• 

Corporate Privacy Processing Norms.

1. Overview: Corporate Privacy Processing Norms

Privacy processing norms govern how corporations collect, use, store, and manage personal data. Under the DPDP Act, 2023, corporations acting as Data Fiduciaries have a legal duty to handle personal data responsibly and in compliance with the law.

The purpose is to protect individual privacy while allowing responsible data use for business and innovation.

2. Core Principles of Data Processing Under DPDP Act

A. Lawfulness and Purpose Limitation

Data must be processed lawfully, fairly, and for specified purposes.

Unconsented or secondary uses of data are prohibited unless explicitly authorized.

B. Consent Requirement

Corporations must obtain explicit, informed, and unambiguous consent from data principals before processing.

Consent must be specific to the purpose and revocable at any time.

C. Data Minimization

Only the minimum amount of data necessary for the purpose may be collected.

Over-collection or storage beyond necessity is prohibited.

D. Transparency & Notice

Data principals must be informed about:

Types of data collected

Purpose of processing

Sharing with third parties

Retention periods

Rights under the DPDP Act

E. Security Safeguards

Corporations must implement technical and organizational measures to prevent unauthorized access, modification, or loss of personal data.

F. Sensitive Personal Data

Special norms apply to sensitive data (health, financial, biometric, religious, sexual orientation, caste/tribe).

Requires heightened consent, stricter security, and sometimes explicit governmental authorization.

G. Rights of Data Principals

Corporations must allow:

Access and correction of data

Erasure of data

Withdrawal of consent

Portability, where applicable

H. Accountability and Record-Keeping

Maintain records demonstrating compliance with DPDP Act obligations, including privacy audits and impact assessments.

3. Corporate Compliance Requirements

Privacy Policy Updates: Must reflect processing norms, consent mechanisms, and third-party sharing.

Employee Training: Staff handling data must understand legal obligations and internal policies.

Data Protection Officer (DPO): Significant Data Fiduciaries must appoint a DPO.

Impact Assessments: Conduct Data Protection Impact Assessments (DPIAs) before new processing operations.

Incident Reporting: Notify Data Protection Board (DPB) and affected individuals in case of a breach.

4. Judicial and Legal Precedents

While the DPDP Act is recent, Indian courts have long developed principles relevant to corporate data processing. Below are six key cases:

Case Law 1 — Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

Supreme Court of India

Recognized informational privacy as a fundamental right under Article 21.

Corporations must respect individuals’ privacy when processing personal data.

Forms the constitutional basis for all corporate privacy processing norms.

Case Law 2 — Puttaswamy (Aadhaar-5J) v. Union of India (2019)

Supreme Court of India

Emphasized necessity and proportionality in data processing.

Corporations must ensure that data collected is necessary and not excessive for the intended purpose.

Case Law 3 — Google India v. Competition Commission of India (2023)

Delhi High Court

Criticized disproportionate collection and processing of personal data.

Corporations must implement data minimization and purpose limitation in line with privacy laws.

Case Law 4 — WhatsApp LLC v. Competition Commission of India (2021)

Delhi High Court

Opaque policies about sharing user data with Facebook raised transparency concerns.

Corporations must clearly inform users about third-party sharing and processing purposes.

Case Law 5 — Malay K. Mahadevan v. State of Tamil Nadu (Madras High Court, 2022)

Highlighted responsibility for data security safeguards.

Corporate entities must prevent unauthorized access or leakage of personal data.

Case Law 6 — Lungowe v. Vedanta Resources plc (UK, 2019)

Parent company held accountable for subsidiary’s mismanagement of data.

Corporations processing data through subsidiaries or third parties must ensure compliance throughout the chain.

5. Key Compliance Themes from Case Law

6. Practical Corporate Steps

Map Data Flows: Understand what personal data is collected, stored, shared, and processed.

Review Privacy Policies: Ensure they comply with DPDP Act principles.

Obtain and Manage Consent: Implement clear consent mechanisms and revocation options.

Implement Security Measures: Encryption, access controls, and monitoring systems.

Conduct Audits: Periodic reviews of compliance and third-party vendor practices.

Train Staff: Employees handling data must understand processing norms and privacy responsibilities.

Breach Preparedness: Have incident response and notification procedures in place.

7. Conclusion

Corporate Privacy Processing Norms under the DPDP Act:

Ensure personal data is processed lawfully, fairly, and transparently.

Require robust consent management, data minimization, and security safeguards.

Mandate accountability across corporate entities and their third-party processors.

Have their roots in constitutional jurisprudence (Puttaswamy) and are reinforced by judicial scrutiny of corporate practices (Google, WhatsApp, Lungowe).

Corporations must integrate privacy by design, maintain continuous compliance audits, and ensure that all processing activities respect the rights of data principals to avoid penalties and litigation.

RELATED Blog

Corporate Law at Afghanistan

Corporate Law at Albania

Corporate Law at Algeria

Corporate Law at American Samoa (US)

Corporate Law at Bangladesh

Corporate Law at Andorra

Corporate Law at Angola

Corporate Law at Antigua and Barbuda

Corporate Law at Anguilla (BOT)

Corporate Law at Argentina