India exempts outsourcers from new privacy rules

Foreign companies sending data to India will also not be covered under the rules

Personal data sent to India by customers outsourcing work to companies in the country will not be covered under new rules governing the collection of such information, the government said on Wednesday, providing relief to India's large outsourcing industry.

The Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules 2011 introduced in April require companies or their intermediaries to take consent in writing from individuals about the use of the sensitive personal information they collect.

The new rules would make it difficult for Indian outsourcers to operate if they were required to take written consent from individuals in other countries whose data they collect and process through call centers and business process outsourcing operations.

As a result of the new rules, companies that rely on India-based outsourcing service providers will be required to adjust their data collection practices to conform to Indian data protection rules, even though their current practices may comply fully with U.S. or European Union privacy rules, said Lawrence Graham LLP, a firm of London-based business lawyers, in a note earlier this year.

A clarification issued on Wednesday by the Ministry of Communications and Information Technology, through the country's Press Information Bureau, said that a "body corporate" providing services relating to collection, storage, dealing or handling of sensitive personal data or information under contractual obligation with any legal entity located within or outside India is not subject to the requirement of the new rules.

The government has also stated that "body corporate" referred to under the new rules are Indian companies, removing the interpretation that U.S. and European companies sending data for processing to Indian outsourcers would have to follow Indian rules while collecting data in their countries.

The clarification by the government removes any such confusion, said Kamlesh Bajaj, CEO of the Data Security Council of India, a company set up by Nasscom (National Association of Software and Service Companies) to set standards for data security and privacy for outsourcers.

It is now clear that it is not the outsourcer, but the companies collecting and sending the data that are responsible for protecting the privacy of the data, according to the rules of the countries they operate in, Bajaj said on Wednesday.

Bajaj said in July that the government had reassured Nasscom that a clarification would be issued, after Nasscom represented to the government that the outsourcing industry would be hit if the rules were enforced.

Under the clarification issued by the government on Wednesday, Indian companies collecting data from individuals, known as "providers of information," will continue to be covered under the new rules governing collection and use of sensitive personal information.

The preferential treatment provided to a section of companies, the outsourcers, could, however, be struck down in court, said Pavan Duggal, a cyberlaw consultant and advocate in India's Supreme Court.

The clarification has not been issued under any provision of the country's IT Act, and in fact violates the spirit of the IT Act, which does not limit the jurisdiction of its laws to companies within India, Duggal said. The clarification is also vague and could lead to a variety of companies claiming to be exempt from the personal data rules, he added.

John Ribeiro covers outsourcing and general technology breaking news from India for The IDG News Service. Follow John on Twitter at @Johnribeiro. John's e-mail address is john_ribeiro@idg.com

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags outsourcingservicesoffshoringNASSCOM

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

John Ribeiro

IDG News Service
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?