What Does India’s Proposed Data Privacy Bill Mean For Startups?

India, the world’s fastest-growing market for new internet users, has seen an explosion of personal data.  Millions of new users have begun to use free and paid data storage sites. 

The Personal Data Protection Bill, 2019, also known as the data privacy bill, was designed to play a critical role in protecting the data of millions of users.  The bill grants the individual, known as a data principal, certain rights. Data fiduciaries, or companies that collect and process personal data, can only do so with the data principal’s permission. 

However, the data can be processed without permission in certain circumstances, such as when the state requests it. This idea has been challenged as supporting governmental surveillance.

Impact Of Withdrawal

The Indian Supreme Court has declared data privacy to be a fundamental right of every citizen. The lack of a governing law has created a massive legal vacuum to protect user privacy. For now, the withdrawal can be viewed as a boost to the startup sector, as compliance for startups would have become significantly more difficult had the bill been passed into law.

Companies should exercise greater caution when designing software infrastructure around user data, as the government is currently working on a new bill. Data localisation may become a barrier to cross-border digital trade and market access, particularly for smaller firms.

What’s Next?

Companies will need to relocate their data processing infrastructure to India, as this is a possible clause in the new bill. To deal with localisation laws, a simpler solution would be to relocate on-premises systems in foreign countries to localised cloud data centres.

Considerable changes need to be made in existing processes involving user data to make provisions for sharing/deleting the user data based on requests from the users/government agencies.

The bill’s review committee has also proposed bringing non-personal data under the purview of the law.  Companies must consider this when developing software/processes based on user data.

How Will It Impact The B2B IT Market?

The rollback benefits the B2B IT market because it allows them to continue operating in the existing infrastructure without making any changes.

It would be a temporary setback for companies that are already in the process of making infrastructure changes to comply with the Privacy Bill. However, they will be in a better position to adapt if the new regulations proposed by the government are along the same lines as the previous bill.

Expectations From The New Privacy Law 

By proposing a single law to govern personal and non-personal data, the committee indicated that the data frameworks would provide innovative ideas and aim to create a seamless flow of data and insights across public and private stakeholders.

It will be a comprehensive legal framework. It is likely to be more severe, similar to China’s data privacy law, and unlike Europe’s general data protection regulation, which holds people to be the owners of their names, email addresses, locations, ethnicity, gender, and so on. Instead of taking that approach, India risks giving the government an advantage over individuals and private-sector data collectors.

The committee has proposed removing the “significant harm” threshold and instituting a 72-hour notification deadline for data principals in the event of a breach.  It suggested that all social media platforms that do not act as intermediaries be treated as publishers and held liable for the content they host. 

Will The Law Define Strict Restrictions Or Ease Current Limits?  

The new laws may tighten a few regulations to increase accountability among various stakeholders who handle user data.

As we are a growing economy, we can expect the new laws to make some concessions to the statutes to boost companies that are in high revenue generating sectors or ailing sectors that the government is looking to expand.

Users will continue to be at the centre of the new laws, and they will have more say over how and who handles their data.

What Does This Mean For The Consumers?

Consumers will have more control over how different stakeholders use their data if both personal and non-personal data are brought under the purview of the law.

Some companies’ free services may become payable, as companies may begin charging a minimum fee to compensate for the costs incurred in complying with the newer laws. Some of the data-intensive services may be discontinued altogether. 

India’s Data Privacy Literacy Gap

According to an OpenText survey, 84% of consumers would pay more to do business with a company that is committed to data security.

In the past, there have been multiple data breaches in which millions of records containing personal information were available for purchase on the dark web. These incidents have raised serious concerns among government agencies and users about data security and privacy. 

Although India has a sizable educated population, digital literacy is still limited and has a long way to go. The government, citizen collectives, NGOs, and others are working hard to raise awareness among Indians about the importance of data privacy and the steps they should take to ensure data safety. Based on these efforts, it is safe to predict that the number of digitally aware citizens concerned about data privacy will grow in the future.

Note: We at Inc42 take our ethics very seriously. More information about it can be found here.