Lawsikho

How to determine applicability of Indian data protection and privacy laws

Material and territorial scope of the laws Impact across Industries How and when to validly claim exemptions from Indian data protection laws How to identify business contact information How to determine the role of your client/employer - Processor/Sub-processor or Controller, Significant Data Fiduciaries or a combination of the above roles How the client/employer role influences implementation obligations and liabilities What to do if your client/employer plays multiple roles in different scenarios Which organisations need to appoint a DPO Consequences of material non-compliance

How to create a roadmap for organisational implementation

How to get started and initiate/lead implementation for your client/employer Crucial tasks and checklists for implementation Treatment of past processing activities Appointment of privacy counsels, DPOs, internal grievance redressal mechanisms How conduct a data protection impact assessment, analyse key risks in a DPIA report and create a roadmap for implementation Alignment of stakeholders from marketing, sales, HR, ops and finance Establishment of department-wise processes and SOPs How to conduct data audits Conducting department-wise Trainings Legal drafting and advisory work

Drafting Policies and Notices

Identification of grounds for processing data - consent and legitimate uses How to validly invoke these grounds in data implementation Key elements of a privacy notice and how to draft one How to create a cookie policy How to customise privacy notices and cookie policies for SAAS, e-commerce, fintech, BFSI and AI Sample templates of privacy notices and cookie policies How to create an internal privacy policy for implementation of privacy laws How to create data breach policies How to create asset policies and BYOD policies How to create Acceptable Use Policies How to create data retention policies and schedules

How to conduct a DPIA

How to identify if DPIA is required Identifying key POCs for a DPIA How to create a record of processing activities How to create a data flow map How to scrutinise data security measures How to assist the business teams to fill the DPIA Sample templates of DPIA Identifying the legal and risk treatment controls Understanding and mitigating the issues highlighted in DPIA

How to create a grievance redressal mechanism

Understanding the obligations of Significant Data Fiduciaries to create grievance redressal mechanism How to establish a competent grievance redressal mechanism How to implement the right to “grievance redressal” in any organisation What are the timelines to respond to any grievance and how to design a process to handle them?

Requirements for third party data transfers and cross-border data transfers

Identifying restrictions on cross-border transfers through sectoral laws and regulations How to ensure rights mentioned under Indian law in cross-border transfers How to analyse the risk associated with any cross-border transfer Contractual clauses necessary for valid third-party transfers How to keep a track of the blacklisted countries by the government

How to lead/review department-wise trainings as a data protection lawyer/privacy counsel

How to conduct an awareness or training session for different departments

Identification of data processed by the relevant department
Drill-down into user access rights and admin controls
Mapping specific restrictions on processing, sharing internally, with external agencies and deletion
Department-specific examples
Training, refreshers and certification

Relevant provisions for administration of data privacy trainings:

Data Protection Regulations
Identifying and Handling Sensitive Data
Social Engineering Awareness
Understanding the Best Practices in Data Privacy and Security

How to evaluate the effectiveness of the awareness or training sessions

How to handle Data Principal Rights

Understanding Rights of Data Principals

Right to correction and erasure of data
Right to nominate
Right to access
Right to withdraw consent and data deletion rights
Right to grievance redressal

How to implement a secure deletion process that allows users to permanently remove their data upon request How to maintain a directory of individuals who have exercised the right to nomination How to collaborate on a self-service portal where users can view and download their data Implementation of popular tools How to implement data deletion rights across the company How to enable and provide a mechanism to register grievances How to liaise with team members in case of Data Access Requests

Incident response and how to handle data breaches

Legal obligations in case of an incident or a data breach How to develop detailed policies and procedures for incident identification, reporting, and response How to identify key roles and responsibilities in a data breach team How to perform pre-emptive risk assessments to identify critical assets, potential threats, and vulnerabilities How to prepare a public statement and communicate with customers, partners, and regulators

Powers of Government, Investigative Agencies and Regulatory Authorities For Interception and Disclosure

Statutory provisions and circumstances which require disclosure of personal information: tax laws, anti money-laundering laws, SEBI and RBI Regulations, Delhi Special Police Establishments Act, state Powers of government, investigative agencies and data protection board to intercept or require disclosure and procedural requirements How to handle requests for disclosure from such agencies and how to verify whether the disclosure rules are validly invoked by government agencies What to do if government/investigative agencies exercise powers in violation of procedures Consequences of wrongful disclosure to government agencies

Dispute resolution, penalties and proceedings before Data Protection Board

How to initiate complaints for a client How to defend your client/organisation before the Data Protection Board Administrative process for adjudication Appellate process before TDSAT Scope of writs and SLPs before and after decisions of Data Protection Board/TDSAT