We are pleased to share that our Partner, Udit Mendiratta has been quoted extensively by the Asian Legal Business with respect to the recently enacted Digital Personal Data Protection Act, 2023 (DPDPA). 
 
Sharing his views on the DPDPA, Udit noted that the new law completely overhauls the previous Information Technology Rules, 2011 (SPDI Rules). According to him, “The SPDI Rules were fairly basic. They had very basic compliance requirements- consent and reasonable security practices being in place. Those are not sufficient to meet the demands of today. This new act, while building on SPDI principles, overhauls the system and provides far more stringent, detailed and nuanced compliance requirements.”
 
Further, analysing on how companies should go about building infrastructure to comply with the DPDPA, Udit stated that, “Companies must firstly, list down the kind of data being collected and decide what is essential for their purpose. Secondly, companies must also very clearly define for themselves and for their end users the purpose of this data collection.”
 
Lastly, Udit while taking note of the current compliance scenario under the DPDPA, highlighted that, companies that are exempt may lose business to competitors that are collecting and storing data in compliance with the DPDPA. According to him, “Users will perhaps hesitate to engage with organizations that are exempt. You’re enjoying an exemption, but there is a certain set of the population which will say, maybe I don’t want to give my data to you.”