Is Your Business Ready for India’s Digital Personal Data Protection Act?

A company usually thinks about data protection compliance for the wrong reasons. Not because a compliance officer found a vulnerability during an internal review, but because of a customer complaint, a regulator's scrutiny of vendor contracts during a due diligence process, or a data breach at a competitor that made the board realise the same could happen to them. By the time the question arises at the C-suite level, it often emerges that the company’s privacy policy was drafted years ago for a quite different set of activities, its consent processes capture more information than the purpose articulated, and no one can give a satisfactory answer on whether its vendor agreements contain the data protection obligations the DPDPA now contemplates.

Such is the reality of data protection compliance, which rarely occupies centre stage until the processing operations begin to scale, involve multiple vendors, use automated or AI-driven processing, or start transferring data internationally. A business that thought of its privacy policy as a purely legal document and did not invest effort in thinking through its data processing operations will learn this the day a data subject exercises their right to erasure, and the company realises it has no idea where that data is stored. An organisation that did not subject its privacy policy to a compliance audit will find out this fact the day a regulator asks to see proof of obtaining someone’s consent for a particular purpose, and it emerges that the consent was obtained via a generic checkbox.

Corrida Legal helps businesses bridge the gapbetween what the requirements of DPDPA and allied laws about a data fiduciary’s responsibilities and what their processing operations actually do. We perform data privacy audits and assist organisations in plugging gaps in their compliance readiness as determined by such audits. In other words, we help design a data protection compliance roadmap based on what the business does rather than what generic requirements say. We help design privacy policies and data processing agreements as well as consent management procedures around a business’s data processing practices and not the other way around. For businesses that use AI or automated processing to evaluate candidates or customers, we advise on how such processing can be designed to meet both the DPDPA and global data protection laws since these areas tend to be grey, and regulatory expectations are evolving. Similarly, for businesses that use processing systems within their own staff, such as in recruitment, performance management, or employee data analytics, we help structure these processes so that processing is lawful, transparent, and fair.

Beyond the basic aspects of data protection compliance, we also have experience helping businesses with cross-border data transfer mechanisms, including standard contractual clauses, and data localisation requirements for data transfers outside India. We assist with data breach response planning, including incident response, reporting requirements to the regulator, and cybersecurity requirements for processing by regulated entities such as banks. We provide advice on the data protection aspects affecting employees and vendors as well as customers, including designing consents, access control mechanisms, and confidentiality requirements to ensure personal data is processed lawfully throughout a business’s ecosystem.

Our data protection expertise is primarily in the advisory space, providing businesses with the opportunity to design their processing operations, privacy policies, and contractual safeguards around an understanding of the DPDPA’s requirements. Our focus is on reducing litigation risk before it arises, though we represent clients in disputes and regulatory proceedings where data protection issues are at stake. Our experience enables us to know that, with very few exceptions, most of the risk a business faces emanates long before any sort of dispute arises. A simple data privacy audit is often sufficient to address the majority of compliance vulnerabilities, such as when a company’s privacy policies were formulated or its vendor agreements reviewed. In most cases, we prefer helping our clients address the deficiencies privately and avoid unpleasant discussions with regulators or data subjects. While we certainly deal with regulators and litigations when necessary, we tend to focus our efforts on helping businesses reduce their exposure to contentious disputes through proactive legal design and risk assessments.