C&L_December 2017 (1)

Cover Story
“We comply with UK/
EU data protection
act for some of our
clients so it is not
going to be a difficult
change for us. However,
the team involved
started working on it
proactively to be ready
to show compliance to
GDPR well ahead of the
deadline.”
Sachin Jain
CIO & CISO at Evalueserve
Jain said that they take “reasonable” as the baseline protection
layer or controls one has to deploy to ensure privacy and
safety of data.
The concern is natural as the IT/ITes sector in India has
reported the largest increase in data breaches in 2016. The
healthcare industry, comes a close second, accounting for
28% of data breaches, rising 11% last year compared to 2015.
This calls for stringent measures to protect healthcare
records of patients in India. The section 43(a) and section
72 of the IT Act mandates organizations to take reasonable
provisions to protect sensitive information and provides a
broad framework for the collection, storage and protection of
personal information in India – including health conditions,
medical records and biometric records.
Other jurisdictions have already enacted sector-specific
laws to protect medical information. The Health Insurance
Portability and Accountability Act (HIPAA) is the primary
law that establishes the US legal framework for health information
privacy and gives patients substantial control over
their information.
At Alembic Pharmaceuticals, the company has tied with a
leading consulting provider to identify areas where it needs
to make process and data changes which would be in alignment
with GDPR regulations.
According to Gopal Rangaraj, its CIO & Head-IT, GDPR is
an organic extension and is not a completely new framework.
In healthcare, end-patient data safety was always a mandate.
Therefore, we capture patient information including demographic
data, and how we handle customer complaints handling
process in the context of GDPR will be interesting.
Alembic Pharmaceuticals Ltd. is an INR 31.31 billion Indian
multinational pharmaceutical company headquartered in
Gujarat, India. Alembic Pharmaceuticals Europe Limited,
however, is the 100 % subsidiary of the Alembic Global Holding
SA, and is located in Malta, Europe.
Rangaraj said that their Indian business does not handle
any EU datasets – but didn't fail to add that adhering to the
guidelines and making them more bulletproof is how they
see the whole thing.
At Wanbury, Jitendra Mishra, its VP-IT and CIO said that
the GDPR is an extension of an earlier law 1995 data protection
directive. The pharma major is the largest manufacturer
of Metformin in the world and exports to over 50 countries –
65% of which comprises of regulated markets.
“We supply 90% of our Metformin to European countries.
We have employees as well as contractors across EU –and
our chief compliance officer in cooperation with IT security
as well as the board – is creating a Standard Operating Procedure
(SOP) to ensure how the GDPR is going to impact our
business, how we secure personal information of our customers,
and how to map all these scenarios to mitigate risks by
enforcing policies, technology and creating awareness in the
organization.”
Across verticals, businesses in India give an impression
that they are in tune with the implications of GDPR. To an
extent, they see their data privacy law offering assistance
when it comes to tackling GDPR requirements as to how
it will help in demonstrating that India is on par with the
EU in terms of data protection law. However, almost everyone
agrees that it needs careful revision to incorporate few
amendments to align with strong protection regulation.
Additionally, they believe that it will also ensure all companies
in India have reasonable practices in place. This will give
confidence to EU companies with subsidiaries in India or
outsourcing work to India.
It looks like the data privacy law has come at the right time
when some Indian businesses are gearing up for biggest ever
overhaul of data protection regulation
December 2017 | CIO&LEADER
13