DPDPA 2023: Practical Implementation for Indian Businesses

The DPDPA represents India's answer to global privacy regulations like GDPR, but with unique characteristics tailored to the Indian context. Key Concepts: • Data Principal: The individual to whom personal data relates • Data Fiduciary: Any entity that determines the purpose and means of processing • Data Processor: Entity that processes data on behalf of a Data Fiduciary • Significant Data Fiduciary: Large-scale processors with enhanced obligations

1. Lawful Basis for Processing Unlike GDPR's six lawful bases, DPDPA primarily relies on: • Consent: Freely given, specific, informed, and clear • Legitimate Uses: Employment, medical emergencies, legal obligations 2. Consent Management Requirements: • Must be obtained before processing • Specific to purpose and data categories • Informed about rights and processing details • Easily withdrawable • Verifiable (maintain records) 3. Data Principal Rights: • Access: Portal or process to request data copy • Correction: Mechanism to update inaccurate data • Erasure: Process to delete data on request • Grievance Redressal: Designated officer and response SLAs • Nomination: Allow designation of nominee SLA: Respond to requests within 30 days

Phase 1: Discovery (Weeks 1-4) • Data mapping: What personal data do you process? • Purpose documentation: Why do you process each category? • Legal basis assessment: Do you have valid grounds? • Third-party inventory: Who processes data on your behalf? Phase 2: Gap Analysis (Weeks 5-8) • Compare current practices against DPDPA requirements • Identify consent gaps • Assess data principal rights enablement • Review processor agreements Phase 3: Implementation (Weeks 9-16) • Deploy consent management solution • Build data principal request handling process • Update privacy notices • Train staff on new procedures • Update processor agreements Phase 4: Operationalize (Weeks 17-24) • Establish monitoring and audit processes • Implement data protection impact assessments • Set up grievance redressal mechanism • Prepare for regulatory inspections

DPDPA introduces significant penalties: • Failure to implement security safeguards: Up to ₹250 crore • Failure to notify breach: Up to ₹200 crore • Non-compliance with children's data provisions: Up to ₹200 crore • Other violations: Up to ₹50 crore