Data Privacy & DPDPA Compliance

Data fiduciary is entity determining purpose and means of processing personal data. "Purpose" = why data is processed (fraud detection, marketing, service delivery). "Means" = how data is processed (systems, technology, retention duration). Data processor is entity processing data on behalf of fiduciary without determining purpose/means, follows fiduciary's instructions. For GCCs: if parent company instructs "process these transactions for fraud detection using this algorithm, retain for 90 days," GCC is processor. If GCC management decides "we will analyze customer behavior to recommend products, using our AI models, retaining data for 2 years," GCC is fiduciary. Practical implications: (1) Fiduciaries face direct penalties (Schedule ceilings up to Rs 250 crore, amount determined by the Board under section 33(2)); the fiduciary remains responsible for processing by its processors (section 8(1)), so processor exposure is largely contractual; (2) Fiduciaries handle data principal rights directly, and significant data fiduciaries must also appoint a DPO and conduct DPIAs and audits (section 10); processor obligations flow from the processing contract: security, breach notification to the fiduciary, audit cooperation; (3) Fiduciaries are responsible for complying with any section 16 restriction on transfers; processors transfer only per fiduciary instructions. Many GCCs operate in hybrid mode, fiduciary for employee data (HR autonomy), processor for parent's customer data (operating per parent charter). Document role clearly in data processing agreement with parent.

Pragmatic approach under the DPDP Rules, 2025 (notified 13 November 2025, enforceable 13 May 2027): (1) Implement contractual transfer safeguards (SCC-style clauses) proactively, adapt EU Commission SCCs or draft custom clauses addressing DPDP Act data principal rights (access, correction, erasure, grievance redressal), security obligations, breach notification, audit rights, liability allocation. Rationale: Section 16 is a negative list, so SCCs are not a statutory requirement, but contractual safeguards evidence accountability under Section 8 and allow a quick switch if a destination is later restricted by notification; (2) Conduct transfer impact assessment (TIA), evaluate recipient jurisdiction's data protection laws, government access regimes, enforceability of data principal rights. Document assessment with legal opinions from home jurisdiction counsel; (3) Implement supplementary safeguards, encryption (data unusable by unauthorized parties including government), access controls (role-based, MFA), contractual restrictions (no onward transfer without consent), audit rights; (4) Obtain explicit consent for high-risk transfers, particularly for sensitive personal data (health, financial), inform data principals of cross-border transfer, risks, and mitigations; (5) Monitor Section 16 notifications (the Central Government may restrict transfers to specified countries) and sectoral localisation directions (RBI payment data, and Rule 13 localisation of specified data for significant data fiduciaries); (6) Engage with parent company data privacy teams, align India GCC practices with parent's global data protection program (GDPR, CCPA compliance infrastructures), ensure India-specific risks addressed. Risk: with the DPDP Rules, 2025 now notified and the 13 May 2027 enforcement date fixed, proactive compliance positions the GCC defensibly for the Data Protection Board’s adjudicatory framework that activates with the rules.

DPDP Act penalty framework: (1) Data fiduciaries: Schedule ceilings up to Rs 250 crore, with the amount determined by the Board after inquiry (section 33(2)); (2) Data processors: no separate Schedule penalty, the data fiduciary remains responsible for processing by its processors (section 8(1)), so exposure is allocated by contract; (3) Consent managers (platforms managing consent): penalties for non-compliance with registration, technical standards. Penalty determinants: (a) Nature, gravity, and duration of breach, single incident vs systemic non-compliance, number of data principals affected, sensitivity of data (children's data, health data higher gravity); (b) Data fiduciary's conduct, proactive remediation vs negligent inaction, cooperation with Data Protection Board investigation, prior violations; (c) Repetitive nature of the breach and whether the fiduciary gained an advantage or avoided a loss; (d) Mitigating factors, self-disclosure of breach, prompt notification to affected data principals, effective remediation (credit monitoring, identity theft protection). Adjudication process: Data Protection Board inquires on a breach intimation, a complaint, a Government reference or a court direction (section 27), conducts hearings, issues orders. Appeal to Telecom Disputes Settlement and Appellate Tribunal (TDSAT). Comparators: GDPR penalties up to 4% of global turnover or EUR 20 million (higher); India quantum lower but Rs 250 crore non-trivial for most GCCs. Key: proportionality principle likely in application, minor paperwork lapses unlikely to attract maximum penalty, but data breach affecting lakhs of individuals with inadequate security could trigger substantial penalty. Mitigation: maintain compliance documentation (policies, training records, DPIAs, audit reports, breach response logs) to demonstrate good faith, invest in cybersecurity maturity to establish reasonable security practices defense under IT Act section 43A.

Yes, employee personal data subject to DPDP Act. "Personal data" is data about an individual identifiable by or in relation to such data, includes employee names, contact details, PF numbers, salary, performance evaluations, health records, biometric attendance. GCC as employer is data fiduciary determining purposes (HR administration, payroll, compliance) and means (HRMS systems, retention periods). However, section 7(i) provides a legitimate use for employment purposes, including safeguarding the employer from loss or liability (for example, preventing corporate espionage, protecting trade secrets, or providing a benefit the employee seeks). Practical implication: GCC need not obtain explicit consent for routine HR data processing (payroll, PF, ESI, tax deductions, attendance) as it's necessary for employment relationship. But: (1) Consent still required for non-essential processing, employee surveys, wellness programs, social events, employee referral programs (process personal data of referrals); (2) A section 5 notice is mandatory only for consent-based processing, but an employee privacy notice specifying data collected, purposes, retention, sharing (government for PF/tax, insurers for group health) and data principal rights remains good practice; (3) Access (section 11) and correction/erasure (section 12) rights attach to consent-based and section 7(a) processing, while grievance redressal (section 13) and nomination (section 14) apply generally; (4) Health and biometric attendance data are not a separate statutory category under the DPDPA but warrant heightened security, purpose limitation, biometric data for attendance only, not for tracking without consent; (5) Retention limitations, post-termination, retain only for legal obligations (7 years for tax records, 3 years for PF), delete other data. Common pitfall: CCTV footage of premises, employees must be informed, footage retained only for security purposes (30-90 days typical), not indefinite storage. Employee background verification, explicit consent required, data shared with verification agencies only on need basis, candidate informed of sources checked. Exit interviews, if data used for analytics (attrition patterns), anonymize before aggregation to avoid individual identifiability.