The Data Privacy Bill is bound to shake up the existing ecosystem

Data protection today is the need of the hour for global citizens as well as enterprises and governments. Data protection has generally been weak on the priority list of organisations for far too long,but the scenario is slowly changing for many of them. The EU's GDPR guidelines that came into effect in May this year may have been the guiding force behind initiating a debate on this matter. 

In the era of internet, anyone sitting anywhere in the world can access the data assets residing anywhere in the world.However there has been a discussion going on around the fact of whether there is any threat if the data resides outside the country. 

“If the concern is around the data protection then data localization without appropriate data protection regime wouldn’t serve any purpose,” asserts Rana Gupta, Vice President - APAC Sales, Identity and Data Protection, Gemalto. “However if the concern is around company sharing the data to foreign government under the local judgment/directions, then it helps mandating companies to keep data locally.”

He continues, “But considering that in many cases, the interaction data being generated (say for example on Facebook, Twitter, WhatsApp etc) will involve interactions between individuals from multiple nationalities, then it is perceivable that the same data will be available in multiple geographies. Especially in cases where the localization is being sought, there do will be a foreign/MNC entity involved unless it is just intended to force Indian companies to not use the foreign CSP.”

Considering most organizations today allow for reasonable use of company issued computers and other IT assets for personal use, it is likely that a significant amount of personal data resides on these assets. This may pose a challenge while seeking assets for investigations or other proactive fraud detection measures undertaken by the organization. In line with these new guidelines, organizations may need to relook at their internal IT policy and their fraud response policy and ensure that employee approvals are obtained prior to accessing personal data.