Hello from India.

As you read this, we in India are looking forward to a long three-day weekend — thanks to 2 Oct. being an annual holiday in honor of Mahatma Gandhi (it is his birthday).

Every 2 Oct., one of Gandhiji's beloved bhajans (devotional song) is played everywhere in his memory. A beautiful song worth listening to, I quote the first stanza below:

Vaishnav Jan To Tene Kahiye Je, Peed Parae Jane Re,
Par Dukhe Upkar Kare Toye, Man Abhiman Na Aane Re..

One Who Is A Vaishnav, Knows The Pain Of Others,
Does Good To Others, Without Letting Pride Enter His Mind..
(Vaishnav: Devotee Of Vishnu)

I strongly believe those of us who have been working in the data privacy domain in India for a while now should take inspiration from the message of these opening lines, given the state of things around us after passage of the Digital Personal Data Protection Act.

It has been just about seven weeks since the act passed and organizations are already facing so much apprehension and uncertainty over compliance, particularly within the stiff timelines being considered. It is time for our (relatively) small community to "know the pain," go out and do what it takes, dispel fears and equip the ecosystem to gear up — essentially "do our good." After all, the future of each of us, as individuals, depends on how our personal data is protected.

What has contributed to this situation of fear, uncertainty and doubt? 

The rules associated with the DPDPA are yet to be published. However, at a recent event, Minister of State for Electronics and Information Technology Rajeev Chandrasekhar, who has been the main person making most announcements in the context of the DPDPA, said rules would be published in the coming 30 days. I hope this will help bring clarity on many of the open and ambiguous issues.

Timelines for compliance are not yet clear. The issue is further obfuscated with the minister saying that large and mature organizations would likely be ready already and, hence, not require too much time, while smaller entities who do not possess the knowhow and skills would require more. In any case, the timelines being discussed — six months to a year — are, in absolute terms, rather stiff. Almost every day there is chatter in the media on the topic, with various sectoral representatives making their case to the powers that be. We will have to wait and watch what eventually happens.

Several aspects of the law seem to be open to interpretation — leading to ambiguity. For example, what actually constitutes "public data" is still not very clear. Does data available on social media platforms qualify? Another question revolves around who exactly will qualify as a "significant data fiduciary." While the parameters to determine an SDF have been published in the DPDPA, the general expectation has been that the government will clarify which specific organizations or sector would come under this category. However, it is now understood this kind of formal clarification is unlikely to be issued. 

Another area of concern for organizations is the lack of availability of blacklisted countries. Particularly since we all live amidst so much of geopolitical uncertainty, there is fear it may lead to a rather abrupt release of blacklisted countries, which, in turn, can lead to sudden disruption of business operations.

On top of all this, when you add the general acute paucity of expertise, misinformation and misunderstanding about what really needs to be done, what does not, and so on, tends to proliferate.

On the flip side — lest you get the impression it is all grey and cloudy — let me share some developments that bring cheer, as well.

The Ministry of Electronics and Information Technology has appointed an officer on special duty for the Data Protection Board that is to be set up to govern the DPDPA. The Officer on Special Duty will work to establish the DPB. Further, Minister Chandrasekhar announced the board will be set up within 30 days.

Interestingly, the minister also said that breaches occurring before the DPB is formed will be taken up by the board once it is operational. This addresses a question that many have asked about this scenario.

All in all, we are at the start of a long, winding road ahead. While I am sure it will be full of twists and turns, it certainly promises to be an interesting journey.

Signing off by thinking of Mahatma Gandhi again with one of his quotes that resonates in our context today: "The future depends on what we do in the present."