Privacy & Information Security Law Blog

On April 11, 2011, India adopted new privacy regulations, known as the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “Rules”).  The Rules are final versions of the draft regulations issued in February 2011 and impose wide-ranging obligations on any “body corporate” (company) that “collects, receives, possesses, stores, deals or handles” personal information.  These obligations require companies to provide privacy policies, restrict the processing of sensitive personal data, restrict international data transfers and require additional security measures.  The Rules introduce an omnibus privacy law that is similar in many respects to existing EU data protection law, but which raises some fundamental challenges for India’s numerous outsourcing vendors, and their customers.

Key Provisions

The Rules impose a number of additional obligations on organizations, as summarized below.

• Privacy Policy – The body corporate, or any person on its behalf, that “collects, receives, possesses, stores, deals or handles” personal information must provide a privacy policy that clearly sets out its practices and policies, identifies any sensitive personal data collected and processed, explains the purposes for which the data is collected and used, discloses specific information in relation to the newly defined category of “sensitive personal data,” and provides for reasonable security practices and procedures.
• Definition of Sensitive Personal Data – Sensitive personal data is now a defined term, although the definition is narrower than had originally been proposed in draft regulations.  Mirroring EU data protection law to some extent, sensitive personal data includes physical, physiological and mental health conditions, medical records and history, and sexual orientation.  The definition also includes biometric data, passwords and financial information such as bank account details, credit and debit card details.  Information that is freely available or accessible in the public domain or furnished under the Right to Information Act 2005 is excluded from the definition of sensitive personal data.
• Restrictions on Data Collection and Processing – At the point of collection of any data, individuals must be made aware of the fact that their data are being collected, the purpose for which the data are collected, the intended recipients of the data and the contact details of both the agency collecting the data and the agency that will retain the data.  Further, all data is subject to a restriction on any processing for secondary purposes.  It must be processed only for the purpose for which it was collected.
• Additional Restrictions for Sensitive Personal Data – The prior written consent of an individual is required before their sensitive personal data may be processed.  Consent may be obtained by letter, fax or email.  The provider of the sensitive personal data must be given the option, at the outset, not to provide data and may withdraw their consent to the processing at any time.  In addition, sensitive personal data may only be collected for a lawful purpose connected with a function or activity of the body corporate, and the collection of the data must be necessary for that purpose.  Sensitive personal data may not be retained for longer than required for the purpose for which it may lawfully be used.
• Rights of Access and Correction – Individuals have the right to review the information about them and to ensure that inaccurate or deficient data is corrected or amended, as feasible.
• Disclosure to Third Parties – Information (including sensitive personal data) may only be provided to a third party with the consent of the provider of the information.  There are exceptions where the disclosure has been agreed to contractually, is required for legal compliance purposes, or where the disclosure is to government agencies mandated to obtain the information for specific purposes.  The body corporate processing the information (or any person on its behalf) may not publish it and any third party recipient is prohibited from further disclosing the information.
• International Data Transfers – A body corporate or another person on its behalf may transfer sensitive personal data or information to another body corporate or person in India or abroad where the same level of data protection is assured.  The Rules also stipulate that “the transfer may be allowed only if it is necessary” for the performance of a lawful contract with the provider of the data or with their consent.
• Security – The Rules state that a body corporate will be taken to have complied with reasonable security practices and procedures where they have implemented those practices and have a comprehensive documented information security program and policies that contain managerial, technical, operational and physical control measures commensurate with the information assets and nature of the business.  In the event of a security breach, the organization must be able to demonstrate that it has implemented its documented security control measures when asked to do so.  An organization that has implemented International Standard IS/ISO/IEC 27001 or an approved industry code of practice is deemed to have complied with reasonable security practices and procedures, provided that compliance with the standard or code of practice has been audited annually.

It is not yet clear how the Rules will apply in practice, particularly in the context of data processing activities outsourced to India.  There is some ambiguity as to the extent to which the Rules will apply to local outsourcing vendors and/or to off-shore arrangements where data processing remains within the corporate group, albeit in India.  Existing contract terms also will be relevant to any assessment of whether existing data processing arrangements require amendment in light of the Rules.  Organizations with operations in India, or which use vendors based in India, will need to review their existing data processing arrangements in light of these new requirements.