- Identity Consulting and Process Design
- User and Role Profiling
- Identity Governance and Access Reviews
- Access Reviews Managed
Build your future with us.
Build your future with us.
On January 3, 2025, the Ministry of Electronics and Information Technology (MeitY) released the much anticipated draft Digital Personal Data Protection Rules, marking a significant milestone in India’s data protection landscape. These rules provide critical guidance for implementing the Digital Personal Data Protection Act, 2023 (DPDPA), aiming to create a structured framework for responsible data handling and individual privacy rights.
For organizations, the draft Rules offer clarity on compliance expectations while aligning with global privacy standards. Whether you’re just beginning or already on the path to compliance, these rules support a smoother transition through incremental adjustments to existing practices.
Processing of digital personal data within the territory of India
Processing of digital personal data outside the territory of India, Any activity related to the offering of goods or services to data principals within the territory of India
DATA PRINCIPAL: Individual whose data is processed.
DATA PROCESSOR: Who processes the Data.
DATA PROCESSING: Personal Data and Sensitive Personal Data.
DATA FIDUCIARY: Decides the purpose of the data processing.
Key Responsibilities of Data Fiduciary:
It will be established by the Central Government of India. Key functions of the Board include:
Collection:
Processing:
Storage:
You can find answers to some of the most frequently asked questions here, so feel free to send us a message if you do not find what you are looking for.
Personal data stored in logs or in debugging-related tasks also qualify as PII of the data principal and hence has to be protected.
Since the government has not specified any guideline, the industry best practices to protect the PII data can be taken into consideration.
Since the government has not specified any guideline, the industry best practices to protect the PII data can be taken into consideration.
The DPO can take on the additional role of consent manager as of now since there is no law that prohibits it. The consent manager works between the data fiduciary and the data principal in upholding their rights.
Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data while Data Processor means any person who processes personal data on behalf of a Data Fiduciary.
As a tech partner to a data fiduciary, you will be a data processor.
A data fiduciary or data processor cannot process any personal data without the consent of the data principal. Purpose of data collection and processing of the same has to be explicitly called out.
The data protection board will decide the scope of data audit.
Yes it is covered under the DPDPA.
A data fiduciary can also process PII data.
There is no space for non-compliance unless there is a valid reason. The law has detailed the list of exemptions to the Act.
Data fiduciaries are the ultimate protectors of the PII of the data principal. They have to implement reasonable controls to protect the PII of the data principal and also provide all their rights in spirit of the law provided.