white_paper_on_data_protection_in_india_171127_final_v2

could be high compliance costs on data processors. 270 Concerns relating to enforceability of
contracts and enforcement capabilities in India must also be taken into account while
attempting to precisely allocate responsibility by identifying multiple actors in processing of
data. On the other hand, there remains the possibility that the new law could be the catalyst
for mature transactions in data processing and the market may adapt to the new norms,
however specific they are.
6.3 Provisional Views
1. To ensure accountability, the law may use the concept of ‗data controller‘. The
competence to determine the purpose and means of processing may be the test for
determining who is a ‗data controller‘.
2. The need to define data processors, third parties or recipients depends on the level of
detail with which the law must allocate responsibility. This has to be determined on an
assessment of the likely impact of imposing obligations on processors and the
compliance costs involved, amongst other things.
6.4 Questions
1. What are your views on the obligations to be placed on various entities within the data
ecosystem?
2. Should the law only define ‗data controller‘ or should it additionally define ‗data
processor‘?
Alternatives:
a. Do not use the concept of data controller/processor; all entities falling within the
ambit of the law are equally accountable.
b. Use the concept of ‗data controller‘ (entity that determines the purpose of
collection of information) and attribute primary responsibility for privacy to it.
c. Use the two concepts of ‗data controller‘ and ‗data processor‘ (entity that receives
information) to distribute primary and secondary responsibility for privacy.
3. How should responsibility among different entities involved in the processing of data be
distributed?
Alternatives:
a. Making data controllers key owners and making them accountable.
270 Dr. Detlev Gebel and Tim Hickman, ‗Chapter 11: Obligations of processors – Unlocking the EU General
Data Protection Regulation‘, White & Case (22 July 2016), accessible at:
https://www.<strong>white</strong>case.com/publications/article/chapter-11-obligations-processors-unlocking-eu-general-dataprotection,
(last accessed 29 October 2017).
50