Skip to main content

Legal Capsule: General Data Protection Regulation: Impact on India-based businesses by Economic Laws Practice

By
General Data Protection Regulation (“GDPR”), approved and adopted by European Parliament in April 2016, is a ‘rights based’ data protection model which allows the users to have greater rights over his/her data.  This came into force on May 25, 2018 GDPR and is today an important topic for most businesses, given the extra-territorial reach of these regulations. This article explores some of the key facets of GDPR and highlights pertinent points.


  • Applicability:Primarily, GDPR lays down rules in relation to protection of natural persons with regard to their personal data. The GDPR is applicable not only to organisations located within the European Union (“EU”), but also applies to organisations located outside of the EU if they ‘process’ personal data of EU subjects as a ‘controller’ or a ‘processor’, and where the processing activity relates to (a) offering of goods or services (including for free) to data subjects in EU; or (b) monitoring theirbehaviour if the behaviour takes place within EU.
  • Processing of personal data:‘Processing’ in the context of GDPR means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
  • Data Protection Principles: GDPR lays down specific data protection principles for processing of personal data. Each ‘controller’ and ‘processor’ needs to ensure that the personal data is (a) processed lawfully, fairly and in a transparent manner, (b) collected for a specific, explicit and legitimate purpose, (c) adequate, relevant and necessary in relation to the purposes for which it is collected, and (d) accurate and is kept up to date. There is not only a requirement to comply with the prescribed principles but the ‘controller’ should be able to demonstrate the compliance.
  • Obligation to comply with GDPR: The obligation to comply with the above principles is not only on the entity collecting personal data of EU subjects but also the entity which stores, transmits, alters, uses such personal data on behalf of the data controller.
  • Lawful data processing under GDPR: Data processing will be considered lawful under GDPR if the data subject has given consent to the processing of personal data for one or more specific purposes. But mere consent of the data subject is not sufficient. The controller shall be able to demonstrate that the data subject has provided the consent. The request for consent by the controller shall be presented in a manner which is clearly distinguishable from other matters, in an intelligible and easily accessible form, using clear and plain language.[2] The data subject shall also have the right to withdraw his/her consent at any time, and it shall be as easy to withdraw consent as it is to give consent.
  • Sensitive personal data: Information which is considered specifically sensitive such as racial or ethnic origin or physical or mental health condition etc. cannot be obtained, stored, transmitted, processed, unless explicit consent for processing of such personal data has been provided by the data subject for one or more specified purposes.

Thinking Ahead to Minimize Exposure And Liabiities


Key takeaways for India-based organisations


The world’s 500 biggest corporations are on track to spend a total of $7.8 billion to comply with GDPR, according to consultants Ernst & Young.[3] In light of the significant compliance cost and burden, companies need to start thinking about the impact on their business model and pricing strategies.

GDPR provides the data subjects greater access to ascertain the manner in which their data is processed. Each controller is now required to maintain a record of processing activities under its responsibility and there are stringent conditions prescribed for notification of the personal data breaches. Given the strict compliance norms and the quantum of penalty involved, it has become imperative for organizations to have dedicated teams for ensuring ongoing GDPR compliance.

GDPR’s extra-territorial application could potentially have a significant impact on Indian organisations, making it critical for companies to analyseand assess whether GDPR is applicable to them. The sectors which are most likely to be affected are IT and ITeS services, business process outsourcing (BPO) units, e-commerce companies catering to customers in EU etc. 


 Venture Intelligence is India's longest serving provider of data and analysis on Private Company Financials, Transactions (private equity, venture capital and M&A) & their Valuations in India.

Popular posts from this blog

EY Tops League Table for Transaction Advisors to M&A deals in 24

By
Moelis & Company & PwC claim the No.2 & No.3 slots Ernst & Young  (EY) topped the Venture Intelligence League Table for Transaction Advisor to M&A Deals   during 2024, advising 34 deals worth $4.1 Billion. Moelis & Company stood second advising 2 deals worth $3.9 billion. PwC followed with 18 deals worth $3.3 billion. Citi ($2.5 billion across 1 deal) and Advay Capital ($2.3 billion across 1 deal) completed the top five. Among the largest M&A deals in 2024, Citi  advised $2.5 Billion acquisition of the Indian business of American Tower Corporation by Brookfield , Advay Capital and Moelis & Company advised the $2.3 Billion acquisition of Care Hospitals by Aster DM Healthcare . Jefferies & Co., JP Morgan and Moelis & Company advised the $1.6 Billion acquisition of Bharat Serums & Vaccines by Mankind Pharma.  Among the other notable M&A deals in Q4 2024, EY advised the $685 million acquisition of ITD Cementation ...
Read more

Morgan Stanley tops League Table for Transaction Advisors to M&A deals in 2020

By
Morgan Stanley , which advised the $10.1 Billion strategic investment by Facebook and Google into Reliance Industries' telecom arm Jio platforms (among other Private Equity investments in the company), topped the Venture Intelligence League Table for Transaction Advisor to M&A Deals for 2020. Ambit Corporate Finance - which advised 3 deals worth $4.0 Billion, including Brookfield's $3.7 Billion acquisition of Reliance Tower Infrastructure Trust -  took the second spot. JM Financial ($3.7 Billion across 5 deals), Metta Capital ($3.4 Billion across 3 deals) and ICICI Securities ($3.4 Billion across 2 deals) - all of whom (along with Citi) are advisors to the $3.4 Billion acquisition of Future Group's retail related ventures by Reliance Retail, announced in August - completed the top five. The  Venture Intelligence League Tables , the first such initiative exclusively tracking transactions involving India-based companies, are based on the value of PE and M&A tra...
Read more

Everything you wanted to know (and some things you didn't care to know) about ChrysCapital's Ashish Dhawan

By
New Delhi-based private equity fund ChrysCapital is vastly different from its former avatar, Chrysalis Capital. While Chrysalis began life (in Mumbai) as an venture capital firm focussed on start-up investments, today's ChrysCapital is best know for its late-stage investments (often in already public companies). The fascinating part of this transformation is that one of the fund's original partners - Senior Managing Director Ashish Dhawan - has been firmly in the driver's seat throughout the process. It's a story that needed to be told. As a cover story. Kudos to Business Today for telling it first. Thankfully, unlike the glowing profiles that BT is famous for - including the one featuring infamous stock brocker Harshad Mehta with his Lexus on the cover - this one has a lot of facts. Some well known. And others less so. That ChrysCapital's first fund would have been a disaster but for the pioneering investment in Raman Roy founded BPO firm Spectramind i...
Read more

Why did Sony Entertainment Television's CEO quit?

By
Businessworld has a cover story on the corporate battle that resulted in Kunal Dasgupta, the CEO of Multi Screen Media (formerly Sony Entertainment Television), quitting just a few months before his contract was due to end. Dasgupta’s abrupt exit was the culmination of six years of tension between majority shareholder Sony Pictures Television International (SPTI) that owns 61 per cent of MSM, on one hand, and Atlas Equifinn on the other, which is a consortium of Indian shareholders (Singapore-based Rakesh Aggarwal, World Media Group director Sudesh Iyer, Shemaroo Entertainment Managing Director Raman Maroo, MobiApps Holding’s Jayesh Parekh, B.R. Sule, Sushil Shergil and actor Jackie Shroff ) holding 32 per cent. Capital Japan and some financial institutions own the rest 7 per cent. And of course, the third protagonist is Dasgupta, who walked a tightrope and managed to keep his job for over 14 years despite the fact that neither group of shareholders was too happy with him. Very little...
Read more

APEX VC Awards: Chiratae Ventures, Blume Ventures, Elevation Capital, Stride Ventures & Alteria Capital judged best funds of 2021

By
Press Release Elevation Capital , Chiratae Ventures , Blume Ventures , Stride Ventures and Alteria Capital were voted the top Venture Capital investors in India during 2021. The Venture Intelligence “Awards for Private Equity Excellence” (APEX) is dedicated to celebrating the best that the Indian Private Equity & Venture Capital industry has to offer. "VCs exist because Entrepreneurs exist and disrupt the ecosystem by creating new businesses. We are very excited to be part of the secular trend of tech disruption that would power India’s journey towards $ 10 Trillion economy over the next decade," said  T C Meenakshi Sundaram, Founder & Vice Chairman, Chiratae Ventures , winner of " VC Fund raise of the Year " award.  " We wish to thank all our entrepreneurs who have chosen to take funding from Chiratae Ventures and investors who have backed us with funds over the past 15 years in this journey.  Congratulations to the entire Chiratae Ventures team and ...
Read more