white_paper_on_data_protection_in_india_171127_final_v2

For a fuller discussion, see page 30 above.
Questions
1. What are your views on the issues relating to applicability of a data protection law in
India in relation to: (i) natural/juristic person; (ii) public and private sector; and (iii)
retrospective application of such law?
2. Should the law seek to protect data relating to juristic persons in addition to protecting
personal data relating to individuals?
Alternatives:
a. The law could regulate personal data of natural persons alone.
b. The law could regulate data of natural persons and companies as in South Africa.
However, this is rare as most data protection legislations protect data of natural
persons alone.
3. Should the law be applicable to government/public and private entities processing data
equally? If not, should there be a separate law to regulate government/public entities
collecting data?
Alternatives:
a. Have a common law imposing obligations on Government and private bodies as
is the case in most jurisdictions. Legitimate interests of the State can be protected
through relevant exemptions and other provisions.
b. Have different laws defining obligations on the government and the private
sector.
4. Should the law provide protection retrospectively? If yes, what should be the extent of
retrospective application? Should the law apply in respect of lawful and fair processing
of data collected prior to the enactment of the law?
Alternatives:
a. The law should be applicable retrospectively in respect of all obligations.
b. The law will apply to processes such as storing, sharing, etc. irrespective of when
data was collected while some requirements such as grounds of processing may
be relaxed for data collected in the past.
5. Should the law provide for a time period within which all regulated entities will have to
comply with the provisions of the data protection law?
206