The DPDP Solution steps are designed to help you navigate the complexities of the Indian data protection laws (Digital Personal Data Protection Act 2023) and ensure full regulatory compliance. This comprehensive guide will walk you through the step-by-step process of implementing our Atlas DPDP solution (or you can use it as a generic guide using any tool of your choice).
- Discover – Systems, Data, Classification and Data Mapping
- Policies – Policies and Purposes models
- Consents – Consent and Notices Management
- Designer – Design Consents, Forms, Notices and Surveys
- Activities – Manage Processing Activities across all processors
- Requests – Handle Customer Requests automatically
- Grievances – Handle Customer Grievances through a workflow
- Incidents – Manage Incidents and handle notifications
- Reports – Dashboard, Reports and Audits
The DPDPA mandates specific processes for data collection, processing, sharing, storing and the rights of the data principal. The key steps for DPDP implementation are described below.
Step 1: Know Your Systems
Knowing what systems and processes you have that collects data is the first step towards full DPDP solution compliance.
- Identify all sources of data (structured and unstructured).
- Scan your entire IT infrastructure to identify the devices that are connected to your network
- The systems are not just servers and databases but even network devices and endpoint
- All systems are capable of collecting or processing data so is best to make a full list
- Map the key people who are owners or users of the various systems
Atlas DPDP Solution: Use our Atlas system for registering all your systems, map and visualise how data flows between your systems giving you the big picture view of your systems in one place.
Step 2: Discover Personal Data
Once you have identified your systems, you will need to know what data the systems are collecting, processing and sharing with other systems in order to be DPDP compliant. Use our Data Discovery scanners to discover and classify personal data.
The steps involved in the process are:
- Scan systems, endpoints, network devices and endpoints such as laptops, linux machines and Macs.
- Classify data such as personal information, identity information, images such as identity documents and financial information
- Automate remediation tasks such as removal of affected files, quarantine policies or encryption
- Use Data Loss Prevention (DLP) tools that can regularly scan and provide logs that can be analysed for personal information stored and processed
- Ensure there is continuous monitoring enabled so the scanners can continue to run and scan your systems at specific intervals.
Atlas DPDP Solution: Use our Data Discovery and Classification tools for scanning your systems, databases and images. Visualise the scan logs centrally. You can either use our scanners or simply use our connectors to import the scan logs from your DLP tools. In addition, Atlas provides survey assessments which are questionnaires that helps organisation wide data assessment.
Step 3: Develop Policies and Purposes
The foundation of any DPDP Solution is a robust set of policies that govern the data collection, sharing and storage and the very purpose for which such data is collected and processed. Key areas to address include:
- Clear policies for each registered system in the inventory
- Collect only what is necessary (data minimisation)
- Retain data only as long as required (data retention limitation)
- Restrict access based on roles and responsibilities
Atlas DPDP Solution: Atlas provides an easy way to map your systems with policies and purposes and modify or clone them for multiple systems. The policies and purposes also track versions and data variations over time for accurate consent collection.
Step 4: Consents and Notices
Build the consents and notices from the systems, policies and purposes. Atlas DPDP solution helps with the following steps.
- Automated consent creation for each unique system
- Multi-lingual consent templates for all 22 languages in the constitution
- Multiple notices and consent capture mechanism
- A clear and unambiguous consent capture with user rights in simple single screen flow
Atlas DPDP Solution: One of the key highlights of Atlas is the Consent Designer feature that allows users to design and configure the consents and notices pages to their exact needs. While we provide a comprehensive out of the box template as per the DPDP rules, you can continue to change the content, buttons etc to match your consent capture needs.
Step 5: Handle Processing Activities
Section 11 (1) (a) of the DPDP Act specifies the rights of the data principle to request for a summary of personal data which is being processed by such Data Fiduciary and the identities of all other Data Fiduciaries and Data Processors with whom the personal data has been shared by such Data Fiduciary, along with a description of the personal data so shared and the processing activities undertaken by that Data Fiduciary with respect to such personal data.
In order to achieve this, we recommend a series of phases for automating this.
6.1 API Integration
- Request every data processor identified in your network to integrate an API call to check for permissions granted for processing personal data of the data principal and make another API call to log the processing entry.
- Consolidate the processing checks (legal basis for processing data) and register the processing log (record of processing activity) in the Atlas registry.
6.2 File Integration
- Where your systems are unable to use our APIs, you can request every data processor to take a file as input for checking legal basis and providing a file with the record of data processing.
Atlas DPDP Solution: We provide fully functioning APIs and file importer functions to integrate both APIs and files to meet the needs of automating data processing activities and provide them as reports when requested by your customers.
Step 6: Manage Requests and Grievances
A key aspect of the Indian DPDP Solution is the rights of the data principal. The following articles describe the various requests customers can make. And if they are dissatisfied with the response they can raise them as grievances and then proceed to report the issue to the data protection board for remedy:
- Section 11(a) – Summary of personal data processed
- Section 11(b) – Identities of Data fiduciaries & Data Processors
- Section 11(c) – Any other ad-hoc data processing carried out
- Section 12(1) – Right to correction, completion, updating, erasure
- Section 12(2) – Correct incorrect data, update incomplete data
- Section 12(3) – Erase personal data unless needed for retention
- Section 13(1) – Means for grievance redressal
- Section 13(2) – Respond to grievances in a timely manner
- Section 13(3) – Allow for approaching board if not satisfied
Atlas DPDP Solution: One of the key highlights of Atlas is the Request from Designer feature that allows users to design and configure the forms to their exact needs. You can design the form with authentication (e.g. email or mobile number verification) before accepting the forms for processing. All of the requests and grievances are logged centrally with an audit trail for DPDP compliance. Atlas also provides a simple workflow for assignment of requests to data owners, time tracking and notifications.
Step 7: Manage Incidents
Personal data breach is defined as any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data.
Further Section 8 (6) says that in the event of a personal data breach, the Data Fiduciary shall give the Board and each affected Data Principal, intimation of such breach in such form and manner as may be prescribed.
Atlas DPDP Solution: Atlas helps with the preparation of automated reports that will need to be sent to the data protection board and also intimate the affected data principals of the breach in the form prescribed by the data protection board.
Implementing a DPDP Solution is a strategic investment in your organization’s future. By following this step-by-step guide, you can ensure a fully compliant solution that safeguards sensitive data, enhances compliance, and builds trust with your customers. The success of a DPDP Solution doesn’t end with just the initial deployment. Continuous monitoring, training, and staying with the changes to regulations are key to staying ahead in the evolving landscape of data protection and privacy.
About
We are your friends at frslabs
FRSLABS is an award-winning research and development company specialising in customer onboarding, identity verification and fraud prevention solutions for businesses. Whether you are a big bank, insurance, telco or a small investment broker, we help you onboard and verify your customers with greater flexibility, compliance and reliability.
Built for you, not for investors
We do what is right for you (and only you) at scale. Nothing is off-limits for us when it comes to innovation, a culture best reflected in the array of patents we have filed. We want to be your trusted partner, to build the solutions you need, and to succeed when you succeed.
Priced for success
We are driven by our mission to touch a billion lives with our tools and not beholden by venture capital or mindless competition. We therefore have the freedom to do the right thing, and price our products sensibly, keeping your success and our staff in mind. We succeed only when you succeed.
Supported by humans
Whatever it takes, we are here to help you succeed with our products and services. For a start, you get to talk to a human for help, not bots, to figure things out one-to-one. Whatever your needs, however trivial or complex it may seem, we have you covered.
