Category Archives: Uncategorized

By Ananya Sarkar and Pratishtha Sharma Personal data is critical to financial services industry, right from loan applications and insurance policies to payment transactions. Financial institutions routinely process personal information, including financial records, personal identity details, transaction details, biometrics, health data etc., making them particularly exposed to privacy and data protection risks. The Digital PersonalContinue reading “Data Protection in the Financial Sector”

In the business environment, organizations rely on third-party vendors for various services which often involve processing of personal data. Under the recently enacted Digital Personal Data Protection Act, 2023 (“DPDP Act”), organizations can engage third-party vendors to process personal data on their behalf under a valid contract. However, the responsibility for ensuring that personal dataContinue reading “7 Questions to Ask Your Vendors About Privacy”

Data Protection and Privacy is more relevant today than ever before. With the internet of things and the rise in digitalization, the challenge of privacy has made users pro-active in protecting their personal information. According to Forbes[1], 45% of US citizens have had their personal information compromised by a data breach in the past fiveContinue reading “Resources for Data Protection and Privacy”

Introduction Data is now termed as a highly valuable asset which used for business expansions plans globally. With the technology driven world and high delivery speed big data is transferred internationally without boundaries just in fraction of seconds. However, these cross-border data transfers/ flows are regulated. As of now approx. 110+ countries have enforced dataContinue reading “Cross border data transfer- An Overview of Adequacy Decision, SCC and BCR”

What is Anonymisation? The Joint Parliamentary Committee in its report on the Indian Data Protection Bill, 2021 (“DP Bill”) recently included anonymized data within the purview of the bill. The DP Bill defines anonymization in relation to personal data as: “Such irreversible process of transforming or converting personal data to a form in which aContinue reading “Anonymisation and Pseudonymisation – Overview and Legal Regime”

Introduction Consent is a form of expressed and immediate acceptance of the terms by the user. Consent provides validity and is binding under certain legal regimes. Data protection laws like the GDPR, CCPA, LGPD, PIPEDA etc recognises consent as a legal basis for processing personal data. It is a highly used best practice by organisationsContinue reading “Consent under the data protection regime”

A Data Subject Access Request (DSAR) or Subject Access Request (SAR) is a form of a right provided to a data subject to exercise. They can request to know what personal data an organisation or a data controller holds on them, how it is processed, with whom the data is shared and the period forContinue reading “What is a Data Subject Access Request (DSAR/SAR)?”