Tired of waiting for the rules for the Digital Personal Data Protect Act, 2023, the Data Security Council of India (DSCI), a data protection body set up by NASSCOM, partnered with IDfy to launch PriView, an AI-powered tool that generates privacy notices for companies.
Notices are the consent forms that companies must provide users under the Digital Personal Data Protection Act, 2023, before collecting and processing personal data. However, the delay in the release of the rules has thrown a wrench in the compliance process of various companies in India, particularly small businesses.
“Navigating data protection requirements will be a new avenue for MSMEs, startups, etc. Therefore, we felt it was imperative to make available tools and resources which facilitate industry readiness for data protection compliance,” said Shivangi Malhotra, Senior Associate for Privacy and Policy at DSCI.
Unique tool
The tool provides a customised reference template of a privacy notice, which will be the first touchpoint for managing data principals’ consent, enabling transparent and informed collection of personal data, said Malhotra.
Evidence shows that many companies in India do not provide users any options regarding the processing of their data, simply asking folks for a blanket consent.
The template generated by the tool will replace this “I agree to terms and conditions and privacy policy” check box that companies are currently using, Niranjan Nargund, Product Lead at Privy under IDfy told businessline.
“This [check box] is the blanket consent and to improve the adoption, we have created this mechanism where you upload your privacy policy and we will do the conversion to the notice as per what the DPDP act says. We also use a de-jargonisation model which simplifies the legal language in the notice, in accordance with the Act,” said Nargund, adding that the tool also offers translation of the notice template in 22 languages, as required by the data protection law.
This paper’s earlier conversation with industry stakeholders showed that notice remains one of the most anticipated aspects of the DPDP rules. In light of this, Sidharth Deb, Associate Director of Public Policy at The Quantum Hub, told businessline that the tool will prove useful, especially for SME companies which are not digital first. He pointed out that the rules are meant to fill the gaps and not change key aspects or principles of the DPDP Act.
He added, “The law is still not clear on the legal implications of personal data being put in the public domain by entities. On that front these notice tools will have to wait for clarifications from the rules.”
He also advised DSCI to refrain from exercising this mechanism in terms of childrens data.
“Privacy notices will have to be cautious in terms of children’s data because of parental consent. So it would be better for DSCI to wait on this front because the act as it is now seems to be presenting challenges to onboarding children into the digital space,” Deb added.
