‘First published on India Business Law Journal’
By: Shantanu Sahay and Pratyush Acharya
As India moved towards full implementation of the Digital Personal Data Protection Act, 2023 (DPDPA), organisations will need to review their practices regarding the retention and use of information that they already possess.
Section 5(2) allows for the continued use of data where there is prior consent for such usage; however, it does not exempt legacy databases from being subject to the new framework.
The term “legacy data” is not a separate statutory category. Section 3 defines digitally collected personal data and information digitised thereafter. Processing includes storing, and the continued retention of data falls under the framework.
This means that the framework applies to ongoing activities and not retroactively to activities that were completed. The key difference in terms of when the framework becomes effective is the date section 5 takes effect, not the date that the legislation was enacted (August 2023). Most of the main processing obligations under the DPDPA are scheduled to take effect in May 2027.
Section 5(2) states that organisations must provide notice as soon as reasonably possible after section 5 takes effect and that previously consented processing may continue until consent is withdrawn. Organisations do not necessarily need to obtain new consent for all processing simply because the legislation has taken effect.
Section 6 establishes substantive standards for consent, while section 5(2) acknowledges historical permissions. The DPDPA does not explicitly address every inadequacy in prior consent mechanisms.
The preferable interpretation would preserve continuity where the existence and scope of consent can be demonstrated, while subjecting all continuing processing to the act. Section 6(10) establishes that evidence is crucial in cases where consent-based processing is challenged.
Rule 3 requires that organisations provide an independently understandable notice that identifies personal data, identifies the purpose for which it will be used, describes how an individual may withdraw consent and describes rights and complaint procedures available to individuals.
Organisations should distinguish between describing current processing practices and describing proposed new uses of personal data that would require additional authorisation. The legislation does not include a general exemption for failed attempts to deliver notices. Lack of operational capability does not justify establishing a deemed-consent mechanism.
Section 7 allows organisations to engage in certain types of processing without obtaining consent from individuals. These include certain qualifying employment-related uses and specific instances where individuals voluntarily provide information.
These are statutory conditions that permit organisations to process information without consent; they do not represent a commercial interest exception.
For example, providing contact information when submitting a service request does not automatically authorise an organisation to use that information for an unrelated group-company campaign. Approval internally to retain information should not be interpreted as approval for its unlimited internal use.
Section 8(7) requires organisations to delete personal data either when the individual withdraws consent or when it is reasonable to assume that the original purpose for collecting that data has ceased to exist (whichever occurs first) unless retention is necessary for compliance with legal requirements.
Rule 8(3) requires organisations to retain personal data along with associated traffic data and processing logs related to purposes listed in the Seventh Schedule for a minimum of one year and then delete them unless further retention is legally mandated.
The Third Schedule specifies inactivity periods for certain types of fiduciaries and purposes but not universally. Similarly, organisations must apply other statutory retention requirements to the records they actually relate to.
For example, section 128(5) of the Companies Act, 2013 requires organisations to retain books of accounts and supporting vouchers for at least eight immediate preceding financial years, subject to qualifications specified therein. Organisations retaining records solely for compliance purposes must restrict their usage for ordinary commercial purposes.
Additionally, implementation must apply to processor-held copies of records, local exports of records, discontinued systems containing records and backup copies of records. Deleting only the primary record does not fulfil section 8’s processor-erasure obligations.
Ultimately, readiness depends on whether each continued use of records can be justified and whether appropriate action is taken based on those determinations. A revised notice, regardless of how well written it may be, cannot replace that evaluation.
etc. whilst wrongfully claiming to be part of our firm and making false claims and allegations.