to restrict companies from using previously shared data

The PDPB would also require the establishment of a Data Protection Authority, to whom data breaches would have to be reported. The DPA would have the ability to initiate investigation and impose significant fines of up to Rs. 15 crore (approximately $ 2,100,000) or 4% of total worldwide revenue, whichever is higher.

Depending upon the nature and volume of data processed, certain entities could be designated as “Significant Data Fiduciaries” and be subject to additional requirements, such as the appointment of a Data Protection Officer and heightened auditing.

Consistent with worldwide data privacy and security trends, “data fiduciaries” would be required to implement reasonably appropriate safeguards and to maintain personal data only for as long as a reasonably legitimate need to do so exists.

The proposed bill also requires that a copy of all covered personal data be maintained on an Indian-based server. The Indian government would possess the authority to classify information as “critical personal data,” which may only be stored within India. Indian trade groups have criticized the data localization provision.

The bill is currently under consideration by the Indian Ministry of Electronics and Information Technology. It must then pass the Indian Parliament.

Richard B. Newman is a digital media and privacy lawyer at Hinch Newman LLP focusing on advertising and digital media matters.  He is a member of the International Association of Privacy Professionals.

Advertising Material. Informational purposes only. Not legal advice. Always seek the advice of an attorney. Previous case results do not guarantee similar future result. Hinch Newman LLP | 40 Wall St., 35th Floor, New York, NY 10005 | (212) 756-8777.