Cos to alert govt, act fast in personal data breaches

Organizations that notice breaches of personal data may have to immediately alert users and flag them to the Data Protection Board, followed by a detailed filing within 72 hours. The government may release draft rules on the matter this week, a person aware of the matter said.

- Gulveen Aulakh & Shouvik Das

The first report to the board must specify the nature of the breach, its location, duration, amount of data involved and its potential impact, while the detailed report must include the circumstances and reasons that led to the breach, and steps to mitigate risk to users and prevent a repeat.

The rules may also envisage a consent artifact architecture essentially, an electronic method for data principals (users) and data fiduciaries (companies handling data) to notify each other on giving or withdrawing consent on data use, and managing or reviewing that consent.

The Digital Personal Data Protection (DPDP) Act, India's first law on data protection, took effect in August, and upcoming rules under the Act will lay the ground for compliance by technology companies. The Act has set penalties of as much as ₹250 crore in case of a data breach. For the average user, the rules put in place rights to access their information by any entity, withdrawal of consent, and enable mechanisms to correct or erase personal data and mechanisms of redressal in cases of breach.