InfraVeritas360DPDPiq

DPDP Insights › IT, ITeS, BPO and GCC

Types of organisation

• IT services and consultingYour teams log into client systems every day. The client decides the purpose; you follow instructions. Your own staff and candidate data is fully yours.
• BPO and contact centreAgents see customer screens, hear card details and handle complaints. Call recordings, screen captures and QA samples are the data that piles up.
• Global capability centreA GCC often works on data of people in many countries. For people outside India, Section 17(1)(d) usually applies; for Indian staff and any Indian customers, the full Act does.
• SaaS and software productsYou are a processor for the data your business customers put in your product, and a fiduciary for your own sign-ups, website visitors and marketing lists.
• Managed services, data centres and cloudCERT-In asks data centres, VPS, cloud and VPN providers to keep certain subscriber information for five years. That sits alongside your DPDP duties.

Whose data you hold

• Employees, interns and candidates
• Client customers handled for clients
• Client staff whose data sits in tickets and systems
• Sub-contractor and contractor staff
• Visitors, CCTV and access cards at offices

Read it from your seat

• DPO / Privacy leadYou look after two kinds of data with different rules: your own staff's, and your clients'.
• CISO / Security headYour controls protect your own company and every client system your people can log into.
• CIO / IT headYour internal systems hold your staff data; your delivery platforms hold your clients'.
• CEO / MDDPDP reaches you in two ways: through your own staff, and through the client data your teams handle every day.
• DirectorYour clients trust the company with their data. That trust is what you are really overseeing.
• HR headYou hold the largest pool of personal data that is fully yours: employees, candidates and alumni.
• Legal & complianceYou negotiate the data clauses clients send, and you write the ones you send to sub-contractors.
• Operations headDelivery floors, shared services and facilities handle data in tickets, screens and paper.
• Delivery headAs delivery head, your teams hold client access and client data every day.
• Chief risk officerClient contracts, sub-contractors and offshore exemptions all create different risk lines.

By department

• IT department
• Administration department
• HR department
• Finance department
• Marketing department
• Customer service department
• Legal department
• Procurement department

Questions specific to this sector

• Does DPDP apply to data of foreign clients' customers?
• How should our people access client systems?
• A client's data is involved in an incident. Who tells whom?
• How long can we keep candidate data?

Practical examples

Notice, request log, retention schedule, vendor clause and breach notice.

Rules that sit alongside DPDP