India Privacy Framework
0 %
For ease of reference and responding, we have extracted some key aspects of the data protection framework for your views.

1. While responding keep in view:
a. The reference slide numbers, where applicable, are mentioned against the questions below.
b. Share aspects you think are unnecessary, and are likely to put disproportionate burden on organizations while not benefitting data subjects significantly and which of them are useful and can be complied to.
c. Aspects that have possibility of creating ambiguity while implementing
d. All categories of data subjects who are associated with your business, such as employees, customers, vendors, job applicants, website visitors, shareholders etc
e. Possibility of conflict with other domestic or foreign laws that may apply to your industry
f. Potential areas of conflict with monitoring for data security & digital surveillance
g. Balance between privacy and other rights in a democratic society such as freedom of expression, right to information etc.
h. Aspects in DP law that are important to make India a data safe country to make it a suitable destination for businesses, and possibility of India being considered for adequacy status by EU and other jurisdictions
i. Data privacy need not be looked at from compliance perspective alone – it could also be used as a business differentiator
j. Effort, cost and time required for complying with the law, vis a vis the benefit to data subjects
k. Business continuity

2. If there are any provisions missing in the white paper, please list them in the last question with justifications for consideration

3. Choose one or more responses that are most appropriate in your view.
a. If your response is not part of the options listed, then tick ‘others’ and briefly enumerate your response
b. Your views are being mainly sought from your organization perspective, and to a lesser extent as an Indian citizen (data subject)
c. Before providing your response, we recommend you review the white paper.
d. Link of overview slide …………………………….
e. If certain aspects do not impact you, you may choose not to respond

A summary of the key aspects and how they are connected to the industry is provided in the overview slides, but the slides are not a substitute for white paper.

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

The questions and response options do not reflect NASSCOM DSCI position on Data Protection..
The questions are on key aspects related to data protection framework. Responses will be aggregated and wherever possible will be leveraged to develop Industry response to the White paper on date protection.

Name of Company: *

Name of Employee: *

Designation and Function in the Organisation: *

Contact email: *

P2.C1: Territorial application of law – location of the entities for personal data originating from India.

Territorial application of law – location of the entities for personal data originating from India.

P2.C1: Territorial application of law – how to ensure effective compliance from entities located outside India?

P2.C2: Whose personal data should be protected by the law?

P2.C2: To which category of agency/entity the law should be applicable?

P2.C2: Effective date from when the law should be applicable

P2.C2: Effective date from when the law should be enforced

P2.C3: What should be the data elements in the scope of law termed as?

P2.C3: Scope of personal data – Definition

P2.C4: Scope of personal data – categories

The law should cover:

P2.C4: Definition of sensitive personal data

Personal data related to –

P2.C4: Should the law apply to pseudonymised data ?

P2.C5: Data processing should include –

P2.C5: Type of data processing should include –

P2.C6: Extent of applicability of the law to the different entities in the data ecosystem

P2.C6: Should the different entities be termed as “Data Controller”, “Data Processor”, “Sub-processor”, etc; based on their role in data processing

P2.C7: Do some of the data processing activities be exempted from the law?

Yes, data processing for the following purposes should be exempted -

P2.C8: What should be the legal basis for the transfer of personal data out of India for a legitimate purpose?

P2.C8: What should be the legal basis for the transfer of sensitive personal data out of India for a legitimate purpose?

P2.C9: Should Data localization be adopted in India ?

P2.C9: Data localization should be applicable to –

P2.C9: Will Data localization negatively impact the data processing industry?

Should Government Agencies have the right to access personal data being processed by the entity ?

P2.C10: In case of overlap with existing laws and future laws & regulations, which law should supersede?

P3.C1: Should the individual’s Consent be considered sufficient for processing the individual’s data, including transferring the data outside India ?

P3.C1: What is the appropriate scenario when a consent should be sought from the individual?

P3.C2: What is the individual’s age below which the child data privacy related requirements should be applicable?

P3.C2: What should be the additional data privacy requirements applicable for processing children’s personal data?

P3.C3: Is a Notice mandatory to be given to individuals for processing their personal data?

P3.C3: What should be the minimum components of a Notice?

P3.C4: What should be grounds of lawful processing?

P3.C5: Should purpose of processing be only limited to that declared in the Notice to the individual at the time personal data collection?

P3.C6: When should processing of sensitive personal data be considered lawful?

P3.C6: What should be the additional data privacy requirements for processing of sensitive personal data?

P3.C7: Should personal data be permanently deleted when it is no more required after using it for the purpose for which it was collected?

P3.C7: Should the retention period of personal data be defined in the DP law?

P3.C8: What rights should be provided to the individual to whom the personal data identifies or relates to, subject to legitimate reasons?

P3.C8: Should a fee be charged from the individual for exercising their rights on their personal data?

P3.C9: Should automated decision making be prohibited?

P3.C9: Should “Profiling” of an individual be permitted for certain lawful and legitimate purposes ?

Yes, for

P3.C10: What are the scenarios when right to be forgotten should be denied to the individual ?

P4.C2: Accountability and liability of entities and its vendors in case of harm to an individual

P4.C2: In case of an instance of harm caused to an individual, what are factors to be considered for deciding the accountability and liability on the entities involved?

P4.C2: Should codes of practice be developed and enforced for processing certain personal or sensitive personal data?

P4.C2: Who should develop the codes of practice ?

P4.C2: What should be considered as a data breach?

P4.C2: Who should be notified by the entity in case of a data breach ?

P4.C2: On what basis should Data Controllers be further categorized (e.g. Red, Orange, Green) and the extent of applicability of the DP law be varied across categories to minimize compliance burden?

P4.C2: Do Data Controllers need to register with the Data Protection Authority ?

P4.C2: When should a Data Protection Impact Assessment be done ?

How should data privacy be ensured by default ?

Should security controls be prescribed in the DP law ?

P4.C2: Should external audits be mandatory for entities handling personal or sensitive personal data ?

P4.C2: Should appointing a Data Protection Officer be mandatory for entities handling personal or sensitive personal data ?

P4.C2: Is a separate, independent Data Protection Authority (DPA) required to ensure compliance with data protection laws in India?

P4.C2/3: DPA should be part of which one of the following ?

P4.C2/3: What should be the role and responsibilities of the DPA ?

P4.C4: What kind of acts of omission by the data controller or data processor should be considered as a Civil violation ?

P4.C4: What should be the penalty for civil violation?

P4.C4: What kind of acts by the data controller or data processor should be considered as a Criminal offence ?

P4.C4: What should be the penalty for Criminal offense ?

P4.C4: What should be compensation to the affected individual in case of civil or criminal violation by the data controller or data processor ?

Civil Violation

What should be compensation to the affected individual in case of civil or criminal violation by the data controller or data processor ?

Criminal Offence

Create survey © SurveyHero.com