India exempts outsourcers from new privacy rules

Foreign companies sending data to India will also not be covered under the rules

Personal data sent to India by customers outsourcing work to companies in the country will not be covered under new rules governing the collection of such information, the government said on Wednesday, providing relief to India's large outsourcing industry.

The Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules 2011 introduced in April require companies or their intermediaries to take consent in writing from individuals about the use of the sensitive personal information they collect.

The new rules would make it difficult for Indian outsourcers to operate if they were required to take written consent from individuals in other countries whose data they collect and process through call centers and business process outsourcing operations.

As a result of the new rules, companies that rely on India-based outsourcing service providers will be required to adjust their data collection practices to conform to Indian data protection rules, even though their current practices may comply fully with U.S. or European Union privacy rules, said Lawrence Graham LLP, a firm of London-based business lawyers, in a note earlier this year.

A clarification issued on Wednesday by the Ministry of Communications and Information Technology, through the country's Press Information Bureau, said that a "body corporate" providing services relating to collection, storage, dealing or handling of sensitive personal data or information under contractual obligation with any legal entity located within or outside India is not subject to the requirement of the new rules.

The government has also stated that "body corporate" referred to under the new rules are Indian companies, removing the interpretation that U.S. and European companies sending data for processing to Indian outsourcers would have to follow Indian rules while collecting data in their countries.

The clarification by the government removes any such confusion, said Kamlesh Bajaj, CEO of the Data Security Council of India, a company set up by Nasscom (National Association of Software and Service Companies) to set standards for data security and privacy for outsourcers.

It is now clear that it is not the outsourcer, but the companies collecting and sending the data that are responsible for protecting the privacy of the data, according to the rules of the countries they operate in, Bajaj said on Wednesday.

Bajaj said in July that the government had reassured Nasscom that a clarification would be issued, after Nasscom represented to the government that the outsourcing industry would be hit if the rules were enforced.

Under the clarification issued by the government on Wednesday, Indian companies collecting data from individuals, known as "providers of information," will continue to be covered under the new rules governing collection and use of sensitive personal information.

The preferential treatment provided to a section of companies, the outsourcers, could, however, be struck down in court, said Pavan Duggal, a cyberlaw consultant and advocate in India's Supreme Court.

The clarification has not been issued under any provision of the country's IT Act, and in fact violates the spirit of the IT Act, which does not limit the jurisdiction of its laws to companies within India, Duggal said. The clarification is also vague and could lead to a variety of companies claiming to be exempt from the personal data rules, he added.

John Ribeiro covers outsourcing and general technology breaking news from India for The IDG News Service. Follow John on Twitter at @Johnribeiro. John's e-mail address is john_ribeiro@idg.com

Join the Good Gear Guide newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags offshoringservicesoutsourcingNASSCOM

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

John Ribeiro

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Armand Abogado

HP OfficeJet 250 Mobile Printer

Wireless printing from my iPhone was also a handy feature, the whole experience was quick and seamless with no setup requirements - accessed through the default iOS printing menu options.

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?