Practical Guide to Data Privacy Laws & Compliance

Illustrate privacy by design through a restaurant payment example, showing how embedding privacy at the center guides business decisions, product design, and service rollout.

Organizations manage confidential, personal, and sensitive personal data and protect them with consent-based safeguards and contractual measures under the information technology act.

Navigate sensitive personal data rules by implementing security practices, defining collection purposes, managing consent, disclosures, transfers, data retention, and establishing a grievance officer.

Explore the Personal Data Protection Bill, 2019 highlights, including extraterritorial jurisdiction, data localization, cross-border transfers, new compliances, data subject rights, penalties, and the proposed data protection authority.

Identify two penalty buckets under the PDP Bill 2019: 15 crore rupees or 4% of worldwide turnover, whichever higher, and five crore rupees or 2% plus imprisonment and compensation.

Understand the proposed rollout timeline for the Personal Data Protection Bill 2019, with a two-year, phase-wise implementation similar to the GDPR.

Explore the grounds of processing data, starting with consent and including function of state, reasonable purposes, employment, compliance with law, and court prompt action.

Identify non-consensual processing grounds under the PDP bill, including government orders, health services in epidemics, and disaster responses. Examine employment-related grounds and future reasonable purposes for data processing.

Explore the essential elements of a privacy policy under the personal data protection bill, including data categories, purpose, consent withdrawal, cross-border transfer, retention, data trust score, and rights.

Clarifies why intermediaries enjoy safe harbour under section 79, requiring compliance with either 2A or 2B and 2C, plus due diligence and central guidelines under 2021 IT intermediary guidelines.