GDPR: What it means for Indian businesses

Terms of use

Terms of Use

The use of this site and the content contained therein is governed by the Terms of Use. When you use this site you acknowledge that you have read the Terms of Use and that you accept and will be bound by the terms hereof and such terms as may be modified from time to time.

All text, graphics, audio, design and other works on the site are the copyrighted works of nasscom unless otherwise indicated. All rights reserved.
Content on the site is for personal use only and may be downloaded provided the material is kept intact and there is no violation of the copyrights, trademarks, and other proprietary rights. Any alteration of the material or use of the material contained in the site for any other purpose is a violation of the copyright of nasscom and / or its affiliates or associates or of its third-party information providers. This material cannot be copied, reproduced, republished, uploaded, posted, transmitted or distributed in any way for non-personal use without obtaining the prior permission from nasscom.
The nasscom Members login is for the reference of only registered nasscom Member Companies.
nasscom reserves the right to modify the terms of use of any service without any liability. nasscom reserves the right to take all measures necessary to prevent access to any service or termination of service if the terms of use are not complied with or are contravened or there is any violation of copyright, trademark or other proprietary right.
From time to time nasscom may supplement these terms of use with additional terms pertaining to specific content (additional terms). Such additional terms are hereby incorporated by reference into these Terms of Use.

Disclaimer

The Company information provided on the nasscom web site is as per data collected by companies. nasscom is not liable on the authenticity of such data.
nasscom has exercised due diligence in checking the correctness and authenticity of the information contained in the site, but nasscom or any of its affiliates or associates or employees shall not be in any way responsible for any loss or damage that may arise to any person from any inadvertent error in the information contained in this site. The information from or through this site is provided "as is" and all warranties express or implied of any kind, regarding any matter pertaining to any service or channel, including without limitation the implied warranties of merchantability, fitness for a particular purpose, and non-infringement are disclaimed. nasscom and its affiliates and associates shall not be liable, at any time, for any failure of performance, error, omission, interruption, deletion, defect, delay in operation or transmission, computer virus, communications line failure, theft or destruction or unauthorised access to, alteration of, or use of information contained on the site. No representations, warranties or guarantees whatsoever are made as to the accuracy, adequacy, reliability, completeness, suitability or applicability of the information to a particular situation.
nasscom or its affiliates or associates or its employees do not provide any judgments or warranty in respect of the authenticity or correctness of the content of other services or sites to which links are provided. A link to another service or site is not an endorsement of any products or services on such site or the site.
The content provided is for information purposes alone and does not substitute for specific advice whether investment, legal, taxation or otherwise. nasscom disclaims all liability for damages caused by use of content on the site.
All responsibility and liability for any damages caused by downloading of any data is disclaimed.
nasscom reserves the right to modify, suspend / cancel, or discontinue any or all sections, or service at any time without notice.

For any grievances under the Information Technology Act 2000, please get in touch with Grievance Officer, Mr. Anirban Mandal at data-query@nasscom.in.

New

See all

No notification found.

GDPR: What it means for Indian businesses

dionpwc

@dionpwc

May 17, 2018

Public Policy

428

By: Sivarama Krishnan, Leader, Cyber Security, PwC India

The size of the IT industry in the top two EU member states—that is, Germany and France—is estimated to be around 155–220 billion USD.¹ For the Indian IT industry to continue to do business in Europe, it needs to comply with the GDPR. In the event of non-compliance on the part of Indian companies, the GDPR imposes a penalty of 20 million EUR or 4% of a company’s global turnover.

Read more about what organisations need to do in order to comply with the GDPR here.

Immediate next steps for Indian companies
Indian companies need to carefully look at the requirements for GDPR compliance. They need to:

Develop/update privacy policies, procedures and compliance programmes.
Conduct data privacy trainings for all employees.
Conduct data discovery exercises and maintain documentation in order to demonstrate visibility of the personally identifiable information (PII) processed.
Document legal basis for processing, communicating privacy notices and recording consent (where applicable).
Establish processes to:

Manage data subject requests.
Enable data breach notification.
Perform data protection impact assessments (DPIAs) for high-risk processing activities.
Embed privacy by design requirements into existing/new processes, solutions and technologies processing PII.

Update vendor governance programmes to include security and privacy due diligence, review/update contracts with GDPR obligations and establish a process around periodic compliance monitoring.

In addition to the above, organisations should focus on updating existing/deploying new technologies to help address key areas and challenges. Some of the leading practices include:

Investing in systems to carry out data discovery exercises to determine what/how/where PII (specifically unstructured data—i.e. PII stored on local workstations, emails, file servers, etc.) is handled within the organisation.
Evaluating tools to address challenges around data subject requests, data retention and disposal, cross-border data transfers, consent management, etc.
Implementing adequate identity and access management (IdAM) solutions, extending coverage of encryption solutions, reviewing and updating configurations of data loss prevention (DLP), security information and event management (SIEM), etc.
Deploying/updating centralised incident and breach management solutions to quickly detect/ prevent security incidents and address data breach notification requirements.
Implementing anonymisation and psuedonymisation techniques in applications to better control data processing activities.

To conclude, the regulation and its enforcement may appear to be daunting to many organisations. There is also a cultural change in the way organisations are starting to handle personal data and provide services to their customers. Current developments and changes being proposed in our privacy landscape, coupled with strong technical capabilities, provide great opportunities for Indian companies to align their services and data handling processes to global standards and become market differentiators in the arena of data privacy and protection.

Footnotes

1. http://www.cioandleader.com/article/2017/05/02/india-gets-ready-eu%E2%80%99s-new-data-regime

Disclaimer

That the contents of third-party articles/blogs published here on the website, and the interpretation of all information in the article/blogs such as data, maps, numbers, opinions etc. displayed in the article/blogs and views or the opinions expressed within the content are solely of the author's; and do not reflect the opinions and beliefs of NASSCOM or its affiliates in any manner. NASSCOM does not take any liability w.r.t. content in any manner and will not be liable in any manner whatsoever for any kind of liability arising out of any act, error or omission. The contents of third-party article/blogs published, are provided solely as convenience; and the presence of these articles/blogs should not, under any circumstances, be considered as an endorsement of the contents by NASSCOM in any manner; and if you chose to access these articles/blogs , you do so at your own risk.

dionpwc

Comment

Just wanted to add one point for the benefit of blog audience - GDPR is critical, not just for Indian businesses doing business in Europe but also for Indian businesses offering their services as third-party vendors to European companies. Indian vendors stand to lose business with European companies if they are not GDPR compliant as it would mean that European companies are liable for their actions.

Call for Inputs: SEBI's consul...

Swapnil