The following document elaborates on how Endpoint Central can help enterprises achieve certain requirements of India's Digital Personal Data Protection Act.
The Constitution of India guarantees the right to privacy under Articles 14, 19, and 21, and the Supreme Court of India, in its landmark ruling K. S. Puttaswamy vs. Union of India, reaffirmed this in 2017. Since the GDPR came into force, the Indian government has been trying to enact a personal data protection law. After multiple iterations and suggestions, India finally passed the Digital Personal Data Protection Act (DPDPA) in Parliament on Aug. 9, 2023.
Before we take a deep dive into this act, here are some useful explanations for the terminologies it uses:
Data principal:
The individual to whom the data relates (e.g., you are the data principal if you provide your name, email address, and phone number for a dinner reservation)
Data fiduciary:
An entity, such as a business, that intends to collect personal information for various purposes (e.g., if a restaurant is collecting your personal details for a dinner reservation, it becomes a data fiduciary)
Data processor:
An entity that processes personal data on behalf of a data fiduciary (e.g., a third-party app helping the restaurant enable the booking of dinner reservations)
Scope:
The scope of the act extends throughout Indian territory and when physical data is digitized. The act also applies when data pertaining to Indians is processed outside of India.
Cross-border data flows:
The cross-border flow of personal data is restricted to countries notified by the Indian government. (Yet to be notified)
Processing of personal data:
Personal data can be obtained and processed after receiving explicit consent from the data principal. In some legitimate cases, explicit consent is not required.
Duties of data fiduciaries:
A business collects personal data for various purposes, thus assuming the role of data fiduciary. The act mandates that data fiduciaries:
Rights for the data principal:
The data principal has the right to obtain more information and request erasure, correction, and redress for grievances.
The Data Protection Board of India:
This board will judge cases of noncompliance with the bill's provisions. The board's verdict can be counter-appealed before the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).
The Indian government may classify a data fiduciary or a class of data fiduciaries as significant based on the:
Penalty:
Noncompliance will result in a penalty of up to 250 crores.
According to IBM's Cost of a Data Breach Report 2023, "the global average cost of a data breach in 2023 was USD 4.45 million, a 15% increase over three years." The report also mentions that around 51% of organizations plan to increase security investments, "including incident response (IR) planning and testing, employee training, and threat detection and response tools."
Personal data breaches are very sensitive because the right to privacy is a fundamental right in India. Besides costing your business financially and incuring hefty penalties, a personal data breach could ruin your company's reputation.
That is why you need Endpoint Central, the comprehensive endpoint management and security suite from ManageEngine. Bundled with multiple security features, Endpoint Central helps you keep your data safe and secure.
There is more to tell about how our solution can help you comply with India's DPDPA. That is why we encourage you to try it by downloading or signing up for our product, which is absolutely free for 30 days.
