India's new data protection law: A compliance guide

Although we have known since 2023 that India's Digital Personal Data Protection Act of 2023 (DPDP Act) would come into effect sooner or later, most businesses put off taking action until the rules were notified. Last week, the ministry of electronics and information technology brought the DPDP Act into force, marking the beginning of a new chapter in India's digital governance history.

- RAHUL MATTHAN

Although data fiduciaries have been given a fairly generous 18-month transition period before the entire law comes into force, now that the clock has started ticking, everyone is worried that they may not have enough time to comply.

The DPDP Act is a relatively straightforward piece of legislation designed to do one thing and one thing only: regulate the processing of digital personal data. It goes about doing this by requiring that anyone who 'processes' personal data must make sure it is always done on legitimate grounds.

So, what does a business have to do to determine whether its current operations are in compliance with the obligations under the DPDP Act? To all my clients who ask me this question, I recommend a simple three-step process to quickly assess the full magnitude of their compliance burden and identify the steps they could take to address any shortcomings.

Step 1 is to take stock of the personal data they currently collect. Most companies (big and small) use software systems to collect, process and store information. As a result, all they must do to answer this question is make a list of all the data fields in their database management systems and what that field contains. With this information in hand, all the company needs to do is identify which of those data fields contain personally identifiable information-and they will get a complete list of all the digital personal data that is being collected as part of their operations.