Ensuring compliance with the DPDP Law: A Comprehensive Guide For Data Fiduciaries

Dec 30, 2024 | General

As the data protection landscape evolves, compliance with the Indian Data Protection and Digital Privacy (DPDP) Act becomes increasingly important. This is not only a legal requirement, but also builds trust between data fiduciaries (entities that collect, store and process data) and data principles (individuals/users/customers). This article outlines the key steps data controllers should take to ensure compliance and effectively protect personal data, as well as the importance of written agreements with data processors.

Outline of steps to ensure compliance

• Appoint a data protection officer and an independent data controller

The DPDP Law requires major data fiduciaries to appoint a data protection officer (DPO) and an independent data auditor and all data fiduciaries should consider adopting this practice: The DPO is the main point of contact for data protection matters and ensures compliance with legal obligations, while the auditor is responsible for data practices

• Assess Existing Data Collection, Storage, Processing and Deletion mechanisms

Every step of the process is regulated by the new Act, from collection up until deletion. It is important to first assess the current mechanisms and systems for how the data is collected, the data protection protocols, the persons who can access and process such data, and the tools for automatic deletion of the data once the purpose has been fulfilled or when the data principle no longer consents to the processing of their data. Comprehensively assess the current data lifecycle, including collection, storage, processing and deletion mechanisms. Involving legal experts can help identify compliance gaps and recommend improvements accordingly.

• Improve data protection measures

Based on the assessment, implement robust security measures such as encryption, access control and intrusion detection systems to protect data from unauthorized access.

• Publish notices on the use of data

Transparency is a core principle of the DPDP Act. Data Fiduciaries must publish clear notices detailing how personal data will be used. These notices must be available in English and in India’s 22 official languages so that all data principles can understand their rights and data use.

• Implementation of consent mechanisms

It is important to obtain informed consent from Data Principles. Develop user-friendly mechanisms that enable individuals to understand and control how their data is processed. Legal counsel can help ensure compliance with the law and best practices.

• Implement automated data deletion protocols.

Establish automatic data deletion protocols to ensure that personal data is not retained longer than necessary for fulfilling the purposes that the Data Principle was informed of, or if the Data Principle withdraws their consent.

• Create a grievance portal

Implement a dedicated platform to handle complaints and requests from Data Principles. This system will allow individuals to easily contact the DPO and submit their requests.

• Conduct regular data protection impact assessments

Regularly conduct Data Protection Impact Assessments (DPIAs) to assess the impact of data processing on the rights of Data Principles. These assessments should outline the rights of individuals, the purpose of the data processing and the risk management strategy. Legal support is essential to conduct a comprehensive DPIA that meets regulators’ expectations.

• Conduct regular audits

Continuous compliance requires regular audits of data practices. Engage legal experts to conduct such audits and provide practical insights for improvement. This practice not only strengthens compliance, but also increases the trust of Data Principles.

The Importance Of Drafting Robust Contracts With Data Processors

The relationship between data controllers and processors is crucial to ensure compliance with the DPDP Law. The drafting of a well-crafted contract is essential to protect the interests of the Data Principle and to clearly set out the obligations of the processors. The key aspects of such agreements are as follows:

• Definition Of Data Processing Activities: The contract must clearly define the data processing activities to be performed by the processor and set out the relevant services and performance standards.
• Access to records: Data controllers must have access to all records and information relating to processing activities kept by the processor to ensure transparency and accountability.
• Ongoing monitoring and evaluation: The contract must allow for ongoing monitoring and evaluation by the controller and prompt corrective measures if necessary.
• Data privacy and liability: contracts should include clauses that protect the confidentiality of customer data and hold data processors accountable for security breaches and data breaches.
• Business continuity planning: It is essential to implement contingency plans to ensure business continuity in the event of a processing interruption.
• Subcontractor approval: prior approval must be obtained for the use of subcontractors for processing activities to ensure compliance standards are met.
• Right to audit: data fiduciaries must reserve the right to audit the work of data processors and receive relevant audit reports.
• Government access and compliance: The contract must allow access to the data fiduciary’s records by government or regulatory authorities and require compliance with any instructions from the competent authority.
• Right To Audit: The data controller must reserve the right to audit the data processor’s IT and cybersecurity systems to assess security measures.
• Post-contract confidentiality obligations: specify that personal data must remain confidential after the contract ends.
• Record-keeping obligations: processors must fulfil their record-keeping obligations in accordance with legal requirements.

A well-drafted data protection agreement (DPA) should outline certain obligations of the data processor, such as

• Acts only according to the written instructions of the data fiduciary.
• Ensure confidentiality and security throughout the data processing lifecycle.
• Employ sub-processors only with the prior approval of the data fiduciary under a written contract.
• Delete or return all personal data at the end of the contract.
• Allow the data fiduciary to conduct audits and provide necessary information upon request.
• Immediately notify the data fiduciary of any problems arising during data processing.
• Help comply with requests from Data Principles and data protection impact assessments.

Compliance with the DPDP Law requires commitment from data fiduciaries at all levels. By following these steps and leveraging legal expertise, data fiduciaries can build a robust framework for data protection. This proactive approach not only reduces legal risks, but also increases the trust of Data Principles and ultimately contributes to a safer digital ecosystem. Investing time and resources in both compliance measures and well-crafted contracts is crucial to creating a responsible data processing environment.

Author: Sumedha Vadhulas

Please contact us at info@origiin.com to know more about our services (Patent, Trademark, Copyright, Contract, IP Licensing, M&A of companies)

Subscribe to YouTube Channel HERE

Join LinkedIn Group: Innovation & IPR

WhatsApp: +91 74838 06607 

Importance Of Jurisdiction In Contracts

Dec 16, 2024 | General

A “Jurisdiction Clause“, also known as a “Choice of Law” or “Forum Selection Clause”, is a crucial provision often included in commercial contracts. It establishes the jurisdiction or court that will have the authority to resolve any disputes that may arise between the parties involved in the contract. For startups that create value based on the IP they own, choosing a the right jurisdiction can mean the difference between being able to successfully prove their claim over their IP, and lax protection measures to protect the very same IP.

Understanding Jurisdiction

Jurisdiction can be defined as the limit of a judicial authority or the extent to which a court of law can exercise its authority over suits, cases, appeals etc. The rationale behind introducing the concept of jurisdiction in law is that a court should be able to try and adjudicate only in those matters with which it has some connection or which fall within the geographical or political or pecuniary limits of its authority.

There are three basic types of jurisdictions:

• Territorial Jurisdiction: Territorial jurisdiction concerns whether the cause of action arose within the sovereign boundaries of the State or has a close enough nexus with the State to justify the State deciding on such suit.
• Personal Jurisdiction: Personal jurisdiction concerns jurisdiction over the defendant. For the court to obtain personal jurisdiction, the defendant must be physically present in State.
• Subject Matter Jurisdiction: Subject matter jurisdiction concerns the court’s authority to hear the type of case or matter in question.

Factors to Consider When Selecting a Jurisdiction

Legal Framework and Business Environment

• Stability of laws: Choosing a jurisdiction where there are changes occurring the IP legal landscape can be very risky, as certain IP rights can be affected even retroactively (i.e., the contract was entered into prior to the enactment of the new law, but the new legislation can still be applied).
• Support for IP protection: Different countries have varying levels of support for IP protection. This can be determined based on the proportional amounts of government funding invested in R&D in sectors such as technology, consumer goods, etc. This can also be assessed based on the tax incentives provided for IP and IP transactions. Licensing and Transactions are taxable at different rates across the world, and choosing a favourable tax environment could also aide in the growth of a startup.
• Regulatory environment: The most important factor to consider is the regulatory environment of a country within the jurisdiction of which a contract has been entered into. Certain countries such as the US are known for the robust IP Protection policies as well as the courts’ stance on the importance and protection of IP, which is evidences by the plethora of case laws supporting the same.

Enforcement of Contracts

• Ease of enforcing contracts in the jurisdiction: While a contract is by definition enforceable, the ease of enforcing such contract varies by jurisdiction depending on the time required to enforce it by the court, the cost for such suit, and a history of quality judgements delivered in such jurisdiction under similar circumstances. The Ease of Doing Business data factor of Enforcing Contracts can be a valuable resource to determine the same, in which Singapore, South Korea, Norway, Kazakhstan and China claim the top 5 ranks.
• Historical context of dispute resolution: Looking into a country’s past judgements delivered on the subject matter of the contract can also help when deciding jurisdiction. For example, if a country is likely to be more supportive of licensors over licensees, or has a history of investing heavily into startups, it can prove favourable in the event that the contracts require legal enforcement.
• Accessibility to Legal Resources: An important factor to consider is the accessibility and availability of legal resources such as attorneys who are familiar with the law of the jurisdiction in which the contract is entered into. The quality of the courts and the arbitration centres should also play an important role in making this decision, as the court system can determine factors such as appealability of the decision, the type of bench that typically hears such disputes, etc.

Cross-Border Considerations

Through the inclusion of a jurisdiction provision in an international commercial contract, Indian law recognises the parties’ right to jointly select a forum (an Indian or foreign court) the enforcement of the contract.

• Enforceability of Foreign Judgment or Decree in India:

A foreign judgement or decree must meet the conclusiveness test in order to be enforceable in India; that is, it must be conclusive and not subject to any of the following restrictions or exceptions:

• not issued by a court with the necessary authority.
• not awarded based on the case’s merits.
• based on a misunderstanding of international law or, if relevant, a refusal to comply with Indian law.
• during the procedures, the Natural Justice principles were not adhered to.
• obtained by fraud and/or deception.
• sustained a claim based on a violation of any Indian law.

• Execution of foreign decree of a reciprocating territory as an Indian decree in India:

A foreign decree issued by a court in a reciprocating territory may be executed as an Indian decree by an Indian district court following the prescribed procedure if a party seeking execution files an execution application with the certified copy of the decree and a certificate attesting to the degree of satisfaction or adjustment of the sum decreed in the district court. To put it another way, the district court will execute the foreign judgement or decree without considering its conclusiveness and without considering the case’s merits. This allows for direct execution, which streamlines and expedites the procedure.
However, for this to apply, the said foreign decree should have been passed by any of the superior courts of any “reciprocating territory ” i.e. any country/territory outside India which is notified to be so by the Central Government in the Official Gazette .

Choosing Between Exclusive and Non-Exclusive Jurisdiction

• Advantages of exclusive jurisdiction: Exclusive jurisdiction provisions restrict disagreements to a single jurisdiction’s courts. You know where you may sue and be sued thanks to an exclusive jurisdiction agreement. Additionally, they provide more protection since, in the event that an exclusive jurisdiction provision is encountered, it is less probable that another court will accept jurisdiction.
• When to consider non-exclusive jurisdiction: In theory, choosing non-exclusive jurisdiction will allow disputes to be heard in the courts of a certain jurisdiction, but it won’t affect either party’s ability to take the matter to the courts of another country if necessary. These provisions provide you with the assurance that conflicts can be heard in a certain jurisdiction that you find desirable, but that jurisdiction elsewhere is accessible if needed. Nevertheless, there remains a chance of parallel processes even though they provide more freedom. However, although they offer greater flexibility there is the risk of parallel proceedings.

In conclusion, it is impossible to exaggerate the importance of jurisdiction in contracts, particularly for startups that rely significantly on their intellectual property. A clear jurisdiction provision acts as a buffer, guaranteeing that disagreements are settled in a way that upholds legal rights and fosters corporate stability. By carefully weighing elements including regulatory environments, legal frameworks, and the ease of contract enforcement, parties can choose locations that suit their risk profiles and interests. Choosing between exclusive and non-exclusive jurisdiction may have a big influence on a startup’s capacity to safeguard its ideas and successfully handle any issues that may arise. Understanding and taking advantage of jurisdictional intricacies is crucial for promoting development and protecting important assets as organisations increasingly conduct cross-border transactions.

Author: Sumedha Vadhulas

Please contact us at info@origiin.com to know more about our services (Patent, Trademark, Copyright, Contract, IP Licensing, M&A of companies)

Subscribe to YouTube Channel HERE

Join LinkedIn Group: Innovation & IPR

WhatsApp: +91 74838 06607 

Importance of Data Privacy – GDPR and DPDP Act

Nov 30, 2024 | General

Data privacy is a discipline intended to keep data safe against improper access, theft or loss. I is vital to ensure that data is kept confidential and secure, and this is achieved through exercising sound data management and preventing unauthorized access that might result in data loss, alteration or theft.

This can be achieved through implementing effective cybersecurity measures within the organisation such through access control measures, such as usernames and passwords, or some form of biometric authentication. Robust legislation regulates the collection, storage and processing of personal data both internationally and domestically in the form of the General Data Protection Regulation (GDPR) and the Digital Personal Data Protection (DPDP) Act.

The GDPR is a legal framework that sets guidelines for the collection and processing of personal information from individuals who live in and outside of the European Union (EU).

The regulation, which was approved in 2016 and put into effect in 2018, is the strictest data security and privacy law in the world. It aims to give users control over their own personal data by holding companies responsible for the manner in which they collect, store and process such information.

The Digital Personal Data Protection (DPDP) Act, 2023 is India’s first legislation on data privacy and protection. It applies to the processing of digital personal data within the territory of India collected online or collected offline and later digitized. It is also applicable to processing digital personal data outside the territory of India, if it involves providing goods or services to the data principals within the territory of India.

General Data Protection Regulation (GDPR)

The GDPR sets forth 3 key principles for with regards to Data Privacy: Lawfulness, Fairness and Transparency.

“Lawful” means that the collection and processing of data is done on a legally valid basis. This can mean enforcing consent mechanisms for ensuring that the user is informed and willing to provide their data.

“Fair” means that the processing of personal data is in the best interest of the user who has provided the data and any processing done on such data is within the scope of what the user can reasonably expect when such data is provided.

“Transparency” is the clear communication of the details of the processing of personal data to the user from whom such data is collected.

With respect to the rights of the users, the GDPR guarantees the following rights:

• The right to be informed
• The right of access
• The right of rectification
• The right to erasure
• The right to restrict processing
• The right to data portability
• The right to object
• The right to not be subject to automated decision-making

The GDPR recognizes that not all organizations involved in the processing of personal data have an equal level of responsibility, and classifies two entities under the purview of the regulation: a Data Controller is an entity which determines the purposes of any personal data and the means of processing it, while a Data Processor is an entity which processes personal data on behalf of a data controller. An entity classified as a data controller or a data processor, is responsible for ensuring compliance with the GDPR and demonstrate compliance with the regulation’s data protection principles. While Date Processors do not have the same level of GDPR compliance responsibilities as Data Controllers, they must still take appropriate organizational and technical measures to ensure that any processed data is done so in line with the GDPR.

Digital Personal Data Protection (DPDP) Act, 2023

This Act establishes guidelines for handling digital personal data, balancing individuals’ rights to protect their information with the necessity of processing data for legal purposes and related matters. The act applies to personal data which is processed within India, and personal data that is processed outside India if it pertains to business activity related to individuals within India.

The Act is based on the following seven principles:

• The principle of consented, lawful and transparent use of personal data;
• The principle of purpose limitation (use of personal data only for the purpose specified at the time of obtaining consent of the Data Principal);
• The principle of data minimisation (collection of only as much personal data as is necessary to serve the specified purpose);
• The principle of data accuracy (ensuring data is correct and updated);
• The principle of storage limitation (storing data only till it is needed for the specified purpose);
• The principle of reasonable security safeguards; and
• The principle of accountability (through adjudication of data breaches and breaches of the provisions of the Bill and imposition of penalties for the breaches).

The Act provides for following rights to the individuals:

• The right to access information about personal data processed;
• The right to correction and erasure of data;
• The right to grievance redressal; and
• The right to nominate a person to exercise rights in case of death or incapacity.

Data privacy is crucial in a society that is becoming more and more digital. Both India’s Digital Personal Data Protection (DPDP) Act and the General Data Protection Regulation (GDPR) are essential frameworks intended to safeguard people’s personal information while making sure businesses manage it appropriately. These rules provide users more control over their information and strengthen their rights by emphasising the values of lawfulness, fairness, and openness.

Following these regulations is not only required by law but also advantageous for businesses, particularly start-ups with significant intellectual property. Stronger customer connections result from the implementation of solid data protection procedures, which also build trust and improve brand reputation. Businesses must be proactive as the regulatory environment evolves, constantly modifying their procedures to satisfy compliance standards and protect the data they handle.

Organisations must effectively address the intricacies of data privacy by comprehending and adhering to the principles set out in the GDPR and DPDP. This effort not only safeguards people’s rights but also helps create a more secure and reliable online environment, opening doors for innovation and expansion in the information economy.