General Data Protection Regulation (GDPR) – Final text neatly arranged | nasscom | The Official Community of Indian IT Industry

Terms of use

Terms of Use

The use of this site and the content contained therein is governed by the Terms of Use. When you use this site you acknowledge that you have read the Terms of Use and that you accept and will be bound by the terms hereof and such terms as may be modified from time to time.

All text, graphics, audio, design and other works on the site are the copyrighted works of nasscom unless otherwise indicated. All rights reserved.
Content on the site is for personal use only and may be downloaded provided the material is kept intact and there is no violation of the copyrights, trademarks, and other proprietary rights. Any alteration of the material or use of the material contained in the site for any other purpose is a violation of the copyright of nasscom and / or its affiliates or associates or of its third-party information providers. This material cannot be copied, reproduced, republished, uploaded, posted, transmitted or distributed in any way for non-personal use without obtaining the prior permission from nasscom.
The nasscom Members login is for the reference of only registered nasscom Member Companies.
nasscom reserves the right to modify the terms of use of any service without any liability. nasscom reserves the right to take all measures necessary to prevent access to any service or termination of service if the terms of use are not complied with or are contravened or there is any violation of copyright, trademark or other proprietary right.
From time to time nasscom may supplement these terms of use with additional terms pertaining to specific content (additional terms). Such additional terms are hereby incorporated by reference into these Terms of Use.

Disclaimer

The Company information provided on the nasscom web site is as per data collected by companies. nasscom is not liable on the authenticity of such data.
nasscom has exercised due diligence in checking the correctness and authenticity of the information contained in the site, but nasscom or any of its affiliates or associates or employees shall not be in any way responsible for any loss or damage that may arise to any person from any inadvertent error in the information contained in this site. The information from or through this site is provided "as is" and all warranties express or implied of any kind, regarding any matter pertaining to any service or channel, including without limitation the implied warranties of merchantability, fitness for a particular purpose, and non-infringement are disclaimed. nasscom and its affiliates and associates shall not be liable, at any time, for any failure of performance, error, omission, interruption, deletion, defect, delay in operation or transmission, computer virus, communications line failure, theft or destruction or unauthorised access to, alteration of, or use of information contained on the site. No representations, warranties or guarantees whatsoever are made as to the accuracy, adequacy, reliability, completeness, suitability or applicability of the information to a particular situation.
nasscom or its affiliates or associates or its employees do not provide any judgments or warranty in respect of the authenticity or correctness of the content of other services or sites to which links are provided. A link to another service or site is not an endorsement of any products or services on such site or the site.
The content provided is for information purposes alone and does not substitute for specific advice whether investment, legal, taxation or otherwise. nasscom disclaims all liability for damages caused by use of content on the site.
All responsibility and liability for any damages caused by downloading of any data is disclaimed.
nasscom reserves the right to modify, suspend / cancel, or discontinue any or all sections, or service at any time without notice.

For any grievances under the Information Technology Act 2000, please get in touch with Grievance Officer, Mr. Anirban Mandal at data-query@nasscom.in.

New

See all

No notification found.

General Data Protection Regulation (GDPR) – Final text neatly arranged

Rajiv Kumar

@rajiv.drish

May 23, 2018

Public Policy

1414

Here you can find the official PDF of the Regulation (EU) 2016/679 (General Data Protection Regulation) as a neatly arranged website. All Articles of the GDPR are linked with suitable recitals. The European Data Protection Regulation will be applicable as of May 25th, 2018 in all member states to harmonize data privacy laws across Europe. If you find the page useful, feel free to support us by sharing the project.

GDPR- Final Texts

General Data Protection Regulation(GDPR): What it means for India, and the World
India is going to strengthen and implement strongest General Data Protection Regulation which will cover all.

The European Union (EU) has taken the lead in amending its existing data protection laws through the introduction of the General Data Protection Regulation (GDPR) that comes into effect from 25 May, 2018. But what are the road map of this regulation and how will it impact India enterprises?

That data is increasingly driving economies around the globe is not an over statement. As businesses across the world uncover the right-fit big data and analytics strategies, data protection regulation is in the spotlight. The European Union (EU) has taken the lead in amending its existing data protection laws through the introduction of the General Data Protection Regulation (GDPR) that comes into effect from 25 May, 2018. So, what are the road map of this regulation and how will it impact India enterprises is the moot question.

What is GDPR?
Data helps businesses differentiate themselves and thus represents a competitive edge. But concerns have been growing over the way enterprises use consumer data for marketing, as current regulations do not offer any control to them. Thus, GDPR was born with more stringent and prescriptive compliance challenges, backed by fines of up to four per cent of a company’s annual global revenue. Other stringent rules include those pertaining to data breach reporting, appointment of mandatory Data Protection Officer, and citizens’ right to be forgotten in the digital realm among others.

How it impacts businesses
The GDPR will replace the 1995 Data Protection Directive and is aimed at protecting EU citizens’ personal data in the new digital world. The regulation covers all the EU member states and citizens, so all global enterprises with operations or customers in EU must comply. Businesses are already gearing up to this new data protection regime. A survey recently asked C-suite executives from large American MNCs about their GDPR compliance plans to which more than half of them said that this was their top data-protection priority. Some American businesses are also looking at ways to reduce their GDPR risk exposure or even withdrawing from the market. Another research by revealed that more than one-third of public web pages of FTSE 30 companies capturing personally identifiable information are in danger of violating the GDPR rules. Indian companies with operations in EU or dealing with EU citizens’ data will also have to comply with this regulation.

Takeaways for India
India is in a unique position as it embarks on a digital transformation journey of unprecedented magnitude through citizen biometric data platform of Aadhaar, e-governance initiative Digital India, fostering presence-less, paperless, and cashless service delivery through IndiaStack and digitization of citizens’ documents via DigiLocker. Aadhaar has strong data protection measures but as India moves towards digital at a scorching pace, ensuring comprehensive protection of data while also empowering citizens to leverage their own data will be paramount. For instance, enrollment for jobs or skilling initiatives based on the documents saved on the cloud platform of DigiLocker.

India’s demonetisation move was followed by the Union Budget for 2017, that outlines an ambitious goal of achieving 25 billion digital transactions in 2017-18 — which means the Government will need to ensure security and regulatory compliance of unprecedented number of websites and web applications offering digital transaction services. With the Goods and Services Tax or GST coming into effect recently, all businesses will now have to maintain electronic invoices on the cloud. India could draw on an over-arching data protection regime by building on GDPR. However, data protection cannot be in the government sphere alone. Businesses in India can also take cognizance and bring in strong data protection measures akin to GDPR, that will only enable their growth in the long run.

One area to be considered is the electronic consent architecture in India, which is a global first, but this needs to be extrapolated further. For instance, Indian citizens should be able to claim penalties, if businesses failed to obtain clear consent to use their personal data. In the horde of digital marketing, consumer right to opt-out is often not delineated or respected. Also, there is the question of what constitutes as personal and sensitive data. Freely available data like a person’s name and email ID could be classified as personal data, while information about a person’s net worth or investment decisions, should be treated as sensitive data, which requires stronger governance and compliance measures. Digital marketers should be able to leverage technology to classify data categories based on such rules.

They also need to understand the rules for portability of customer data – what can be shared or not shared; with or without their consent; with the competition or industry at large. Indian enterprises dealing with customer data also need to store, organize and provide access control to customer data in their possession in accordance to global norms. This will preempt any data protection governance and compliance norms that may be implemented by the Government, which is likely to happen soon. India Inc. could thus learn from GDPR and leapfrog the curve as it has done in the past, with technology deployments in sectors like banking, telecom etc.

To conclude, GDPR will strengthen data protection measures of enterprises and empower them and their customers, if followed in the right word and spirit. Businesses operating in other regions too will do well to adopt the GDPR standards as data protection increasingly becomes a worry.

Disclaimer

That the contents of third-party articles/blogs published here on the website, and the interpretation of all information in the article/blogs such as data, maps, numbers, opinions etc. displayed in the article/blogs and views or the opinions expressed within the content are solely of the author's; and do not reflect the opinions and beliefs of NASSCOM or its affiliates in any manner. NASSCOM does not take any liability w.r.t. content in any manner and will not be liable in any manner whatsoever for any kind of liability arising out of any act, error or omission. The contents of third-party article/blogs published, are provided solely as convenience; and the presence of these articles/blogs should not, under any circumstances, be considered as an endorsement of the contents by NASSCOM in any manner; and if you chose to access these articles/blogs , you do so at your own risk.

Rajiv Kumar