India exempts outsourcers from new privacy rules

Foreign companies sending data to India will also not be covered under the rules

Personal data sent to India by customers outsourcing work to companies in the country will not be covered under new rules governing the collection of such information, the government said on Wednesday, providing relief to India's large outsourcing industry.

The Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules 2011 introduced in April require companies or their intermediaries to take consent in writing from individuals about the use of the sensitive personal information they collect.

The new rules would make it difficult for Indian outsourcers to operate if they were required to take written consent from individuals in other countries whose data they collect and process through call centers and business process outsourcing operations.

As a result of the new rules, companies that rely on India-based outsourcing service providers will be required to adjust their data collection practices to conform to Indian data protection rules, even though their current practices may comply fully with U.S. or European Union privacy rules, said Lawrence Graham LLP, a firm of London-based business lawyers, in a note earlier this year.

A clarification issued on Wednesday by the Ministry of Communications and Information Technology, through the country's Press Information Bureau, said that a "body corporate" providing services relating to collection, storage, dealing or handling of sensitive personal data or information under contractual obligation with any legal entity located within or outside India is not subject to the requirement of the new rules.

The government has also stated that "body corporate" referred to under the new rules are Indian companies, removing the interpretation that U.S. and European companies sending data for processing to Indian outsourcers would have to follow Indian rules while collecting data in their countries.

The clarification by the government removes any such confusion, said Kamlesh Bajaj, CEO of the Data Security Council of India, a company set up by Nasscom (National Association of Software and Service Companies) to set standards for data security and privacy for outsourcers.

It is now clear that it is not the outsourcer, but the companies collecting and sending the data that are responsible for protecting the privacy of the data, according to the rules of the countries they operate in, Bajaj said on Wednesday.

Bajaj said in July that the government had reassured Nasscom that a clarification would be issued, after Nasscom represented to the government that the outsourcing industry would be hit if the rules were enforced.

Under the clarification issued by the government on Wednesday, Indian companies collecting data from individuals, known as "providers of information," will continue to be covered under the new rules governing collection and use of sensitive personal information.

The preferential treatment provided to a section of companies, the outsourcers, could, however, be struck down in court, said Pavan Duggal, a cyberlaw consultant and advocate in India's Supreme Court.

The clarification has not been issued under any provision of the country's IT Act, and in fact violates the spirit of the IT Act, which does not limit the jurisdiction of its laws to companies within India, Duggal said. The clarification is also vague and could lead to a variety of companies claiming to be exempt from the personal data rules, he added.

John Ribeiro covers outsourcing and general technology breaking news from India for The IDG News Service. Follow John on Twitter at @Johnribeiro. John's e-mail address is john_ribeiro@idg.com

Tags servicesoffshoringoutsourcingNASSCOM

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

John Ribeiro

IDG News Service

Comments

Comments are now closed.

Latest News Articles

Most Popular Articles

Follow Us

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Resources

Best Deals on GoodGearGuide

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?