Latest / ContraMinds Podcast - Unlocking Personal Growth and Professional Excellence / Bharath MS and Madhura Shanthini on Navigating India’s Evolving Data Privacy Ecosystem (#047)

Transcript

Bharath MS and Madhura Shanthini on Navigating India’s Evolving Data Privacy Ecosystem (#047) · ContraMinds Podcast - Unlocking Personal Growth and Professional Excellence

• 0:01
  SPEAKER_05: We all have uh banks or agents of banks or however they want to call it.
• 0:06
  SPEAKER_05: Now call us up and ask if we want personal loans because it's something that we all of us face in common and nobody remembers where we where they got our data from, or nobody has a track of it.
• 0:15
  SPEAKER_05: So if I were to inform a bank about not processing my data, don't call me back.
• 0:21
  SPEAKER_05: Now uh I don't remember a case where we have stopped receiving calls.
• 0:27
  SPEAKER_01: Exactly.
• 0:28
  SPEAKER_05: We still do.
• 0:29
  SPEAKER_05: Now there's going to be a problem because one of the obligations under the act is that when consent is revoked or consent is withdrawn, that data must be erased and it should be pro stopped, the processing must be stopped.
• 0:43
  SPEAKER_05: We should not handle the data henceforth unless there is a necessity to retain the data.
• 0:51
  SPEAKER_02: Today's episode is proudly brought to you by Effortless.
• 0:55
  SPEAKER_02: Effortless is the ultimate solution for startups and SMBs seeking seamless money management and compliance handling.
• 1:03
  SPEAKER_02: E-invoicing and eva bill generation with just a couple of clicks.
• 1:08
  SPEAKER_02: Slashing collection efforts by a staggering 90% through the magic of automated follow-ups.
• 1:14
  SPEAKER_02: Snapping a quick photo of your bill to instantly log expenses.
• 1:18
  SPEAKER_02: With Effortless, you get the power of a consolidated bank account view, seeing both business and personal accounts seamlessly integrated.
• 1:26
  SPEAKER_02: With Effortless, making UPI-like payments is a breeze.
• 1:30
  SPEAKER_02: Effortless keeps you on track, ensuring your finances and compliance are always in top shape.
• 1:37
  SPEAKER_02: Effortless wasn't just created by anyone, it was crafted by chartered accountant and entrepreneurs who understand the pulse of startups and SMBs.
• 1:46
  SPEAKER_02: Visit www.goeffortless.ai and embark on a journey that will redefine the way you do business.
• 1:54
  SPEAKER_02: Effortless, because managing a business should be anything but a hassle.
• 2:02
  SPEAKER_02: Hi Bharat and Madura, thanks a lot for accepting my invitation to talk in the Contraminds podcast.
• 2:09
  SPEAKER_02: It's an absolute privilege to talk to you and thanks for taking time and talking to us.
• 2:16
  SPEAKER_00: Very good evening, Swami.
• 2:18
  SPEAKER_00: It's an absolute pleasure and honor joining you here.
• 2:21
  SPEAKER_00: Knowing who all have preceded us and who have spent considerable time with you, it's absolute pleasure and honor to come and share our thoughts, experience, and knowledge on data protection tonight.
• 2:34
  SPEAKER_02: Fantastic.
• 2:36
  SPEAKER_02: So, Bharat, let me dive into the subject straight away.
• 2:40
  SPEAKER_02: I think we are going through a very critical phase in the uh you know the privacy uh you know uh legislation that's happening in India.
• 2:50
  SPEAKER_02: And uh this whole uh you know DPDPA act uh is really uh something that uh has taken a lot of effort, and I'm sure uh you know a lot of effort has gone into designing this uh you know very important act.
• 3:06
  SPEAKER_02: So if you can spend some time giving me a perspective on how this will impact business and uh what really are some of the key tenets of this act, that will be a good starting point for our conversation.
• 3:24
  SPEAKER_00: Absolutely.
• 3:25
  SPEAKER_00: Um, firstly, before we get into protection of data, we need to understand the privacy side or what is data, what is personal data, what is digitized personal data.
• 3:38
  SPEAKER_00: Uh there are basically three or four layers to it.
• 3:42
  SPEAKER_00: Uh data is information.
• 3:44
  SPEAKER_00: Information means uh and personal data means information about a particular person.
• 3:52
  SPEAKER_00: So if if Swami, I'm speaking to you, I know you are Swami, you are in Bombay, uh, you have uh you are a male, uh, you are probably uh Hindu by choice of religion.
• 4:07
  SPEAKER_00: We don't know what you practice, but I'm presuming with your name.
• 4:11
  SPEAKER_00: Uh and uh you will have uh your date of birth, your medical records, your financial uh status insofar as your banking records.
• 4:24
  SPEAKER_00: So any data which is able to personally identify you and which are personal to you would be the personal data of which you are the primary owner or you are the principal person for your own personal data.
• 4:45
  SPEAKER_00: Now, this data over the years, when uh say 40-50 years back when we all went to school would have been on a register, a school register.
• 4:57
  SPEAKER_00: That's the start.
• 4:58
  SPEAKER_00: I mean, it would be in a corporation register where we get a birth certificate.
• 5:04
  SPEAKER_00: Then it will be taken.
• 5:05
  SPEAKER_00: That birth certificate will then get translated into a school joining program where the school will ask, show me the birth certificate so that I know you are eligible and you are old enough to join school.
• 5:18
  SPEAKER_00: And that data gets translated into college.
• 5:22
  SPEAKER_00: With from college, you will have a college degree.
• 5:26
  SPEAKER_00: From there, you will open bank accounts from bank accounts, and then you will have your own uh uh email addresses.
• 5:34
  SPEAKER_00: You have uh then you go to a doctor down your road.
• 5:38
  SPEAKER_00: He might be having a scribbling pad, or you might have, or he or she might have a separate docket called Swami, and then it might have your medical records from your class two to class, I mean, all the way up until you are currently uh hail and healthy.
• 5:56
  SPEAKER_00: So there are a variety of data.
• 5:59
  SPEAKER_00: There is a variety of personal data, not all data pertaining to you is personal data.
• 6:04
  SPEAKER_00: There might be publicly available data as well, but we'll come to that later.
• 6:09
  SPEAKER_00: And then these are in different modes or medium, it can be in physical form or it can get digitized and become digital personal data.
• 6:23
  SPEAKER_00: When you look at uh the Indian history, uh we've been very, very open about a lot of things.
• 6:32
  SPEAKER_00: I mean, no one was really bothered about privacy.
• 6:35
  SPEAKER_00: Of course, privacy law has been primitive, not been enforced the way it would in the Western world.
• 6:42
  SPEAKER_00: Um I'm I'm I'm going on a long route here, but I will probably try to summarize it.
• 6:48
  SPEAKER_00: But uh when you look at uh cultural differences, Indians have been very open about their data.
• 6:57
  SPEAKER_00: They don't really care about their data.
• 6:59
  SPEAKER_00: When you go to the West, even their uh envelopes which come home will be put through a shredder, but we don't.
• 7:06
  SPEAKER_00: Um having said that, um, in 2000s uh was the first time when there was a need felt to have uh data protection and privacy protection.
• 7:20
  SPEAKER_00: Uh that that there is a rich history on why it came about to be uh formed, but 2006 statute never made it to becoming a law.
• 7:30
  SPEAKER_00: I mean it was more of a bill and it never became an act.
• 7:34
  SPEAKER_00: But eventually, uh earlier this year, we have the government which has passed in both the houses a digital uh uh data protection law.
• 7:46
  SPEAKER_00: So DPDPA is gonna protect personal data which is digitized.
• 7:53
  SPEAKER_00: Therefore, we need to have an act which will protect individuals, which will monitor and also guide corporations, individuals, organizations on how this personal data will be stored, saved, processed, and who uh is gonna monitor all these things, they would be probably a government-run tribunal.
• 8:19
  SPEAKER_00: And last but not the least, the most important key part is the consent.
• 8:26
  SPEAKER_00: I as a personal data, my personal data, or you as with your personal data need to consent where and how this data has to be personal data has to be used.
• 8:39
  SPEAKER_00: So they are bringing in very many players in this whole management of personal data.
• 8:46
  SPEAKER_00: But uh I I I as a starter, I just wanted to give a brief history on uh where we were and where we are, but of course we will uh go into the nitty-gritties eventually.
• 9:00
  SPEAKER_02: Fantastic.
• 9:01
  SPEAKER_02: I think uh uh it always makes sense, Bharat, to uh get the perspective first because yeah, you know, half the time we get into the details without having the perspective.
• 9:11
  SPEAKER_02: So it's great that uh you know you gave us the perspective.
• 9:15
  SPEAKER_02: But one question I have is if I were a customer and if I were a business, how is my life going to change with this DPDPA, right?
• 9:24
  SPEAKER_02: Which is uh, you know, there's going to be uh a whole host of things that are going to change for me as a customer, and what is it going to be for the business?
• 9:37
  SPEAKER_00: Well, um five years back, if you if I would have told you that you could spend months together without going to an ATM or a bank without cash, no one would have believed this.
• 9:53
  SPEAKER_00: Uh, the way 3G became 5G, the the digital transactions came about to be done, NEFT and uh uh online transfers from two-hour window to six-hour window to twelve-hour window to twenty-four windows have come.
• 10:12
  SPEAKER_00: The uh national uh at the national level there have been a lot of changes where UPI payments have been enabled.
• 10:23
  SPEAKER_00: Um 10 days back when we had the Ganesh uh or Vinay Khaturti.
• 10:30
  SPEAKER_00: Uh the I I tried going to this market and I I went with the 500 rupee note believing that they won't have digital money, and they said we don't have chuta, we don't have change for you, so please pay me by PayTM or Google uh GP of uh products worth 80 rupees and 100 rupees.
• 10:52
  SPEAKER_00: Uh so that's the transformation we are looking at even in data, in the sense uh day in, day out, we get pushed in by SMS, WhatsApp, calls which have been eating into our valuable productive time.
• 11:11
  SPEAKER_00: Unsolicited calls, targeted calls, uh uh even uh the social media.
• 11:18
  SPEAKER_00: I don't want to take famous names, uh, where uh you they know that you are in Bombay, you are in Bashi, you are looking out for an apartment which is three crores, and then there will be advertisements targeting you.
• 11:34
  SPEAKER_00: And those would be the transformational daily change which as an individual I would have.
• 11:41
  SPEAKER_00: From a marketing perspective, it will be much more selective.
• 11:48
  SPEAKER_00: You know who is really interested in buying an apartment in Vasi for three crores, and you will not be going and targeting 20,000 persons, you will be targeting 200 persons who have given consent.
• 12:04
  SPEAKER_00: So your budgets would possibly get lesser, and your target will be more focused.
• 12:11
  SPEAKER_00: That's my high take on it.
• 12:13
  SPEAKER_00: Um, but only time and tide will say as to how from an individual perspective, from a marketing uh marketing company perspective or a targeting company perspective, life would be different.
• 12:27
  SPEAKER_00: But I would say there would be more productivity, there would be less cost to the company.
• 12:33
  SPEAKER_02: Okay.
• 12:33
  SPEAKER_02: So Madhura, uh, there are multiple uh you know stakeholders in this uh act that uh you know that's defined, right?
• 12:43
  SPEAKER_02: So there's somebody called a data fiduciary, there is some somebody called a consent manager.
• 12:48
  SPEAKER_02: So can you walk us through who's a consent manager, uh, who's a data fiduciary, and can you give us some examples of how, if I were a bank or if I were a telco, uh how should the whole world of managing personal data change uh for me as a business?
• 13:10
  SPEAKER_05: Um let me speak from both perspectives, from the individual's perspective and from the business perspective.
• 13:16
  SPEAKER_05: So, uh, first starting with who all of us individually are, um, first change that, as Barasa was saying, the first change that this law is going to bring is that at every instance where our data is being collected, we'll be given a notice.
• 13:31
  SPEAKER_05: Each individual will be given a notice of what are the requirements, and we'll also be expected to give consent.
• 13:37
  SPEAKER_05: So now this means that there are going to be numerous organizations coming and asking me for consent.
• 13:43
  SPEAKER_05: And on a daily basis, we also give our information to multiple different businesses for the different transactions, right?
• 13:50
  SPEAKER_05: So, in order to manage all of these, it is essential for even individuals to have some system to manage and organize the kind of consent that I'm giving to different persons.
• 14:02
  SPEAKER_05: Say, for example, let's take in if uh I am located in Chennai and if I were to move to Bangalore or Mumbai, then all the other local providers, I might not be interested in continuing uh in them continuing processing my data.
• 14:17
  SPEAKER_05: And they should be some mass uh they I should also be enabled to uh communicate with all these local vendors, maybe my departmental store, maybe local real estate agent, banks, and tell them to stop processing my data because I'm moving to a different location or to give a change in address.
• 14:35
  SPEAKER_05: All of these is gonna be difficult uh to make it uh other than to say it's going to be difficult, uh understanding that it might be difficult, the government has brought in the uh ideology of concept manager, and this takes this amongst everything that the law is speaking of.
• 14:51
  SPEAKER_05: The consent manager concept has uh gotten a lot of attention because it's very new.
• 14:58
  SPEAKER_05: Most other laws, uh, around 120 other countries across the globe have data protection laws, but consent manager is a law that is coming, is a concept that has come new in India.
• 15:08
  SPEAKER_05: Okay, the law itself has uh recognized such a concept, and this the primary objective is to help people understand.
• 15:16
  SPEAKER_05: We are a large, we should understand that from the Indian perspective, this is a large nation, very mixed with population.
• 15:23
  SPEAKER_05: We are still a developing country, and there is a bunch of uh, you know, the population is divided by literacy, ability, language, and a number of other uh mechanisms, or uh a number of other uh factors, I can say.
• 15:38
  SPEAKER_05: So, uh, in such situations, it's also essential that uh it is easier for the individuals to manage the consent, and that's the um birth of the concept of consent managers.
• 15:50
  SPEAKER_05: This is going to be an entirely new kind of entities that are brought into picture to assist and aid the individuals in managing their consent.
• 16:01
  SPEAKER_05: Um, for now, for understanding purposes, let's uh you know take the example of uh each individual engaging and consent manager, a separate entity who will collect and moderate and manage the consent that I give to various uh businesses.
• 16:17
  SPEAKER_05: But what will these entities do?
• 16:19
  SPEAKER_05: How will they be structured for our easy understanding purposes?
• 16:23
  SPEAKER_05: Let's just think of it as another app that we have in our phones through which we give data and through which we'll manage data.
• 16:30
  SPEAKER_05: Um, it is expected that um the entire ideology of concept managers can come up like a centrally organized situation like how UPI works or through different um technology such as APIs, which will interact with other vendors and manage consent.
• 16:48
  SPEAKER_05: So that's the entire idea of concept managers, which is an entirely um new concept that has been brought into recognized by a law as such.
• 16:57
  SPEAKER_05: And um, looking at the lead that we took in terms of API, this can also be something that other countries may in future borrow from us.
• 17:05
  SPEAKER_05: Um and uh apart from consent managers, we also have other uh actors or players in the act, and one of them, which is you mentioned, is the data fiduciary.
• 17:16
  SPEAKER_05: So, in simple terms to column, um the act that refers to the individuals as data principals because you own the data and the data is specifically yours.
• 17:26
  SPEAKER_05: And um, there's a specific term data fiduciary given to businesses that work on that data.
• 17:33
  SPEAKER_05: So, all I'm using the word businesses for convenience, but whenever I use that, I also refer to organizations that can operate out of a non-profit motive, such as educational institutions or non-governmental institutions, or or even the government per se.
• 17:48
  SPEAKER_05: So, because data fiduciary is any organization, any entity that is handling some personal data.
• 17:55
  SPEAKER_01: Okay.
• 17:56
  SPEAKER_05: So for their uh operations or for their business.
• 18:00
  SPEAKER_05: That means every other organization in India, irrespective of their industry or irrespective of their scale of business, is working on some amount of personal data.
• 18:11
  SPEAKER_05: Because without personal data, the e-commerce delivery that we use, they'll not be able to deliver it to our space.
• 18:17
  SPEAKER_04: Correct.
• 18:18
  SPEAKER_05: All the bills will not get delivered.
• 18:21
  SPEAKER_05: And without personal data, there is no end customer, there is no connection at all.
• 18:25
  SPEAKER_05: Even even in the manufacturing industry, there are there is for communication purposes, or even in B2B, there is some amount of personal data involved.
• 18:33
  SPEAKER_05: So this means not just IT companies, not just social medias, but every other brick and mortar store that we in on a daily basis operate with, they'll also fall under the act, and they are the data fiduciaries.
• 18:48
  SPEAKER_05: When you're processing the data for your own purposes, for your business, to communicate with your customers, then you're a data fiduciary.
• 18:56
  SPEAKER_05: And one way this law differs from the other laws on on privacy across the globe is in general, the uh to describe a business that's operating on personal data, the word data controller is being used because that that way it refers to the entity that is controlling the means of processing and the purposes of processing, the entity that is deciding the means and purposes.
• 19:20
  SPEAKER_05: But this act calls it as the data fiduciary, giving significance to the term fiduciary because on a trust basis is that we are giving our data to some entity.
• 19:30
  SPEAKER_05: To emphasize on that trust basis is the reason the act is uh not terming the entities as data fiduciaries.
• 19:38
  SPEAKER_05: Uh, when an entity is operating uh on personal data, is handling a large amount of personal data or very sensitive personal data, then that entity can fall under the category of something called the significant data fiduciary, which will have higher obligations and more uh you know cost-consuming obligations than what a general uh data fiduciary might have.
• 20:02
  SPEAKER_05: So there are two layers one would be the significant data fiduciary and then the significant data fiduciary.
• 20:08
  SPEAKER_03: Okay.
• 20:08
  SPEAKER_05: And there's another concept called the data processor.
• 20:11
  SPEAKER_05: So data processors will mostly be subcontractors of uh data fiduciaries to whom a data an entity has given the data and instructed on what should be um what processing should be operated or what how the data should be handled.
• 20:29
  SPEAKER_05: So data processes are if if we are a data fiduciary, all our vendors become the data uh processes.
• 20:37
  SPEAKER_05: And we might on a daily basis think that maybe we are not using any vendors, but if we are handling data digitally, it's possible that we are using a lot of softwares for handling them, and all of these softwares also become our data fiduciaries.
• 20:51
  SPEAKER_05: All other processing outsourced apart from the company, they are data processors.
• 20:59
  SPEAKER_02: So it a typical BPO would become a data processor, is what you are saying, correct?
• 21:04
  SPEAKER_05: Precisely, BPOs would be not only BPOs, most other B2B companies will also fall under the category of uh data process for that amount of data that they are handling.
• 21:15
  SPEAKER_05: If they're sending an email, the mailing system is a data processor because what if I am sending an email from my company to uh a customer, I'm expecting the email carrier to only act on whatever instructions that I have given.
• 21:30
  SPEAKER_05: I'm not expecting them to do anything in a if I'm sending an email, it doesn't allow the mail carrier to take that data and use it for any other purposes or for their own purposes.
• 21:41
  SPEAKER_05: They are strictly acting under the instructions I have employed them or I have engaged with them only to act on the instructions that I have given.
• 21:48
  SPEAKER_05: So that likewise, I'm you know, likewise, if a company is giving uh is using a processor, then the processor is required to only act on the instructions of the company, or the vendors and subcontractors will.
• 22:00
  SPEAKER_05: Typically fall under this category.
• 22:01
  SPEAKER_02: Okay, great.
• 22:02
  SPEAKER_02: So uh somewhere I read that uh you know all businesses uh are coming under this law, or are there different timelines that have been given, for example, if I'm an MSME, I may not be digitally compliant or I may not have the maturity to uh you know become uh as uh the as the act uh wants so or startups.
• 22:25
  SPEAKER_02: So is there a difference in the kinds of businesses that this act uh you know gives flexibility to uh you know uh comply with this law?
• 22:40
  SPEAKER_05: Uh to answer uh yes, I'm also glad about posting that this law recognizes the difference in the Indian landscape and the different uh how it will be difficult can be difficult for certain businesses to comply with uh obligations.
• 22:55
  SPEAKER_05: So uh one main key aspect is that this law has not come into effect till date.
• 23:00
  SPEAKER_05: It has been announced.
• 23:01
  SPEAKER_05: We have a copy of the deserted copy of the act, it has been notified and inacted, but but it's not brought into effect yet.
• 23:08
  SPEAKER_05: What the government has uh said is that different portions of the act can come into effect on different dates as well.
• 23:16
  SPEAKER_05: This can be that major operators like social media, like um other entities that deal with a lot of personal information will be required to comply with the act first and later and on and you know subsequent basis, other smaller businesses will be uh bought within the compliance requirements.
• 23:37
  SPEAKER_05: And also to note uh this act also has certain exceptions for startups for smaller companies, where they will be accepted not from the entire application of the act but from certain obligations.
• 23:50
  SPEAKER_05: Startups can have an exceptions on to once it is being notified by the government, start there is a you know placeholder or there is a provision that may allow startups to be accepted from certain provisions.
• 24:02
  SPEAKER_05: Okay, and uh, as I was saying, it is already layered to some extent.
• 24:06
  SPEAKER_05: So we have the data fiduciary, which will be all entities, and entities processing large amounts of data, or the scope of processing is very high, or uh they handle very sensitive data, they can like banks, they will fall under the significant data producery category who have higher obligations.
• 24:23
  SPEAKER_05: So the timeline is also can be different, the scope of obligations can also be different.
• 24:29
  SPEAKER_02: Are there any uh certifications or you know, like a badge uh that uh gives me as a business uh to say that I am 100% compliant with uh this act?
• 24:41
  SPEAKER_02: Is there anything like that that's there right now?
• 24:45
  SPEAKER_05: If there is anything as such, that will be a great relief to most organizations, but we should currently also understand that this law is something that businesses should comply on a daily basis.
• 24:59
  SPEAKER_05: It's not just you know one registration or one certification, and hey, I am compliant.
• 25:05
  SPEAKER_05: So this is more on a practical and an implementation basis.
• 25:08
  SPEAKER_05: So currently, under the law, we don't have any certification uh procedure as such, but uh any kind of uh information security uh practices or certifications, such as the ISO 27001 or the 2010, which is around uh information security management systems, or the ISO 27701, which is uh more I mean more um related to privacy because it uh it revolves around the privacy information management systems, personal information management systems, and cyber security, right and cyber security, right?
• 25:47
  SPEAKER_05: Yes, yes, cybersecurity machines can be helpful.
• 25:50
  SPEAKER_05: The law doesn't call out on any of the certifications that I'm speaking of, but on a practical and implementation basis, um moving towards any of these security certifications can be very helpful because although we call this a privacy legislation, the implementing leg, one of the implementing legs is security, cybersecurity.
• 26:08
  SPEAKER_05: So to enhance protection, it would be suggestible to have these uh certifications or any other certifications recognized globally, um, but all of these are not what the law calls out on a practical basis, it can be helpful.
• 26:21
  SPEAKER_00: Okay, great.
• 26:21
  SPEAKER_00: So ISO 27001 and 27701 both are for information security and privacy information management system.
• 26:35
  SPEAKER_00: So while the first one is how you protect data inside your organization, and third second one is a very advanced one.
• 26:44
  SPEAKER_00: Both of them normally have a gestation period of six months to ten months to one year for study of your practices uh internally and how you are logging in movement of data within your organization, and after the end of six months to ten months, depending on when you think you are ready for the audit, ISO officials come sit with you for a few days, they audit your systems for about how long ever it takes, and if you pass, of course, an ISO certification is given.
• 27:20
  SPEAKER_00: But as rightly said, the DPDPA Act is nothing to do with ISO certification, it does not require your organization to be certified if it's only for the comfort level of your badge of quality in which you are managing data and information privacy as well.
• 27:44
  SPEAKER_01: Okay, okay.
• 27:45
  SPEAKER_05: So uh so once you're considering it might not be uh you know uh economically feasible for all organizations to go for an ISO certification.
• 27:55
  SPEAKER_05: Exactly, exactly it can be very well governed within internal practices and implementation of certain other requirements.
• 28:01
  SPEAKER_00: It might not be I was checking it takes about 9 to 15 lakhs, anywhere between nine and fifteen lakhs to get it.
• 28:07
  SPEAKER_02: Exactly.
• 28:08
  SPEAKER_02: No, which is the next point uh uh Bharata I'm coming to which is uh you know, uh is this kind of a law uh if I'm already, you know, uh I'm compliant with the uh international privacy laws, does it require me to uh uh you know uh get some waiver, or do I need to uh comply with the Indian jurisdiction?
• 28:35
  SPEAKER_02: So is there is there something that it it says so I may be GDPR compliant?
• 28:40
  SPEAKER_02: So is the uh you know so how does that work?
• 28:45
  SPEAKER_00: So the standards are uh so different, the expectations are so different.
• 28:51
  SPEAKER_00: Uh in some ways, GDPR has got higher standards, in some ways, Indian DPDPA has got higher standards.
• 29:00
  SPEAKER_00: When I mean what I mean by that is uh the way in which they uh look at the controller, what we call it as the fiduciary is different.
• 29:09
  SPEAKER_00: Uh there is no concept of a constant manager in uh GDPR at all.
• 29:15
  SPEAKER_00: Uh, I think that would be a game changer in India.
• 29:19
  SPEAKER_00: Okay.
• 29:19
  SPEAKER_00: Uh what I mean by that is uh to put it in a very uh different perspective, but on a relatable perspective.
• 29:28
  SPEAKER_00: Uh affordable Indians are so used to having a chauffeur or a person who will come and clean the house on a daily basis, uh, or uh a runner, an errant person who will go shopping for you, um, or a concierge, personal concierge.
• 29:47
  SPEAKER_00: We can call them by different names, but I don't want to term them differently.
• 29:53
  SPEAKER_00: But the West uh doesn't have that.
• 29:57
  SPEAKER_00: I mean, you go to a shopping mall in India, you have an automated parking system.
• 30:05
  SPEAKER_00: But for uh the getting the parking ticket out, you have a man or a woman pushing the button for you and giving the ticket out, which you can do it on your own.
• 30:15
  SPEAKER_00: Correct, right?
• 30:17
  SPEAKER_00: Either way, you can technically have a consent management on your own, but still in India they deemed it fit that you need a consent manager for different perspectives, probably because an individual, not all individuals would know how to do that, or you can call it as a concierge desk.
• 30:40
  SPEAKER_00: So uh there's no one uh standard, there is not one level of quality of uh data protection.
• 30:49
  SPEAKER_00: Uh yes, GDPR is ahead of time.
• 30:53
  SPEAKER_00: Uh when when it says ahead of time, they are ahead of us, they were implemented first.
• 30:57
  SPEAKER_00: I won't say they are of higher quality or higher standard, uh, but it's not the same yardstick.
• 31:03
  SPEAKER_00: Okay.
• 31:04
  SPEAKER_00: Uh it's like taxation law.
• 31:06
  SPEAKER_00: Uh, you you you have a different set of tax in the EU, different set of tax in India.
• 31:11
  SPEAKER_00: If you're compliant in EU, you need not be compliant in India, right?
• 31:16
  SPEAKER_00: So uh if you have an organization which has a foot in EU and foot in India, you need to be compliant of tax laws in both countries or both jurisdictions.
• 31:27
  SPEAKER_00: Similarly, even for data protection, you need to be compliant though of different set of expectations and standards in each of the two jurisdictions.
• 31:36
  SPEAKER_02: So if I were an organization, the law is still not in force, how do I prepare myself?
• 31:42
  SPEAKER_02: Because somewhere I read that uh law firms like yours are helping in gap analysis, uh, looking at uh you know where how the data is being uh you know stored, how the data flows are.
• 31:55
  SPEAKER_02: So uh what are the things that are being done?
• 31:58
  SPEAKER_02: And if I'm an organization wanting to be prepared for this change that's going to happen, what are the things I should be doing, Madhur?
• 32:07
  SPEAKER_05: So uh first to start out with, there should be an overall understanding of the data that we process.
• 32:14
  SPEAKER_05: Because this law, as such, the requirement as such is very new to India, and you know, privacy, as uh Bharat was saying in the starting of the uh presentation of the session, uh privacy as such is a concept that we are slowly moving towards.
• 32:30
  SPEAKER_05: Not all Indians understand the concept of privacy until the big boss has been a show that's you know on the top uh watch.
• 32:40
  SPEAKER_05: So this is going to take time for everybody to understand the privacy requirements, but we are slowly moving towards there.
• 32:47
  SPEAKER_05: Let's think of the number of consumers who are uh starting to purchase mobile devices that um project privacy is the key USD.
• 32:56
  SPEAKER_05: So we are moving slightly closer to the requirement, uh to being more concerned about privacy.
• 33:02
  SPEAKER_05: Uh with that, uh when obligation uh when we speak of obligations from a company's perspective, it's first important to understand what data we process, who do we have it shared with, and what are the pro what are the purposes that we use it for?
• 33:19
  SPEAKER_05: Where does this data get stored?
• 33:21
  SPEAKER_05: When we work with organizations, most organizations might not know where their data centers are.
• 33:27
  SPEAKER_05: Is it in a different country?
• 33:28
  SPEAKER_05: It might be in the US because you have worked with any vendor who has got you a data space in the US, and uh and on the go of everyday operations, we uh sometimes don't have a track of where and all our data goes.
• 33:42
  SPEAKER_05: Maybe it's an organization that has bring your own device policies, or it's just that people use their own systems, and it might be a lot of data might be lying in the laptops of employees who are even lefty organizations.
• 33:54
  SPEAKER_05: We don't have a track of it.
• 33:55
  SPEAKER_05: So, first to understand where the data is, wherever it goes, and uh this got to be uh the first step and the most critical step that any organization is taking.
• 34:06
  SPEAKER_05: We call it the data mapping, understanding the movement of data.
• 34:10
  SPEAKER_05: And uh, it's uh a little tricky also because uh data, when it moves, it it leaves very less trace, intangible assets.
• 34:21
  SPEAKER_05: So we're not able to clearly track where and all the data is moving and who has access to it, or do multiple people have access to it from the same ID in such cases.
• 34:31
  SPEAKER_05: How do we understand who is looking at what data and using it for what purposes?
• 34:37
  SPEAKER_05: It's very usual for us to call a customer from our personal mobile numbers to get some update, and all of it is going to be tricky because when uh such they have the relaying the customers' numbers as well as they do that.
• 34:50
  SPEAKER_05: So, first to is to understand the data processing of how we handle the data.
• 34:55
  SPEAKER_05: And when we say data mapping, we refer to five main questions, like I was saying to someone else.
• 35:02
  SPEAKER_05: One is what data do we process?
• 35:05
  SPEAKER_05: Where is the data located?
• 35:07
  SPEAKER_05: What are the purposes that is it is being used for?
• 35:11
  SPEAKER_05: Who has access and when do we delete the data?
• 35:15
  SPEAKER_05: And the last question gets trickier because in most instances we forget that data needs to be deleted.
• 35:22
  SPEAKER_05: Only when we run out of storage do we think of deleting the data.
• 35:25
  SPEAKER_05: That's that's the general conversation.
• 35:29
  SPEAKER_05: So it's important that we focus on all these five and understand um the entire data mapping processes.
• 35:37
  SPEAKER_05: And it's important for different stakeholders from different teams of an organization to sit together and understand because it's not going to be possible for one employee to just look at and say, oh, this is what we maybe the way the HR is processing the data can be very different from all the sales.
• 35:52
  SPEAKER_05: Each department can be using their own software, not something centralized.
• 35:56
  SPEAKER_05: They've been using different tools to process data.
• 35:58
  SPEAKER_05: So it's essential to first understand the data mapping process.
• 36:02
  SPEAKER_05: And uh, how privacy professionals and law firms like us help in doing it is through our experience in working with organizations across industries because what learning from one helps another.
• 36:16
  SPEAKER_05: So that's where our key role goes in helping uh companies understand, giving a full set of questions.
• 36:25
  SPEAKER_05: Have you done this?
• 36:26
  SPEAKER_05: Have you done this?
• 36:27
  SPEAKER_05: Do you process data?
• 36:28
  SPEAKER_05: I mean, do you process employee data?
• 36:30
  SPEAKER_05: Where are that is being stored?
• 36:31
  SPEAKER_05: If you're having an insurance company, what is the data and for employee insurance?
• 36:36
  SPEAKER_05: What is the data that you give them?
• 36:38
  SPEAKER_05: And uh what are the verticals in which data can be exchanged?
• 36:42
  SPEAKER_05: This is something that can come from experience or and an entire set of analysis that we do with the data, and that's where um you know we are trying to help companies and understanding.
• 36:53
  SPEAKER_02: So that's fantastic.
• 36:54
  SPEAKER_02: So, therefore, as a law firm, uh you are actually having a practice uh which is really around going to organizations and saying, Hey, we can help you with the data mapping, and therefore understanding the legal and the compliance uh requirements of organizations and where do they stand today?
• 37:14
  SPEAKER_02: And that's really the first step that you believe organizations should start doing.
• 37:18
  SPEAKER_02: Is that right, Barat?
• 37:19
  SPEAKER_02: Would that be the first step to take?
• 37:22
  SPEAKER_00: Absolutely.
• 37:22
  SPEAKER_00: We we call it the audit, it's like uh looking back into home, it's like a house audit.
• 37:32
  SPEAKER_00: Uh for the first time you will start understanding uh whose data do we have, why do we have it, where is it, as Madhu was mentioning.
• 37:43
  SPEAKER_00: It's um it's a it's an introspective question.
• 37:47
  SPEAKER_00: Unless you know what you have, you don't know what you have to do.
• 37:52
  SPEAKER_00: So the first step would be to do an introspection, what we call it as an audit.
• 37:58
  SPEAKER_00: Uh, and then it's not only just a law firm which will be important to be embracing or hand holding any of the organizations.
• 38:09
  SPEAKER_00: There'll be at least I'm visualizing 10 other players who will come to stitch this statute together to to make it work.
• 38:21
  SPEAKER_00: When I say to make it work, for an UPI to work, you need to have a Google, you need to have uh uh two banks, as in my bank, your bank, uh to uh send monies through Google Pay.
• 38:36
  SPEAKER_00: Uh and then you have apart from the bankers, you need to have another layer of a third-party vendor who will check if my pin verifies and opens my bank account, and then this the the it'll come and tap into knock your bank account for you to accept.
• 38:58
  SPEAKER_00: So without you knowing the API UPA transactions which are happening right now, have at least 10 players for one transaction to go.
• 39:10
  SPEAKER_00: And that's how we would have even data protection.
• 39:14
  SPEAKER_00: Not one person is enough, but as a starter, let's pause, let's see what we have, let's see what we should do, and you know, teams like ours would possibly help you go through your own itemized um uh subject matters, and then help you uh uh be prepared for the times to come because when it comes, there are penalties, there are uh uh not only just cost implications, there might be sanctions as well, uh, which we need to be aware of.
• 39:55
  SPEAKER_00: The bigger the company you are, uh the bigger the sanctions are.
• 39:59
  SPEAKER_00: Uh I'm told that it runs into several crores.
• 40:03
  SPEAKER_00: The top uh penalty is about 250 crores.
• 40:08
  SPEAKER_00: So uh, and and 250 crores might not be very much for uh a very, very large corporation, but 250 crores is a big money as a penalty.
• 40:20
  SPEAKER_00: Yeah, it's it's not a tax liability you are paying, it's it's not that you are challenging a tax liability, but it's a penalty of 250 crores for non-compliance of Data Protection Act.
• 40:33
  SPEAKER_00: Uh when I say 250 crores, that's the top end.
• 40:36
  SPEAKER_00: You can start with 2 crores, 5 crores, 10 crores, and it can go anywhere up.
• 40:41
  SPEAKER_00: Um, but what we are doing right now is uh firstly talk about it.
• 40:48
  SPEAKER_00: Uh secondly, we are having uh systems in place to uh discuss with and draw up a map, conduct those audits, and then give them reports of the audits to see where they are.
• 41:03
  SPEAKER_00: We don't know the gaps because we still don't know uh what the uh need is, right?
• 41:10
  SPEAKER_00: So we can possibly come out with a report of audit on the data which they have, and then say these are the portions of DPDPA which would be applicable for you, and let's wait for the rules and the regulations and the notifications to come because we are also expecting at least 15 to 20 different sets of rules and notifications to support the main statute.
• 41:39
  SPEAKER_02: Okay.
• 41:40
  SPEAKER_02: So uh so which clearly uh means that uh you know, so if I were to say I want to get into the journey as an organization, uh what is a kind of Madhu, what's the kind of uh timeline that I should prepare myself for?
• 41:55
  SPEAKER_02: Say, is it a three-month effort, is it a six-month effort?
• 41:58
  SPEAKER_02: Because when do you think uh in uh you know, I'm not I'm not asking you to you know uh make a guess, but assuming that you know we are going to be ready in a year's time or a uh you know 12 months time or an 18 months time for this to actually become a uh you know come into practice as an organization, how long does it take for me to do the steps that you were talking about?
• 42:21
  SPEAKER_02: And uh who are the stakeholders that the organization should bring together to get this into some shape?
• 42:29
  SPEAKER_05: The timeline for implementing all of this is going to mainly depend on how prepared you are for uh learning, I mean, for complying with this.
• 42:40
  SPEAKER_05: Let's take the example of somebody already knowing to drive a car.
• 42:44
  SPEAKER_05: To drive a different car is going to take a lesser amount of time, but to learn from scratch is going to because maybe the controls are a little different, the uh headlight is on the left and not the right, and very simple changes like so.
• 42:55
  SPEAKER_05: Similarly, if you had been compliant with any data protection law of a different country, it's going to be a little simpler because this data mapping that we were speaking of could have already been done.
• 43:06
  SPEAKER_05: Certain procedures would have been already implemented.
• 43:08
  SPEAKER_05: If the company had an ISO 27001 or 27701, certain preliminary measures would have been already covered.
• 43:15
  SPEAKER_05: But if we were to start afresh, then that's going to take some amount of time.
• 43:20
  SPEAKER_05: The timelines will totally depend upon uh the uh scale of operations of a business, the amount of data they process and the kind of controls that they already have in place.
• 43:32
  SPEAKER_02: So if I were to if I were to break it down and then say uh for the you know the for the benefit of the audience, if I were to say I'm a fairly immature business to a mature business to a you know mid you know mid scale mature business.
• 43:48
  SPEAKER_02: If I were to look at it, because in India you get even get a you know probably a uh you know a 20 million, 50 million dollar company which could be not digitally mature, right?
• 44:00
  SPEAKER_02: So, therefore, given that as an extent, uh, if you say I want to engage a law firm, a set of IT uh professionals, all of you coming together to do the data mapping exercise, typically, uh, you know, would you say, you know, give yourself about uh if I'm immature in terms of digital maturity and where my data is, not in terms of the business that you are doing.
• 44:23
  SPEAKER_02: Okay.
• 44:24
  SPEAKER_02: Uh would you say give yourself uh six months, nine months?
• 44:28
  SPEAKER_02: Because anyway, ISO 27001, like what Bharat was saying, was a six to nine month exercise, right?
• 44:33
  SPEAKER_02: So, therefore, that's the kind of timeline you are saying.
• 44:36
  SPEAKER_02: Start to prepare now rather than sprint in the last minute.
• 44:40
  SPEAKER_02: That's what you are saying, right?
• 44:41
  SPEAKER_05: That's that's definitely true because if we were to wait for the government to give the deadlines, we'd all be rushing up towards compliance, and that's gonna create a lot of bottleneck because um the law in operation is going to do a lot with how the practices and the uh methods in which the companies are going to implement it.
• 45:01
  SPEAKER_05: There's a large amount of time that we'll have to spend in understanding the data that we process.
• 45:05
  SPEAKER_05: There's a substantial amount of time that we'll have to spend in training the concerned individuals, training our employees on what to do and what not to do.
• 45:13
  SPEAKER_05: And uh, we have to give this time when we when we start ahead, we also stay ahead of the curve and we know, and it's not going to cause much chaos or uh it's not going to impact the business running when the compliance deadline comes into play.
• 45:28
  SPEAKER_05: We can focus on it on a slow and steady manner, and that's the reason we are emphasizing on companies moving towards compliance uh on the go.
• 45:36
  SPEAKER_05: And we also know that now the act has come in, the rules are the more um procedural aspects are yet to come in.
• 45:46
  SPEAKER_05: This also gives us a space to set the foundation right so that we can in future build on it.
• 45:51
  SPEAKER_02: Okay, and uh and from your experience, uh what are the kind of challenges you are seeing for uh companies which are you know walking this path today?
• 45:59
  SPEAKER_02: I'm sure you're working with, I know I know you guys work with a lot of startups, with a lot of companies.
• 46:04
  SPEAKER_02: So, typically, what kind of challenges are you seeing, and uh, you know, uh how do you how do I overcome these challenges?
• 46:11
  SPEAKER_02: If you were to give me a broad perspective of how uh they how do you see the challenges and how do they uh what what do you recommend as overcoming the challenges?
• 46:22
  SPEAKER_00: So a variety of them.
• 46:24
  SPEAKER_00: I will uh obviously let uh Madhu also chip in.
• 46:28
  SPEAKER_00: Um for example, if I'm a fintech company or if I'm a travel company, let's take a travel company.
• 46:35
  SPEAKER_00: I did uh I won't take names, but we are advising them right now.
• 46:40
  SPEAKER_00: Now they want to create their own mobile app so that clients can so they have a fleet of 500-600 cars and they want the clients to come and book where they have to be picked.
• 46:55
  SPEAKER_00: So they they help with the large um corporations uh who have multiple uh locations, multiple officers.
• 47:06
  SPEAKER_00: So they have a centralized way of booking cars.
• 47:09
  SPEAKER_00: And the same car company has to speak to Google Maps, has to collect data from the company and their officer who has to be picked up, so they know the officer's uh mobile number, whether it's a he or a she, uh, their address and their drop address.
• 47:29
  SPEAKER_00: So some parts of this is personal data, the home address or probably the drop address.
• 47:37
  SPEAKER_00: So they are not a software company, they have outsourced the creation of the software to a third party who's running the comp the software for them and maintaining it as well for them.
• 47:55
  SPEAKER_00: So if you look at the flow of data, the data goes from the individual, it's always from the individual.
• 48:02
  SPEAKER_00: Personal data means data is owned by an individual because it belongs to or it relates to an individual.
• 48:11
  SPEAKER_00: From the individual, it'll go to the company, say Kriya law.
• 48:14
  SPEAKER_00: Kriya law knows that Bharat has to go to the airport at 5 a.m.
• 48:19
  SPEAKER_00: to catch a 7 a.m.
• 48:20
  SPEAKER_00: flight.
• 48:21
  SPEAKER_00: So Kriya law will tell that company, please go and pick up Bharat from such and such a place and drop them at such and such a place.
• 48:29
  SPEAKER_00: So from individual to my company, from my company to the travel company, travel company to the software company which is running the travel company's software platform.
• 48:42
  SPEAKER_00: And for all, you know, that software company might have their data servers located in Australia, maintained by an Australian company.
• 48:52
  SPEAKER_00: So I'm just giving you in a matter of 15 minutes, eight persons have already touched your data without you knowing where it has gone, where how it is gone.
• 49:03
  SPEAKER_00: Um to summarize it, the to the the whether you are a travel company or a food company or a departmental store or a doctor who's who's looking at uh who's who's building their own softwares for meeting clients like this, and there are third-party software which are giving doctors and patient video interactions, and the data is inputted through the doctor appointment software, you know, like a company like Practo, whoever it is.
• 49:38
  SPEAKER_00: So every person, whether you are a doctor, fintech company, travel company, departmental store, food store, restaurant, everyone needs to understand that they are collecting data, whether they like it or not.
• 49:52
  SPEAKER_00: Or even my newspaper person has a WhatsApp business account and he sends me WhatsApp business account generated invoices for 800 bucks for the three newspapers I generate.
• 50:04
  SPEAKER_00: So, long story short, uh, everyone is going to be uh affected, everyone needs to know about data.
• 50:11
  SPEAKER_00: How we want to do it is we need to start at home.
• 50:15
  SPEAKER_00: So I'm sorry, uh Madhura, I just wanted to give a context over it uh before you want to answer his actual question.
• 50:22
  SPEAKER_02: I think I think the context setting is brilliant, uh Barat, because I think the context setting, if I were an audience listening to this, it just tells me the the depth that I need to get in.
• 50:34
  SPEAKER_02: It tells me how I need to do, therefore, you know, the traditional methods of how I did store my data, how I did it, how I did my marketing, how I process my insurance, how I process my uh, you know, uh admin, everything is going to change because you can actually complain to the data protection board.
• 50:54
  SPEAKER_02: Uh, is something that I'm I'm seeing, right?
• 50:57
  SPEAKER_02: So, therefore, can you just walk us through uh, you know, I believe there's going to be a data protection board, and uh, you know, like Herrera, you could actually go there and say, hey, these guys are reached out to me without my consent, and that's really where the litigations or the complaints will start, right?
• 51:13
  SPEAKER_02: That's the way Malu is going to work, right?
• 51:16
  SPEAKER_05: Precisely, and that's going to bring that's uh that's the reason I guess we all of us are speaking about this data protection law because uh we know that there's going to be a board that is going to listen to complaints, that is what was not there earlier.
• 51:29
  SPEAKER_05: We also had many data protection related obligations under the earlier Information Technology Act and the rules made under the act, but now we have a concrete system that would hear and listen to complaints from individuals, and that is another aspect that's making this law a lot more serious.
• 51:46
  SPEAKER_05: Now, uh, one of the main challenges that the um companies might face is first, let's look at a little into the prime obligation of the law.
• 51:59
  SPEAKER_05: The law says that you have to collect consent and provide a notice to individuals in English and all the 28 official languages.
• 52:09
  SPEAKER_05: That's that's gonna be a sad trouble itself.
• 52:12
  SPEAKER_05: But still, there should be a notice, and this notice should say what data you're handling, who is it that you're sharing with, and what are the purposes that you're using it for.
• 52:21
  SPEAKER_05: To say what you're doing, you should first know what you're doing, and this that's where the entire data mapping processes come in.
• 52:28
  SPEAKER_05: To identify that is going to be the first challenge because currently most of our uh organizations or entities in India are not mature or organized in terms of their data handling practices, and now they'd have to sit together and understand what different teams are doing, and can come off as a shock to most managements on what different teams are doing with the data.
• 52:49
  SPEAKER_05: So that knowing the data and this entire work is going to be the first challenge.
• 52:54
  SPEAKER_05: The second challenge is that internally in each of the organizations, there should be employees or departments or mechanisms in place that is going to address grievances before the grievance can go to the data protection board.
• 53:08
  SPEAKER_01: Okay.
• 53:09
  SPEAKER_05: So if I have a trouble with any company processing my data, say, for example, we all have uh banks or agents of banks or however they want to call it, uh, call us up and ask if we want personal loans because it's something that we all of us face in common and nobody remembers where we where they got our data from, or nobody has a track of it.
• 53:27
  SPEAKER_05: So if I were to inform a bank about not processing my data, don't call me back.
• 53:33
  SPEAKER_05: Now uh I don't remember a case where we have stopped receiving calls.
• 53:39
  SPEAKER_01: Exactly.
• 53:40
  SPEAKER_05: We still do.
• 53:41
  SPEAKER_05: Now, this is going to be a problem because one of the obligations under the act is that when consent is revoked or consent is withdrawn, that data must be erased and it should be pro stopped, the processing must be stopped.
• 53:55
  SPEAKER_05: You should not handle the data henceforth unless there's a necessity to retain the data.
• 53:59
  SPEAKER_01: Exactly.
• 53:59
  SPEAKER_05: Now there should be people in the organization who are going to listen to these complaints and resolve them.
• 54:05
  SPEAKER_05: Or if I want to change my phone number or an email ID, if people have switched from organizations to different organizations and they want do not want to be communicated in the previous uh channels of communication, phone number or email ID or whatsoever.
• 54:18
  SPEAKER_05: Um, all these grievances should be redress at the company level because the law says an individual should first go and approach the data fiduciary, the company or the entity, and only then can they go and approach the board.
• 54:31
  SPEAKER_05: So the individuals are not going to directly walk into the board, it's going to come to the company first, and the company is also given a chance to address the grievance.
• 54:39
  SPEAKER_05: But what if we have an email and we don't know how exactly to do?
• 54:43
  SPEAKER_05: Or what if there is a complaint that is being received and uh individuals are not acting upon it, I mean the employees are not acting upon it.
• 54:50
  SPEAKER_05: There should be set processes to hear grievances, and people within the organization or externally engaged individuals must be uh utilized to handle the grievance addresses because with the act and with the awareness that people in general have, before we didn't know that we can withdraw consent, now we know.
• 55:10
  SPEAKER_05: And there's going to be a large amount of people making requests, there should be proper processes within organizations to handle them as well.
• 55:18
  SPEAKER_05: Um, it can also be externally outsourced to uh privacy professionals, law firms, or however information security professionals who are dealing with it.
• 55:26
  SPEAKER_05: But they should be addressed because when you're given a chance to do that, you should do that, and if that is being negligently handled, when it goes back to the data protection board, that might be taken seriously.
• 55:37
  SPEAKER_05: So that's one challenge that companies might face to set up internal uh you know mechanisms or departments and personals to analyze that.
• 55:46
  SPEAKER_05: And uh the other challenge is going to be earlier um when we had the information security uh information technology, um, sensitive personal data rules, there were larger amount of obligations for sensitive personal data and personal data in general, which can even mean my phone number and my name just as such.
• 56:07
  SPEAKER_05: And um, in such cases, now earlier sensitive personal data had different obligations, and personal data had different obligations.
• 56:15
  SPEAKER_05: Few other global uh acts like GDPR also say act in the same manner, but um in this law, in the current law, all the there is just uh definition of personal data, and all obligations are on personal data.
• 56:29
  SPEAKER_05: So even names tone numbers should be protected in the same way our biometric should be protected, meaning there shouldn't be no uh leak of information and it should be only processed by authorized persons and uh all the other obligations apply to oral data on a very similar model.
• 56:45
  SPEAKER_05: For us, too, again, going back to my personal to understand this and implement this is going to be the main challenge.
• 56:52
  SPEAKER_05: And the third challenge is that currently we just have the act, the rules are yet to come.
• 56:57
  SPEAKER_05: So, the act uh to give you an example, the act says that we'll have to notify uh the board, the data protection board and the individuals in case of a data leak or a data breach.
• 57:09
  SPEAKER_05: But what timeline should we notify in?
• 57:12
  SPEAKER_05: What are the um what is the manner in which such notification has to be provided?
• 57:17
  SPEAKER_05: All these procedural aspects have to come out in the rules, and only then companies will know to uh what has to be done.
• 57:23
  SPEAKER_05: So now we are setting up the foundation and there is an entire building that has to come up after.
• 57:29
  SPEAKER_05: So that can be um I can say that's a little, you know, that's uh that's um not a challenge per se, but there's another aspect that companies should be aware of.
• 57:40
  SPEAKER_02: Fantastic.
• 57:41
  SPEAKER_02: So uh so I have a couple of uh you know uh follow-up questions on this, but uh uh there are lots of places where uh you know uh I won't name the companies, my data is already with them.
• 57:53
  SPEAKER_02: Okay, so how do I prepare for uh you know, normally the uh what I've read is uh sometimes these laws actually help the big firms and not the small firms, right?
• 58:08
  SPEAKER_02: Because uh the small firms don't have the budget to uh manage this kind of uh complex systems that they need to put in place.
• 58:17
  SPEAKER_02: So, do you believe as uh uh you know as professionals uh that uh it is protecting the uh what I call as the data police or uh like a monopoly, I call them data police, right?
• 58:31
  SPEAKER_02: So, or does it uh you know really help the MSMEs or the small companies because the small companies, as Bharat said, I can't afford 15-20 lakhs to do these kinds of things.
• 58:43
  SPEAKER_02: So, so where do you think this is going to hit?
• 58:46
  SPEAKER_02: Because to me, that is going to be the biggest challenge that I see.
• 58:50
  SPEAKER_02: I'm now talking some general things, but it's important for uh us to understand that you know how it will impact at the uh you know at the grassroot level, right?
• 59:03
  SPEAKER_00: So uh, Swami, let me again go back in history, right?
• 59:08
  SPEAKER_00: Uh if you were the same MSME 10 years back, 15 years back, when we didn't have digital information, uh we used to have something called yellow pages, and and they were like fat big books, and there were companies.
• 59:24
  SPEAKER_00: I mean, that was a brand of Get It.
• 59:26
  SPEAKER_00: I mean, get it will be a company which will collect information, there will be uh telephone directories, uh, and you know how traditional marketing used to be done.
• 59:37
  SPEAKER_00: You you you will take the address from telephone directories and send mass mailers, and there were tradition, I mean a phenomenal company called Otto Burlington.
• 59:46
  SPEAKER_00: I do not know whether you remember them.
• 59:48
  SPEAKER_00: Of course.
• 59:49
  SPEAKER_00: Yeah, they won't send you the products, but they will only send you a pamphlet.
• 59:53
  SPEAKER_01: Correct.
• 59:53
  SPEAKER_00: Right?
• 59:54
  SPEAKER_00: Yeah, and and then you you use the same pamphlet, you will take what you want, you mail them back, which is prepaid, and then they will send you the products if you send the money and cash on delivery used to be there through the post.
• 1:00:08
  SPEAKER_00: So they did survive.
• 1:00:11
  SPEAKER_00: So marketing was always there before the digital era.
• 1:00:15
  SPEAKER_00: If you want faster communication, if you want to use data to make yourself uh relevant, of course, the larger company will have deeper budgets, larger teams, geographical spread, which will make them embrace law faster.
• 1:00:34
  SPEAKER_00: But once a law has come, there is no turning back and saying I am small, I am medium, I am uh micro, uh, I I it's unfair.
• 1:00:46
  SPEAKER_00: It doesn't work that way.
• 1:00:48
  SPEAKER_00: Uh if you want to use a third party's data, I mean it's not that generic data cannot be used, it's it's personal data which you cannot use.
• 1:00:58
  SPEAKER_00: So let's understand that.
• 1:01:00
  SPEAKER_00: So you can outsource this to a person and say, I do not know what to do.
• 1:01:06
  SPEAKER_00: I want to, so it's it's gonna be targeted.
• 1:01:10
  SPEAKER_00: So half an hour back, I was mentioning how you will not be hitting uh in unknown targets.
• 1:01:17
  SPEAKER_00: Uh earlier on, uh I think data protection is gonna be making life easier and your marketing budgets must much lesser.
• 1:01:29
  SPEAKER_00: So you know who is willing, who is consented, who is open to receiving your information rather than spending unknown amount of money to unknown persons, whether they are consented, interested or not, and still making one or two large social media companies take all your money for every click they have money from you.
• 1:01:57
  SPEAKER_00: We know who we are speaking about.
• 1:01:59
  SPEAKER_00: Yeah, right.
• 1:02:00
  SPEAKER_00: Instead, if the three of us are talking about or interested in data protection information, and there is a company selling a book on data protection, and the company will go out and say, Please find out five persons from Bombay and Chennai who are interested in buying books and who have consented for us to be targeted, then that mail will be sent only to consented targeted five individuals rather than 5,000 individuals who are uninterested.
• 1:02:38
  SPEAKER_00: So I think it is not going to be initially to understand it would be difficult.
• 1:02:46
  SPEAKER_00: Uh at the end of the day, uh, a person who is selling Narial Pani coconut at the end of our road who's got a uh a GPA or a Google Pay or a UPI, uh, he understands how it works.
• 1:03:01
  SPEAKER_00: Uh, it will be simplified.
• 1:03:03
  SPEAKER_00: It will be simplified, and there's gonna be a leapfrog in in privacy embracement in India.
• 1:03:09
  SPEAKER_00: And it will be, and there would be disruptors who will come and simplify it for us.
• 1:03:14
  SPEAKER_00: Uh and and and uh that that's gonna change India into a 5.0 country where uh I think that is the next level of growth uh where unwanted spend and splurge on marketing will be behind us.
• 1:03:31
  SPEAKER_00: Uh that's my take on it.
• 1:03:33
  SPEAKER_00: Uh only time will say what it is.
• 1:03:35
  SPEAKER_00: Uh Madhura, uh, you have anything to add on how the small ones would be able to comply?
• 1:03:41
  SPEAKER_05: That's uh first to say that was a wonderful uh uh way of putting it because most companies fear that it's going to affect their marketing and you know affect their business, but it's it's actually a blessing in disguise, if I can say it that put it that way.
• 1:03:57
  SPEAKER_05: So and um speaking of how Sonak affects or uh impact smaller businesses, we should appreciate how this law has been structured in a manner that's very simple.
• 1:04:08
  SPEAKER_05: So if we look at, you know, if when we are speaking of GDPR, if we look at GDPR, the requirements that a GDPR is not as simple as the law is.
• 1:04:16
  SPEAKER_05: So um the guy even the government has taken the efforts to understand the how how it's going to be because India is a is a large population and um with a different large population, not just in mean terms of persons, but also in terms of businesses and smaller businesses.
• 1:04:34
  SPEAKER_05: So that is being very well taken into account in the drafting of the act, and it's it's put up in a manner that it's um if we are doing things the way it is expected to be done, we are after compiled with the act.
• 1:04:47
  SPEAKER_02: Fantastic.
• 1:04:48
  SPEAKER_02: So on that note, uh Bharat, what would be your advice uh to companies?
• 1:04:54
  SPEAKER_02: Uh, I think you really uh you know you summarized it beautifully in the uh you know, in the earlier uh you know, uh thing that you were talking about, where what you said really is it's going to leapfrog the way we uh you know the way we look at data, the way we'll uh you know, uh I think time will say, but probably will leapfrog many economies, is what you were saying.
• 1:05:14
  SPEAKER_02: So, what would be your advice to companies saying what are the five or you know one or two steps that they need to take?
• 1:05:21
  SPEAKER_02: And that way I think uh it'll just become a process that they need to follow.
• 1:05:27
  SPEAKER_02: So, what would be your advice?
• 1:05:30
  SPEAKER_00: First advice let's not procrastinate it.
• 1:05:33
  SPEAKER_00: Let's see uh what we have and uh where we have it and what do we do with it.
• 1:05:40
  SPEAKER_00: And I say it it's about data, it's about personal data.
• 1:05:44
  SPEAKER_00: So it's time that we as responsible citizens, uh law abiding uh companies, corporations, entities, we are sitting on someone else's valuable uh information.
• 1:06:00
  SPEAKER_00: We are uh it's like I I am taking your car and putting it at home, and uh uh I'm responsible for it.
• 1:06:11
  SPEAKER_00: That's why it's called a fiduciary in under the act.
• 1:06:14
  SPEAKER_00: So if you are a fiduciary and I have something of yours which I am supposed to protect and process properly, I need to know what I have of yours and where have I kept it.
• 1:06:28
  SPEAKER_00: It's like uh uh Swami has given me his property documents and said I'm going out on a tour, please take care of it.
• 1:06:36
  SPEAKER_00: I am a fiduciary, I am supposed to take care of it.
• 1:06:40
  SPEAKER_00: I mean, I don't own it, but I need to take care of it.
• 1:06:43
  SPEAKER_00: So I would possibly put it in a bank locker or my uh fireproof safe at home.
• 1:06:49
  SPEAKER_00: I do something about it.
• 1:06:52
  SPEAKER_00: When you come back and ask after the trip, I need to retrieve it and give it to you and not give it off to a third person.
• 1:06:59
  SPEAKER_00: So it's as simple as that.
• 1:07:01
  SPEAKER_00: So to start with, we need to look into our own cupboards and see what data we have, what part of that data is personal to someone?
• 1:07:15
  SPEAKER_00: Do I have a digital copy of such personal data?
• 1:07:20
  SPEAKER_00: Where do I save it?
• 1:07:22
  SPEAKER_00: How do I save it?
• 1:07:24
  SPEAKER_00: Where do I use it?
• 1:07:26
  SPEAKER_00: What purpose, most importantly, do I have a consent from that person to use the data I use it for?
• 1:07:37
  SPEAKER_00: If these four or five elements, what, where, how, why, of the personal data of third parties, it's a start.
• 1:07:49
  SPEAKER_00: It's a start to know what we are holding on so that we know what to do with it.
• 1:07:57
  SPEAKER_00: So the first step would be an audit or an uh internal check introspection mechanism, and then to look at the law as to where do I fit in?
• 1:08:08
  SPEAKER_00: Am I a fiduciary?
• 1:08:11
  SPEAKER_00: Am I a processor?
• 1:08:13
  SPEAKER_00: Am I uh a super fiduciary?
• 1:08:15
  SPEAKER_00: What is the word?
• 1:08:17
  SPEAKER_00: Significant data fiduciary, um, so on and so forth.
• 1:08:21
  SPEAKER_00: So uh let's start by looking in our own drawers and cupboards, what data we have, uh, and and then uh call out uh or find out which slot of the statute we fit in.
• 1:08:38
  SPEAKER_02: Thanks.
• 1:08:38
  SPEAKER_02: On that note, uh Bharat, it was a lovely conversation, extremely enriching in terms of how this act has been configured, uh, you know, done.
• 1:08:49
  SPEAKER_02: Uh thanks, Madhu, for some brilliant explanation on the components, very, very clear direction that you gave in terms of the need for data mapping access.
• 1:08:59
  SPEAKER_02: And Bharat, thanks for your explanation on making it simple and easy for business to take to take the first step.
• 1:09:06
  SPEAKER_02: Thanks a lot.
• 1:09:07
  SPEAKER_02: Lovely talking to both of you.
• 1:09:10
  SPEAKER_00: Absolute pleasure and honor joining you.
• 1:09:12
  SPEAKER_00: Yeah, uh and yeah.
• 1:09:14
  SPEAKER_05: It was wonderful um experience for us as well to discuss on all of these aspects.
• 1:09:19
  SPEAKER_05: And now, before we conclude, I just want to recall a fact that two years ago, when a very famous instant messaging tool that all of us use changed its privacy policy.
• 1:09:30
  SPEAKER_05: And uh India was one that there was a litigation as well, because uh that is going to mean that the instant messaging tool that we on an everyday basis use is going to process the data for purposes that we might not have authorized to do.
• 1:09:44
  SPEAKER_05: And uh when India understood that there was a law in this the policy that was applicable in India was not the same policy that was applicable in EU because EU had a law protecting its people's personal data, but India didn't have a law, but now today we have one, and this is a great leap towards how uh how we take our stance when it comes to personal data as a nation.
• 1:10:05
  SPEAKER_02: Fantastic.
• 1:10:06
  SPEAKER_02: Thanks, Madhu.
• 1:10:07
  SPEAKER_02: On that note, thanks a ton for your time and uh thanks for uh really enlightening us on what's going to come and how businesses and of course we as uh you know consumers and customers need to be prepared for this law.
• 1:10:22
  SPEAKER_02: Thanks a lot.
• 1:10:28
  SPEAKER_02: Thanks for listening to this episode.
• 1:10:30
  SPEAKER_02: For selected links and detailed show notes, visit www.contramines.com slash blog.
• 1:10:38
  SPEAKER_02: Follow contraminds on social media and let us know who you would like to see next on the podcast.
• 1:10:44
  SPEAKER_02: If you're listening to Contramines on Apple Podcasts, do share your comments and give us a rating.
• 1:10:50
  SPEAKER_02: We are keen to know what you're thinking.
• 1:10:52
  SPEAKER_02: Contramines is also on YouTube.
• 1:10:55
  SPEAKER_02: If you are listening to the podcast on YouTube, hit the subscribe button and stay up to date on all our releases.
• 1:11:02
  SPEAKER_02: Thanks for listening and stay safe.