00:06
Adam Stofsky
Hey. I'm here with the dream team of tech and privacy lawyers from JSA, a very prominent and major law firm india. Can you guys introduce yourselves, tell us a bit about who you are in your practice. Yajas, you want to go first?
00:20
Yajas Setlur
Yeah, sure. Thanks, Adam. So I'm Yajas. I'm a technology lawyer from Bangalore, India. I work in a law firm called JSA, and I sort of focus on technology, media and telecommunications law, which covers data privacy as well. And I've been doing this for ten years now, and he's still going strong.
00:41
Adam Stofsky
Probir, who are you?
00:44
Probir Chowdhury
Much older than my young person, but my name is Prabir. I'm a partner at JSA. Been doing this for 19 years. Going strong. I'm a technology and fintech lawyer based out of Bangalore. And part of my cage is to help clients figure out how to work india, in the tech sector.
01:06
Adam Stofsky
So we're talking about the DPD, which is India's data privacy law. What does DPD stand for again?
01:14
Yajas Setlur
Is it just data, the digital personal data protection?
01:18
Adam Stofsky
Right. So my question for you is, why do I need to worry about this? I run a small tech company here in the US. It's not just me. The question is, who needs to worry about this law? On the one hand, it seems like kind of a big deal. This is like, you know, a country of over a billion people, a massive market, a big tech and growing tech market. On the other hand, it's india. So my question for you is, who needs to worry about this law? Who needs to learn about it and understand it?
01:49
Yajas Setlur
I think any company that's sort of looking to do business india or that has plans of being india either by having actual entity or some sort of a physical presence or simply having their services or products sold. Because any of these companies, if they're planning to process data belonging to Indians barrel, they need to look at this. They need to look at this law pretty carefully. So it's just companies based india, but it would be american software companies. It could be hotel platforms, travel aggregators. Anybody who is looking at indian consumers would need to look at this big.
02:39
Adam Stofsky
F. So can you say a bit more about what that means? So what does it mean to, like, be india? What is that? What if I'm a. What if I'm an indian freelancer that we use some freelance platforms like upwork? If I'm just only selling to folks in Europe, do I need to worry about this? What does it mean to be india with respect to this law.
03:05
Yajas Setlur
So the law in that sense is pretty simple. It says that if you're an entity that's outside India and you're processing personal data of indian outside India, but you're doing it in connection with or in parallel with selling goods or services to Indians, that's when the law applies. So, and, you know, I think the law pretty much assumes that if you are selling goods and services india and you are processing personal data, that you sort of know that you are likely to be covered under indian law. So there is a sort of presumption that somebody who is doing in business india should know what indian law requires, and that is exactly the way it works.
03:54
Adam Stofsky
Are there any limitations on this? The CCPA, for example, California's general data privacy law, has some restrictions on, like, the size of a company or the company's revenue or number of customers, anything like that? Or is it just like pretty much any company of any size?
04:13
Yajas Setlur
So. Well, law doesn't have any of that. I think what the indian lawmakers have tried to do is to try and keep the law as simple as possible, as easy to read as possible, and keep it fairly light and sort of principle based. So there isn't a threshold in terms of either in terms of the company's size or the number of customers. So theoretically, a company that sells even a handful of products and only deals with a few customers india would be expected to be aware of what the indian law requires.
04:48
Probir Chowdhury
You know, I think it's probably important, you know, Yajis and I can talk a little bit about it, is that there are few pointers to companies. It may not apply to most us companies, but, for example, there are some exceptions on, you know, who the legislation applies to. Like, one of the aspect is that the data is, has to be in digital form for it to be actually regulated by the act. You know, and I will say that today's day and age. Probir, what do you mean by digital form? Because is it everything online? Is it everything you know, or you type in? Nobody. But, you know, we are india, right? So we are still a growing country with the growing economy. Lot of information and data is collected and is jotted down. You know, it's not always digitized, though.
05:37
Probir Chowdhury
And that is really exemption for smaller companies india, smaller shops india, you know, who are collecting data because as I just said, there is no exemption based on the threshold business revenue.
05:51
Yajas Setlur
Right.
05:51
Probir Chowdhury
So if you're like a small moment fox store india, you know, you would not be really, you know, like digitizing everything. You'd be just like collecting receipts and putting your information, you know, in a Rolex or something. So, yeah, so, you know, it does exempt businesses who are actually storing information like that. That's one exemption. Then the other exemption is also for information which is available in public data. Right. So if there is information available publicly, then, you know, if you are collecting and processing that data, then potentially you're exempt from the applicability of this act.
06:33
Adam Stofsky
You don't need to get consent to collect data that's already out there.
06:36
Probir Chowdhury
Exactly right. That's right. So that's that. But so there are these provisions which potentially could impact businesses, the US, who are, again, you know, maybe scraping web data, but then potentially don't need to get consent. Right. So it's not on the threshold value. It's on how you're collecting data and what you're doing as a business. And of course, there is one big exception. I just. You could probably talk about that.
07:05
Yajas Setlur
Yeah. This probably doesn't tie to the example that you are giving, Adam. But, you know, if there was an indian company that's processing or dealing with the data of Americans, and that data is coming to the indian company not directly from the american consumer, but if there was a large hospital chain or a pharmaceutical company that was transferring the data to India, was outsourcing to sending it to a back office here india, then the law exempts those processing activities. And I think that came as a pretty huge sigh of relief to multinational companies that use India as a sort of back office to process data because you don't want to be dealing with overlapping laws in multiple jurisdictions for the same activity. And I think that was sort of one positive feature of the law.
07:59
Adam Stofsky
So what that means is that there's no Indians involved. Right. So this is the data of just Americans or Europeans, but happens on indian soil. That's interesting.
08:08
Yajas Setlur
That's right. I think that was a hard fought exemption. And I think companies that have back offices india had to lobby pretty hard to explain to the government why, how not providing that exemption would sort of hurt the outsourcing economy and sort of would make business very difficult india.
08:27
Adam Stofsky
Wow. That's actually. That seems really important, actually. So because of the way so many companies work, b, two, b, relationships india, I guess what I'm hearing from you guys just to kind of wrap this up is for pretty much any company, the minute you begin to do business india, this is a very broadly speaking, whether it's you conclude your first sale, you start marketing activities or gathering, maybe lead data. The minute that contact with the subcontinent, with India happens, you have to start worrying about this law. Is that a good summary?
09:03
Yajas Setlur
That's right. Yeah. I think that, I think that data privacy is now going to be one of the top four or five things. A company that's looking to come to India for the first time is going to have to think it was nowhere close to that list. Things like tax and other issues took priority. But data privacy is definitely going to be one of the first few things they'll have to think about when they're looking at India. And I think that's the way we're changing the way culturally companies.
09:34
Adam Stofsky
Great. Great. All right. Thanks, guys. Really appreciate it.
09:37
Yajas Setlur
Thank you.
<div style="padding:56.25% 0 0 0;position:relative;"><iframe src="https://player.vimeo.com/video/914869245?badge=0&autopause=0&player_id=0&app_id=58479" frameborder="0" allow="autoplay; fullscreen; picture-in-picture" style="position:absolute;top:0;left:0;width:100%;height:100%;" title="12035_Who Needs to Worry About the DPD"></iframe></div><script src="https://player.vimeo.com/api/player.js"></script>