Data Processing Rules Under Privacy Laws

𝐖𝐡𝐚𝐭 𝐦𝐚𝐤𝐞𝐬 𝐜𝐨𝐧𝐬𝐞𝐧𝐭 “𝐟𝐫𝐞𝐞, 𝐬𝐩𝐞𝐜𝐢𝐟𝐢𝐜, 𝐢𝐧𝐟𝐨𝐫𝐦𝐞𝐝, 𝐮𝐧𝐜𝐨𝐧𝐝𝐢𝐭𝐢𝐨𝐧𝐚𝐥 𝐚𝐧𝐝 𝐮𝐧𝐚𝐦𝐛𝐢𝐠𝐮𝐨𝐮𝐬” 𝐮𝐧𝐝𝐞𝐫 𝐃𝐏𝐃𝐏 (with examples that fail the test) Many existing consent mechanisms in India may struggle to meet the DPDP standard. Here’s why. Where consent is the ground for processing, it must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, for a specified purpose, and limited to personal data necessary for that purpose. What the law requires 1. Specific and purpose-limited Consent must relate to a clearly identified specified purpose and only the data necessary for it. The Act illustrates this clearly: a telemedicine app may seek consent for data required to provide telemedicine. Access to phone contacts does not automatically ride on that consent. 2. Informed (notice + Rules) Before consent is taken, the Data Fiduciary must disclose: • personal data processed and the purpose • how she may exercise her rights (including withdrawal) • how to complain to the Data Protection Board The Rules require clear, plain language with itemised data and specific purposes. 3. Unambiguous and affirmative Consent must involve a clear affirmative action. Passive or “do nothing” mechanisms (pre-ticked boxes, “by continuing you consent”) struggle to meet this standard. 4. Unconditional and non-waiving Any part of consent that violates the Act, Rules or any other law is invalid. The Act’s illustration: consent to issue an insurance policy combined with a waiver of the right to complain to the Board. The waiver is invalid. 5. Ongoing control Consent may be withdrawn at any time, with ease comparable to giving it. The notice must clearly show how. Examples that fail the test 1. Bundled, unnecessary permissions A payments app seeks KYC consent while also asking for SMS, contacts and precise location via a single “Accept all” toggle, without necessity or explanation. 2. Consent with rights waivers “I consent to processing and waive my right to complain to the Data Protection Board.” The waiver is invalid. 3. Vague notices A long privacy policy that never itemises data or specifies concrete purposes, but still seeks a generic “I agree”, fails the Rules. 4. Passive consent patterns Pre-ticked boxes or “by continuing to browse you consent” lack a clear affirmative action tied to a specified purpose and proper notice. Takeaway If consent is your ground under DPDP: • Design the notice first • Avoid bundling unrelated processing • Never attach rights-waivers • Make withdrawal obvious and friction-light Get this wrong, and you may not have valid consent at all. What consent patterns are you seeing that concern you? Share in comments. Relevant provisions DPDP Act, 2023: ss. 4, 5, 6, 7, 8(7) DPDP Rules, 2025: rr. 2(1)(d), 3, 9, 14(2) #DPDP #DataProtection #ConsentManagement #PrivacyByDesign #IndianLaw

⚖️Today’s CJEU judgment in C-484/24, NTH Haustechnik v EM, clarifies how the #GDPR applies when a national court uses evidence containing personal data in civil or employment litigation. 🔹The case concerned an employer that wanted to rely on data obtained from a former employee’s private eBay account to prove that she had sold company property without authorisation. The referring German court assumed that the employer may have obtained the data unlawfully and asked whether the GDPR prevents the court from using that evidence. 🔹The Court held that judicial handling of such material can itself amount to processing of personal data, especially where documents are filed electronically, stored, consulted, retrieved or used by the court. That processing may be based on Article 6(1)(c) GDPR, because the court has a legal duty to rule on admissibility of evidence and, where evidence is admissible under national law, to take it into account when deciding the case. 🔹The Court accepted that national procedural law does not need to contain a detailed statutory rule for every situation in which courts use evidence containing personal data. It is enough that national law, including clear and foreseeable case-law, sets the conditions for such use, pursues a public-interest objective and remains proportionate. The right to a fair trial is central to that assessment. 🔹Article 17(3)(e) GDPR does not create a separate legal basis for processing. It only limits the right to erasure where processing is necessary for legal claims. Courts must still rely on one of the legal bases listed in Article 6 GDPR. 🔹The Court also rejected an automatic exclusion of evidence merely because a party previously collected or stored the data unlawfully. The GDPR contains no general rule requiring courts to disregard such evidence. A national court may therefore use evidence containing personal data obtained in breach of privacy or data-protection rights, provided that the court’s own processing complies with the GDPR and that national rules on admissibility are respected. 🔹The principle of data minimisation still applies, but it does not require the court to carry out a full proportionality test for every act of judicial processing. At the stage of deciding admissibility, the court may process the data needed to assess the evidence. Once evidence is admitted, the court must ensure that the data used and disclosed are limited to what is necessary. Before disclosure to parties or third persons, the court may need to anonymise, pseudonymise or otherwise reduce the data. 💡A violation of the Article 13 GDPR information duty by the party that collected the data also does not, by itself, prevent the court from using the evidence.

📌 Employee Data under GDPR vs. CCPA: When Privacy Enters the Workplace Not all personal data belongs to customers. What about employees? Whether you're running HR for a European startup or a California tech firm, privacy law has plenty to say about the people behind the screen. Let’s break it down 👇 🇪🇺 GDPR: Full Rights for Employees In the EU, employees are fully-fledged data subjects - just like consumers. They enjoy the full suite of rights: ✅ Access to personnel files ✅ Rectification of errors ✅ Erasure (in some cases) ✅ Right to object - when processing (e.g. monitoring/profiling) is based on legitimate interest ✅ DPIAs - required when processing is high risk (e.g. surveillance, biometrics) 🧠 Consent? Not ideal. Per Recital 43, consent is unlikely to be freely given in situations of power imbalance - like between an employer and an employee. → Employers should rely on legal obligation or legitimate interest, with safeguards. 🧪 Example: A German company uses facial recognition to track attendance. This biometric data triggers a DPIA, requires a valid legal basis, and additional safeguards. 💡 Bottom Line: In Europe, workplace privacy is an extension of fundamental rights. Employers must justify why and how they process employee data. 🇺🇸 CCPA: Employees as Consumers California’s CCPA includes employees, contractors, and job applicants under the term “consumer.” This means California employers must now uphold: 📋 Right to know what’s collected 🧽 Right to delete (with exceptions) 🛠️ Right to correct 🚫 Right to opt out of sale/sharing 🛑 Right to limit use of sensitive personal info ⚠️ Key points: – No formal DPIA requirement – Consent is still valid in many cases – No specific rules yet on employee surveillance, though broader CCPA rules apply 🧪 Example: A California employer tracks geolocation via mobile app. This may count as sensitive personal info, and employees could limit its secondary use. 💡 Bottom Line: California now extends privacy rights to employees - but within a consumer rights framework, not a fundamental rights regime. 🎯 The Core Difference GDPR → Rights-based, principle-heavy, accountability-focused CCPA → Consumer-centric, flexible, still evolving 🌍 What This Says About Privacy Culture 🇪🇺 “An employee is a rights-holder - regardless of role.” 🇺🇸 “An employee is a consumer - now entitled to more transparency and control.” Same desk. Different philosophies. 👇 Want a follow-up on: 🔹 Vendor risk - how third-party liability plays out under GDPR vs. CCPA? 🔹 What businesses need to consider before EU-U.S. data transfers? #GDPR #CCPA #CPRA #EmployeeData #WorkplacePrivacy #HRCompliance #CIPPE #CIPPUS #PrivacyProfessional #EUUSPrivacySeries #DataRights #GlobalPrivacy #LinkedInLearning #InfoSec #DataProtection

When I first started working in Privacy, managing Privacy Impact Assessments (PIAs) and the Third-Party Risk Management (TPRM) process, I often found myself puzzled. Everywhere I turned, people were talking about DPAs — between customers, processors, and sub processors. And honestly, in the beginning, I struggled to untangle what these terms really meant and how they fit together. But with daily exposure, working hands-on with assessments and vendor reviews, the pieces started to click. Today, I want to share a simple breakdown that helped me (and hopefully helps you too). The Data Protection Chain (GDPR perspective) Controller (GDPR Art. 4(7), 24–25) Decides why and how personal data is processed. Example: A bank choosing to use a payroll SaaS. Must have a DPA with the Processor (Art. 28(3)). Processor (GDPR Art. 4(8), 28) Processes personal data on behalf of the Controller. Example: The payroll SaaS provider. DPA must require: processing only on instructions, security, confidentiality, DSAR support, breach notification, and subprocessor controls. Subprocessor (GDPR Art. 28(2) & 28(4)) Engaged by the Processor to help deliver services. Example: SaaS provider using AWS cloud hosting. Requires a DPA with the Processor, and the Controller must authorize their use. Fourth Party (Sub-subprocessor) (extension of Art. 28(4)) A vendor engaged by the Subprocessor. Example: AWS using a backup provider. Must also have a contract flowing down equivalent GDPR obligations. Controller doesn’t contract with them directly but must be notified and approve. Note: The DPA is the legal thread that holds the entire chain together — ensuring accountability flows from the Controller all the way down to the Fourth Party. A missing or weak DPA can mean non-compliance, contractual disputes, and even regulatory penalties. Audits keep organizations honest and accountable.

𝐈𝐧𝐝𝐢𝐚'𝐬 𝐃𝐢𝐠𝐢𝐭𝐚𝐥 𝐏𝐞𝐫𝐬𝐨𝐧𝐚𝐥 𝐃𝐚𝐭𝐚 𝐏𝐫𝐨𝐭𝐞𝐜𝐭𝐢𝐨𝐧 𝐑𝐮𝐥𝐞𝐬 𝐰𝐞𝐫𝐞 𝐣𝐮𝐬𝐭 𝐧𝐨𝐭𝐢𝐟𝐢𝐞𝐝 𝐨𝐧 𝐍𝐨𝐯𝐞𝐦𝐛𝐞𝐫 𝟏𝟒, 𝟐𝟎𝟐𝟓. This isn't just a compliance issue. It's a strategic governance imperative that Boards can no longer afford to defer. From my experience advising boards, here are five critical implications for directors and corporates: 1. The 18-month runway has conditions. The Rules provide an 18-month phased rollout for full compliance. But breach notification requirements and certain obligations took effect immediately on November 14. Boards that assume they have 18 months to act are mistaken. Incident response plans must be operational now. 2. Data breach penalties reach ₹250 crores. Failure to maintain reasonable security safeguards can attract penalties up to ₹250 crore. Not notifying the Data Protection Board or affected individuals of a breach carries penalties up to ₹200 crore. This isn't operational risk. This is existential risk for many companies. 3. The 72-hour breach notification mandate is live. Data Fiduciaries must provide initial intimation immediately and submit a detailed report to the Data Protection Board within 72 hours of breach detection. Most companies don't have systems to detect breaches in 72 hours, let alone report them. This creates immediate board-level exposure. 4. Significant Data Fiduciaries face annual audits. SDFs must conduct annual Data Protection Impact Assessments and independent audits, with reports submitted to the Data Protection Board. For companies processing large volumes of sensitive data, this elevates data governance to mandatory board oversight, not optional compliance. 5. Consent Managers create a new regulatory layer. Consent Managers must be incorporated in India with minimum net worth of ₹2 crore and operate interoperable platforms compliant with Data Protection Board standards. This fundamentally changes how companies manage user consent, especially for fintech, consumer -tech ,edtech, and digital platforms. Boards must understand these implications for customer experience and operational costs. 𝐓𝐡𝐞 𝐛𝐨𝐚𝐫𝐝 𝐢𝐦𝐩𝐞𝐫𝐚𝐭𝐢𝐯𝐞: India now has operational data protection laws. The Rules were issued after 6,915 public inputs through nationwide consultations. Boards that treat this as an IT problem will face penalties and reputational damage. Those that embed data governance into strategic oversight will build customer trust and competitive advantage. The question for board directors: In your experience, is data privacy integrated into enterprise risk management, or siloed in technology committees? #DPDP #DataPrivacy #BoardGovernance #CorporateGovernance #RiskManagement #DigitalIndia #DataProtection #Compliance Data Sources: Ministry of Electronics and Information Technology (MeitY) DPDP Rules 2025 notification (November 14, 2025), Press Information Bureau, India Briefing DPDP Analysis (November 2025).

Last month at an IAPP privacy webinar, the discussion centered on how data privacy and AI truly align. As the panel unpacked real-world audits and case studies, I discovered a set of hidden GDPR articles that quietly sync with the way modern AI actually works. That’s when it hit me → the toughest GDPR tests for AI often come from five quieter articles that regulators rely on to measure real compliance. Here are the five that every AI user should have on their risk radar: 💡 GDPR guards the data. The EU AI Act governs the AI system itself. Most teams forget you need to pass both tests. Rule 1 → Article 22: Automated Decision-Making & Profiling Yes, this is the human-in-the-loop safeguard. If your model makes a decision solely by algorithm with legal or significant impact (credit, hiring, healthcare, insurance), users have the right to: ↳ Opt out of the automated decision ↳ Demand a human review before the outcome stands ➡️ Designing that review pathway isn’t optional; it’s architecture. Rule 2 → Articles 13 & 14: Radical Transparency These require clear, intelligible notices describing: ↳ What data you collect ↳ Why you process it ↳ Your lawful basis Even if data is obtained indirectly (e.g., scraped training sets). ➡️ Must be written in plain language—not legalese—and shown at the point of collection. Rule 3 → Article 30: Records of Processing (RoPA) Your single source of truth: ↳ Every dataset ↳ Purpose of processing ↳ Categories of subjects ↳ Retention periods ↳ Transfers ➡️ Supervisory authorities usually ask for this first. Keep it audit-ready. Rule 4 → Articles 44–49: Cross-Border Data Transfers Using global cloud platforms or U.S.-based APIs? These clauses dictate when you need: ↳ Standard Contractual Clauses (SCCs) ↳ Binding Corporate Rules (BCRs) ↳ Adequacy decisions ➡️ Essential for lawful data flows post-Schrems II. Rule 5 → Articles 37–39: Data Protection Officer (DPO) Triggered by: ↳ Large-scale monitoring ↳ Special-category data processing This isn’t ceremonial. A DPO is: ↳ The operational bridge between engineering, governance, and regulators ↳ A trust signal for investors and enterprise clients 💡 Takeaway GDPR isn’t just Europe’s privacy law; it’s the architectural blueprint for AI governance worldwide. Before you deploy another model or ship the next feature, stress-test your design against these five “quiet” articles. #GDPR #ResponsibleAI #HumanInTheLoop #DataPrivacy #AICompliance #RiskManagement #IAPP

Every U.S. company should review the DOJ data rule taking effect April 8. Law360 shared my summary on how to assess and tackle it ⤵️ The U.S. Department of Justice's "Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons" rule has a lot to unpack. This Law360 piece is an executive level summary of what the rule requires, how it impacts common business practices, and how to assess and address its impact on your company. A few points from the piece and recent discussions I've had: 🔸Yes, it has roots in a Biden EO, but it is also based on a Trump EO, so don't assume it will be delayed, rewritten, or reversed 🔸Many U.S. companies will be subject to the rule 🔸Common business practices like #OnlineAdvertising can trigger the rule 🔸Exceptions in the rule are narrower than you may expect 🔸EU-style approaches to obtain consent or implement standard contractual provisions for cross-border transfers won't help 🔸The rule is a #NationalSecurity rule that doesn't follow typical #privacy or #dataprotection frameworks 🔸Many data types and combinations are regulated as sensitive under the rule--including contact information, web traffic and analytics data, account usernames, and advertising identifiers 🔸Anonymizing or de-identifying data doesn't bring it out of scope 🔸Existing compliance and vendor diligence practices likely won't meet the rule's requirements 🔸Common #DataSecurity practices and programs may need re-scoping and enhancement The piece has suggestions on how to assess if your company engages in restricted or prohibited transactions under the rule, including with tips when: 1️⃣ Identifying business units and functions dealing with in-scope data 2️⃣ Determining if #vendors, #employees, #contractors, or #investors with access to that data involve restricted transactions 3️⃣ Assessing if other people or entities with access to that data involve prohibited transactions If there are prohibited or restricted transactions, April 8 may be too soon to get into full compliance. The piece has some suggestions for how to triage those transactions in the weeks ahead. For more info, see: 🔹Key questions to assess if the rule applies https://lnkd.in/gcXcVqxG 🔹My slides on #adtech considerations https://lnkd.in/gPVP5j9p 🔹Our blog summarizing the rule https://lnkd.in/gX9Ebukf 🔹The DOJ webpage with information about the rule https://lnkd.in/g5e3aYE2

Understanding Personal Data, Indonesia’s UU PDP vs. the EU GDPR Many organizations still question what qualifies as personal data under the Personal Data Protection Law. Some assume that collecting names or employee data like ID numbers doesn’t count, hoping to avoid compliance. However, the law defines personal data broadly, any information that can identify a person, directly or indirectly, is covered. This includes names, contact details, employment records, and even online identifiers. PDP Law also distinguishes specific personal data, which requires stricter protection due to its sensitive nature. This includes health records, biometrics, financial information, and criminal history. Interestingly, different jurisdictions classify sensitive data differently. The EU’s GDPR considers sexual orientation, religious beliefs, and political views as sensitive due to their potential for discrimination. In contrast, Indonesia mandates religion in official documents but does not categorize sexual orientation as sensitive, reflecting cultural and legal differences. Beyond classification, UU PDP and GDPR take different regulatory approaches. Under GDPR, processing special category data is strictly restricted unless a company meets specific legal justifications, such as explicit consent or legal obligations. Meanwhile, Indonesia’s UU PDP does not explicitly restrict processing sensitive data but automatically considers it high-risk, requiring a Data Protection Impact Assessment (DPIA) to evaluate risks and mitigation measures. Here is a table of the differences between special category data in Indonesian PDP law and GDPR

Is using your preexisting personal data, collected for a different purpose, to train your data an incompatible purpose under GDPR? Belgian DPA says: Yes but allows the use of legitimate interest as the new legal basis. 💡 Important also for US based / operating companies because the new US state privacy laws have the same "incompatible purpose test" BUT require consent as the new legal basis. At issue: a company's use of customers' personal data, (including payment transactions), collected to facilitate the payment - to build and train models to offer personalized discounts for third-party non-banking services and products. Key points: Further processing for building the model for third party discounts is an incompatible new purpose 🔹 If you do not disclose a processing purpose at the outset, further processing may constitute a new purpose. 🔹 Saying that you use customers' transaction data to better know and serve your customers for all marketing and commercial purpose for banking and insurance products is NOT the same as saying you will use it to build models to serve all types of third party commercial partners. 🔹 Customer expectations are key: Here, the customer entrusted his personal and transactional data to the bank as a banking customer and had no reasonable expectation that the bank would use the same data, with no possibility for the customer to object, to train data models that transcend the bank's banking and insurance activities. The appropriate legal basis for the use of the model for third part discounts is consent, but for building the model itself can be legitimate interest. 🔹 Building data models in order to offer customers personalised discounts on third-party products and services is a legitimate interest 🔹 The processing of the data is necessary for the purpose: data models are a necessary intermediate step between the transaction data, and offering personalised discounts through digital means. 🔹 The damage to rights does not outweigh the bank's interest: because here the company processes data where (1) as many identifiers as possible have been removed in order to train a model without applying it to identified individuals in an operational context; (2) no attempts are ever made to re-identify the individuals in the training set; (3) the resulting models are merely algorithms that no longer contain personal data; (4) no personal data is share with third parties and (5) no special categories of personal data are processed. 🔹 Thus: the impact on the individual and the processing of his personal data is kept to a minimum. The individual can still object to the use under Art 21. 🔹 To actually use the model for the third party discount, you need opt in consent. H/t Simon Hania, Romain Robert pic by Vectorjuice on Freepik #dataprivacy #dataprotection #privacyFOMO #AIprivacy

𝐆𝐃𝐏𝐑 <> 𝐃𝐒𝐀 Back in 2017, I led GDPR compliance at Google Trust & Safety, when privacy was at the centre of Europe’s digital regulation journey. Then came the Digital Services Act (DSA), which sprinkled privacy elements into a law meant to tackle online safety. Confused? Me too. Now, the European Commission and the EDPB are finally bringing the two laws together - clarifying how the DSA and GDPR interplay and where their overlaps align. Here are some areas where the overlaps were discussed and aligned: 🪢 𝐂𝐨𝐧𝐭𝐞𝐧𝐭 𝐦𝐨𝐝𝐞𝐫𝐚𝐭𝐢𝐨𝐧 𝐚𝐧𝐝 𝐢𝐧𝐯𝐞𝐬𝐭𝐢𝐠𝐚𝐭𝐢𝐨𝐧𝐬 (𝐀𝐫𝐭𝐢𝐜𝐥𝐞 7 𝐃𝐒𝐀 ↔ 𝐀𝐫𝐭𝐢𝐜𝐥𝐞 6 𝐆𝐃𝐏𝐑):  platforms’ voluntary investigations to detect or remove illegal content often involve analysing user data, which requires a lawful basis under GDPR. 🪢 𝐍𝐨𝐭𝐢𝐜𝐞-𝐚𝐧𝐝-𝐚𝐜𝐭𝐢𝐨𝐧 𝐚𝐧𝐝 𝐜𝐨𝐦𝐩𝐥𝐚𝐢𝐧𝐭 𝐬𝐲𝐬𝐭𝐞𝐦𝐬 (𝐀𝐫𝐭𝐢𝐜𝐥𝐞𝐬 16–20 𝐃𝐒𝐀 ↔ 𝐆𝐃𝐏𝐑):  handling user reports and appeals involves personal data and must comply with data-minimisation and transparency principles. 🪢 𝐃𝐞𝐜𝐞𝐩𝐭𝐢𝐯𝐞 𝐝𝐞𝐬𝐢𝐠𝐧 𝐩𝐚𝐭𝐭𝐞𝐫𝐧𝐬 (𝐀𝐫𝐭𝐢𝐜𝐥𝐞 25 𝐃𝐒𝐀 ↔ 𝐀𝐫𝐭𝐢𝐜𝐥𝐞𝐬 5 & 6 𝐆𝐃𝐏𝐑): both laws prohibit manipulative interfaces that steer users into privacy-intrusive behaviour. 🪢 𝐀𝐝𝐯𝐞𝐫𝐭𝐢𝐬𝐢𝐧𝐠 𝐚𝐧𝐝 𝐩𝐫𝐨𝐟𝐢𝐥𝐢𝐧𝐠 (𝐀𝐫𝐭𝐢𝐜𝐥𝐞 26 𝐃𝐒𝐀 ↔ 𝐀𝐫𝐭𝐢𝐜𝐥𝐞𝐬 9 & 22 𝐆𝐃𝐏𝐑): DSA bans ads based on sensitive data or profiling minors, reinforcing GDPR safeguards. 🪢 𝐏𝐫𝐨𝐭𝐞𝐜𝐭𝐢𝐨𝐧 𝐨𝐟 𝐦𝐢𝐧𝐨𝐫𝐬 (𝐀𝐫𝐭𝐢𝐜𝐥𝐞 28 𝐃𝐒𝐀 ↔ 𝐀𝐫𝐭𝐢𝐜𝐥𝐞𝐬 5–8 𝐆𝐃𝐏𝐑): both require high privacy and safety standards, with minimal data processing. Europe is moving toward a more coherent digital rulebook - where privacy, safety, and accountability finally converge.