white_paper_on_data_protection_in_india_171127_final_v2

Australia
The Privacy Act requires credit rating bodies to ensure that regular audits are carried out by
an independent person to ensure that certain agreements with credit providers are being
complied with. 749
South Africa
Under Section 89 of the POPI Act, the Information Regulator is required to assess ―whether
an instance of processing of personal information complies with the provisions of [the] Act‖
in the prescribed manner. It may do so on its own initiative or on request by or on behalf of
the responsible party, data subject or any other person. The provision clarifies the mandatory
nature of such assessment, stating that it must be carried out by the Information Regulator ―if
it appears to be appropriate‖ though it may not make the assessment if, on a request, it is
unable to identify the requester or the action that must be assessed. 750 Information notices are
sent to the relevant organisation towards initiating an assessment. 751 A provision is also made
regarding the assessment report resulting from the assessment process. 752 The report is to be
given to the responsible party and the Information Regulator may also make any aspect of the
assessment public if it is in public interest to do so.
(iv) Data Protection Officer
The designation of a specific individual or officer by a data controller to facilitate compliance
through monitoring and advising as well as to act as a point of contact with a data protection
authority is a crucial element of data protection laws. These individuals are often called data
protection officers (DPOs). 753 It is relevant to note that in the present Indian legal framework,
a body corporate is required to designate a grievance officer for grievance redressal purposes
with certain details of the same posted on the body corporate‘s website. 754
International Practices
European Union
749 Sections 20N (3)(b) and 20Q(2)(b), Privacy Act.
750 Section 89(2), POPI Act. The criteria that the Information Regulator is to keep in mind when determining
when it is ‗appropriate‘ to make the assessment is also laid down. See Section 89(3), POPI Act.
751 Section 90, POPI Act.
752 Section 91, POPI Act.
753 For example, as part of EU GDPR‘s accountability-based compliance framework, DPOs will be at the heart
of the regulatory scheme, facilitating compliance with the provisions of the EU GDPR as key players: See
Article 29 Data Protection Working Party, ‗Guidelines on Data Protection Officers (‗DPOs‘)‘, European
Commission (13 December 2016), 4-5, available
at: http://ec.europa.eu/newsroom/document.cfm?doc_id=43823, (last accessed 20 November 2017).
754 Rule 5(9), SPDI Rules.
170