.svg){kind=small}
.png)
The Digital Personal Data Protection Act, 2023 and the DPDP Rules are finally here. Businesses now have a clear deadline to ensure compliance with the requirements of the new law.
Obligations for businesses under the DPDP Act all centre around the “Data Principal” (in simple terms - your customer).
The DPDP Act gives Data Principals (aka your customer) more control over their data and a pathway to enforce their rights over their data.
The obligation to facilitate these rights - known as “Data Principal Rights” mostly lies with you, the business (or as the DPDP Act calls you - the Data Fiduciary).
This has serious implications for your systems and processes - including downstream data and third party vendors you use.
This article tells you:
- What are all the Data Principal Rights under the DPDP Act
- What your obligations are for each right
- What product and process changes you will need to make in order to comply
What are the 7 Data Principal rights under the DPDP Act?
Data Fiduciaries must ensure customers can raise a rights request
Rights are useless without a way to enforce them.
The DPDP Act requires Data Fiduciaries to prominently inform customers:
- How they can raise a Rights Request.
- What details the customer will need to give when submitting the request e.g a username or any other identifier
This information should, ideally, be displayed in the consent collection notice/box itself and must be on the website or application as well.
What changes do Data Fiduciaries need to do in the back-end for Data Principal Rights?
There are 6 back-end things that you as a Data Fiduciary need to ensure to fulfil your DPR obligations under the DPDP Act.
A. Maintain Records of Processing Activities (ROPA)
You must know what data you collect, where it flows, where it is stored, and whom you share it with. This information must be recorded in a visual map tied to a strong back-end information database.
Without a ROPA, you will find it hard to respond and resolve rights requests within the mandated timeline.
B. Maintain Documented Retention Timelines
Not all data can be deleted on request. Sectoral laws and regulations may require retention for a specific period. The DPDP Rules itself specify a minimum one year retention period and 3 year retention periods for certain types of businesses.
Having a documented data-wise retention schedule will help determine what can be erased in case of a Rights Request and what must be retained.
C. Build Systems for Rights Request Fulfilment
Rights-handling cannot be manual. You will need an end-to-end DPR fulfilment system:
- A customer-friendly, easily accessible privacy center where customers can submit access, correction, withdrawal, and erasure requests,
- a verification layer so that a third party cannot falsely raise a rights request on behalf of a customer
- a backend workflow engine that triggers internal deletion/ update/ retrieval when the request is raised
- a ticketing system with response templates, internal owners and escalations that ensures responses are within the 90 day timeline.
D. Ensure downstream syncing of Updates, Erasure and Withdrawal
You will need all systems where you store personal data to be synced to the status of consent. If the user withdraws consent, every internal system and third party vendor will need to be notified. You will then also need a proper confirmation that the data has, indeed, been deletewd from the downstream system.
E. Maintain Translated Consent Notices
Businesses will need to ensure that the Consent Notice is made available in the language the customer understands. The DPDP envisages consent notices in 22 Indian languages. The easiest way to do this is to pre-bake consent notices in all languages and display a language toggle prominently in the consent notice itself.
F. Maintain auditable consent logs
All activities performed to the consent must be logged. A log of consent collection, log of consent storage, log of DPR request, log of processing of DPR.
These logs are vital to a) respond clearly to your customers when they raise a request, and b) to demonstrate compliance in case of regulatory and DPB inspections.
Use Consentin to help you manage Data Principal Rights
In this article we have mentioned all the backend changes you need to make to successfully discharge your DPR obligations under the DPDP Act. You can use this information (and other information in our blog) to build your own internal DPDP compliance systems.
However, if you don’t want to build - but instead want to buy and implement a ready-to-use platform for DPDP compliance - we hope you consider our platform - Consentin by Leegality.
Consentin is a comprehensive platform that gives Indian businesses the ability to ensure DPDP compliance across their customer and vendor journeys in a fast, easy and secure way.
Consentin has everything you need all under one roof - fully compliant with the DPDP Act:
- Data Discovery
- Data Mapping and ROPA preparation
- Consent Collection, Storage and Deletion
- Privacy Centre for DPR rights management
- Third Party Risk Assessments
- Cookie Consents
You can explore the platform here
.avif)
