Almost every business now holds personal data: customer names and phone numbers in a CRM, employee records in an HR system, addresses in an order book. Privacy law has caught up with that. India's Digital Personal Data Protection Act and the European Union's General Data Protection Regulation both set rules for how that data is collected, used and protected. This article explains what each asks of a business in plain terms, and the practices that satisfy both.
This is a practical overview from a team that builds software holding personal data. It is not legal advice. For decisions about your own obligations, speak to a lawyer who works in this area.
India's Digital Personal Data Protection Act
The Digital Personal Data Protection Act, 2023 is India's law on personal data held in digital form. It applies to data processed in India, and to processing outside India when it is connected with offering goods or services to people in India. Its obligations are being brought into force in stages through rules issued by the government, so check the current position before relying on any timeline.
The Act calls the business that decides how data is used a data fiduciary, and the person the data is about a data principal. In outline, it asks a business to do the following.
Give notice and obtain consent. Tell people in clear language what you collect and why, and get their consent, except where the Act allows processing for certain legitimate uses.
Use data only for the stated purpose, and stop holding it once that purpose is served.
Keep it accurate and secure, with reasonable safeguards against a breach.
Report a personal data breach to the Data Protection Board and to the people affected.
Honour people's rights to access their data, correct it, have it erased and raise a grievance.
Take extra care with children's data, including consent from a parent or guardian.
Businesses designated as significant data fiduciaries carry further duties, such as appointing a data protection officer and commissioning audits. Penalties under the Act are financial and can be substantial.
The EU's General Data Protection Regulation
The GDPR applies to organisations established in the European Union, and to organisations elsewhere that offer goods or services to people in the EU or monitor their behaviour. An Indian company with European customers or users can fall within it.
The GDPR rests on similar principles: lawfulness, purpose limitation, data minimisation, accuracy, storage limitation and security. Consent is one of several lawful bases for processing, alongside contract and legitimate interest. People have rights to access, correct, erase and move their data. A breach that puts people at risk must be reported to the regulator within 72 hours of the organisation becoming aware of it.
What the two laws have in common
The DPDP Act and the GDPR differ in detail but agree on the essentials. Know what personal data you hold. Collect it for a stated reason. Keep it secure. Delete it when you no longer need it. Tell people what you are doing, and respond when they ask. A business that builds those habits is most of the way to meeting either law.
Seven practices that satisfy both
1. Keep an inventory of personal data
List what personal data you hold, where it lives, why you hold it and who can see it. Most businesses are surprised by the answer, because copies sit in spreadsheets, inboxes and old systems.
2. Collect less
Data you never collected cannot leak. Ask for the fields a process needs and no more. Every optional field on a form is a liability.
3. Make consent and notices clear
Say what you collect and why in language a customer understands, at the point of collection. Record that consent was given, and make withdrawing it as easy as giving it.
4. Control access and encrypt
Give each role access to the data its work requires. Encrypt data in transit and at rest, and log who viewed or changed sensitive records.
5. Set retention periods and delete on schedule
Decide how long each kind of record is kept and delete it when the period ends, unless another law requires you to keep it. Deletion should be a routine job, not a project.
6. Check your vendors
Data you pass to a payment gateway, a messaging provider or a cloud host is still your responsibility. Know which vendors hold what, and put the obligations in the contract.
7. Prepare for a breach
Decide in advance who investigates, who reports and what customers are told. Both laws expect prompt notification, and a plan written during an incident is written too late.
What this means for the software you commission
Privacy is cheaper to build in than to add later. When you commission a system that holds personal data, such as an HRMS, a CRM or a customer app, ask how it handles each of the seven practices above. Role-based access, an audit trail, consent records, retention rules and the ability to export or erase one person's data should be part of the design.
Ask too where the data will live and in whose name. On our projects the database and the hosting are in the client's name.
Conclusion
Data privacy is no longer a concern only for large companies. India's DPDP Act and the GDPR ask every business holding personal data to know what it has, use it for a stated purpose, protect it and delete it in time. Start with an inventory, collect less, and make sure the software you run supports the rest. If you are planning a system that will hold personal data, talk to us about building privacy in from the start.
Human. Digital. Future.
