It appears that India’s Digital Personal Data Protection Bill (“DPDP”) is poised for consideration during the Lok Sabha’s ongoing monsoon session. Present reports about such proceedings suggest that despite strong dissent from the minority, a standing committee managed to adopt a draft report on DPDP just yesterday through a majority vote. Other pressing matters notwithstanding, since the monsoon session is scheduled to last until August 11, the government may get the draft law passed, after all.
Pursuant to Section 11 of DPDP, the central government (“CG”) can classify any company or other entity as a ‘significant data fiduciary’ (“SDF”) based on its own assessment of certain listed factors, which include the volume and sensitivity of personal data processed, as well as the risk of harm to individuals related to such data (“Factors”).
Importantly, special obligations apply to SDFs, in addition to the ones which all data fiduciaries must abide by. Thus, understanding the implications of each prescribed Factor becomes important. However, DPDP itself does not provide much clarity. With regard to ‘sensitivity’, for example, neither does DPDP define the term nor separately explain ‘sensitive personal data/information’ (“SPDI”).
Nevertheless, concerned entities could interpret the term in light of provisions related to SPDI under other laws and proposals – including the SPDI rules and DPDP’s past avatars. Further, given that GDPR had heavily influenced such prior drafts, the EU’s provisions may provide additional interpretive guidance.

The post Sense and Sensitivity : ‘Sensitive’ Information Under India’s New Data Regime appeared first on S&R Associates.