white_paper_on_data_protection_in_india_171127_final_v2

The EU GDPR focuses on a ―risk based approach‖ for continual assessment and adoption of
mitigation measures. It does not mention whether the organisation should adopt a specific risk
assessment industry standard (eg. ISO 27001, ISO 31000 etc). The only security practice it
recommends is the use of pseudonymisation of personal data.
Accountability demands proactive actions from organisations including continuing
investments to ensure that security safeguards are up to date. Organisations are expected to
empower customers with tools and technologies to protect their data.
Under the existing privacy framework in India, Rule 8 of the SPDI Rules, mentions security
practices that a body corporate should have in place for the purpose of protecting sensitive
personal data. These security practices and standards should be supplemented by a
comprehensive documented information security programme and information security
policies that contain managerial, technical, operational and physical security control measures
that are commensurate with the information assets being protected with the nature of
business. 676 It also mentions making use of international Information Technology Security
Standards such as ISO 27001 and the use of code of best practices created by self-regulatory
bodies, once approved and duly notified by the government. 677 The use of empanelled
auditors to ensure compliance was these practices was also mandated.
Security safeguards obligations should provide adequate protection to the personal data of the
individuals while taking into account the financial and organisational capabilities of data
controller. A risk-based approach of dealing with potential security and associated privacy
incidents could be the general norm. The approach should define the risk criteria, the
mitigation measures and mechanisms to ensure reporting and continual improvement.
2.3 International Practices
European Union
The EU GDPR provides that a data controller would be responsible for, and must be able to
demonstrate compliance with principles relating to the processing of personal data (these
include the purpose limitation principle, data accuracy principle, storage limitation principle
etc.). 678 The obligation requires data controllers to implement appropriate technical and
organisational measures to ensure and be able to demonstrate that data processing activities
are performed in accordance with the data protection obligations set out under the EU
GDPR. 679
Data controllers must also review and update such technical and organisational measures
whenever necessary. 680 The measures incorporated would take into account the nature and
676 Rule 8(1), SPDI Rules.
677 Rule 8(3), SPDI Rules.
678 Article 5(2), EU GDPR.
679 Article 24, EU GDPR.
680 Article 24(2), EU GDPR.
151