A recent study has revealed that approximately 50 percent of organizations are still in the process of acquiring the necessary skill sets to effectively implement the Digital Personal Data Protection (DPDP) Act of 2023, according to ‘The India Data Protection Readiness Report’ by EY India, released on Sunday.
The report highlights a significant gap in the readiness of Indian organizations with respect to compliance with the DPDP Act. Only 36 percent of these organizations currently have Data Protection Officers (DPOs) based in India. This absence of on-ground DPOs affects their ability to manage consent and adhere to the provisions outlined in the DPDP Act.
The report identifies several key challenges hindering organizations in their journey towards compliance. These challenges include a lack of awareness regarding regulatory guidelines, resource constraints, and resistance to organizational change. Overcoming these obstacles is crucial to ensure the effective implementation of the DPDP Act.
Lalit Kalra, Cybersecurity Consulting Partner at EY India, emphasizes the importance of building a robust technological infrastructure to ensure data security and accountability. He also underscores the significance of cultivating a proficient workforce capable of comprehending the legal and ethical aspects of data processing and effectively managing data breaches.
In a notable finding, the report reveals that 76 percent of respondents believe that an organization’s commitment to data privacy and transparency would influence their purchasing decisions. This signifies a growing awareness among consumers about the importance of data privacy and their willingness to support companies that prioritize it.
Mini Gupta, Cybersecurity Consulting Partner at EY India, stresses the importance of establishing a transparent data protection ecosystem, emphasizing that it not only fosters trust but also empowers consumers to make informed choices, safeguarding their privacy and security.
The DPDP Act lays down specific norms for the management of personal data belonging to Indian residents. It mandates explicit consent for the collection and use of personal data, outlines best practices for data storage and processing to prevent breaches, and provides additional rights to Data Principals, such as the right to correct, delete, update, and erase their data under Section 12. Section 14 of the DPDP Act allows Data Principals to nominate another individual in case of death or incapacity.
