DPDP Act – A catalyst from data to wealth

August 11, 2023, will forever be engraved as a momentous day in India’s digital saga. On this day, India heralded the dawn of a new era by notifying the Digital Personal Data Protection (DPDP) Act. The Act’s primary intent, as implied by its title, is to establish a legal framework, safeguarding individuals’ privacy within the digital realm. However, it holds significance beyond this, as it also opens doors to novel prospects of wealth generation in multiple ways, including growth in data volumes, fresh avenues for data monetization, greater demand for cyber security, cyber audit, and cyber forensics.

It is important to understand numerous compliances that data fiduciaries (which means all businesses dealing with personal data of their customers) need to comply with. These include: ensuring that the data processing is undertaken only for the purpose for which the data principal has given consent or for legitimate uses as provided under the Act; due notice must be given prior to obtaining consent; the consent must be free, specific, informed, unconditional and unambiguous with clear affirmative action; additional safeguards if consent involves personal data of a child; cease processing of data if data principal withdraws consent; ensure completeness, accuracy, and consistency of data if the data is used to make a decision, which affects the data principal; erase data if data principal withdraws consent or the purpose for which data was collected is completed; update data whenever data principal so advises; and service other requests from the data principal. The responsibility remains with the data fiduciary even when the data is being processed by a third party. Significant Data Fiduciaries also need to appoint independent data auditors to carry out periodic data audits and data protection impact assessments.

The necessity to give prior notice, obtain informed consent and other compliances to the Act, and keeping them for future audits and checks will add to data fiduciaries’ overall data storage requirements. This will be particularly important to businesses and organizations in fintech, health, education, travel and e-commerce, and other digital platform verticals who collect personal data as necessary part of their functioning. DPDP Act, without explicitly mandating localization of data, does provide legal backing to local processing requirements under any other government Act/rules. For example, localization requirements laid down by the Reserve Bank of India. Further, the Act also provides an enabling provision, which the government can invoke for localization of any category of data. Increased data generation and localization point to significant growth in data storage requirements in the country. Anecdotally, India produces 20 percent of the world data but has only 2 percent of the world’s data center capacity. I posit that data center capacities will grow in India exponentially in the coming decade, bringing in billions of dollars of investment. CRISIL predicts India’s data center capacity will more than double from the current capacity of 870 MW by 2025.

In the words of Clive Humby, British mathematician, data has become the new modern-day oil. With a population of 1.4 billion, India is a wellspring of abundant data. What was needed was an instrument to monetize this data. The DPDP Act acts as the drilling rig capable of extracting this valuable resource while data empowerment and protection architecture (DEPA) as a toolkit for the extraction process. DEPA enables flow of data while protecting privacy of individuals. It is a unique Indian initiative, conceived by iSpirit Foundation as the third pillar of the India Stack – the other two being Aadhaar for digital identity of persons and UPI for digital financial flows. NITI Aayog has already approved DEPA. For an account aggregator, DEPA enables seamless and automatic flow of data. A data principal seeking loan from a bank can now allow the bank to access information from other financial institutions; a patient can allow access to his doctor of his medical records from multiple hospitals and test labs; a prospective job seeker can enable access to his educational degrees or experience certificates from educational institutions and employers. DEPA also will allow monetization of data by enabling sharing of anonymized data. Such data will be in huge demand for training artificial intelligence (AI) models. DEPA enables for differential privacy-based public certification system, which will empower data fiduciaries to allow AI models to inspect their anonymized data without taking back any of the training data. By making available the data for training AI models, without compromising privacy, make data storage racks worth their weight in gold.

The Act puts the onus on the data fiduciary to take reasonable security standards to protect personal data in its purview. Stiff penalties have been provided for breaches with penalty up to Rs 250 crore for every breach. This stringent framework will incentivize organizations, regardless of size, to improve their cyber security measures, bolstering the growth of domestic cyber security industry. This is a great opportunity to finally create Make in India cyber security products. MeitY and Data Security Council of India could catalyze this by creating standards and certification mechanism for trust and reliability of home-grown cyber security standards.

Data audit has been mandated for Significant Data Fiduciaries under the Act, but it is advisable for all businesses engaged in processing personal data. Data audits will come to occupy the same level of importance as financial audits do today in the corporate world. Board level audit committees may get formed. Data audit and data protection impact assessment would lead to growth in demand for data auditors and cyber forensics – yet another sunrise vertical, which is likely to get a big boost, thanks to the DPDP Act.

As Digital India marches ahead, the DPDP Act has potential to pave the way to the next phase of growth of digital economy of India – making it India’s biggest engine of growth during Amritkaal.