Just as the DPDPB 2023 was tabled in the Parliament on 3rd August 2023, FDPPI as the most committed data protection organization of India, held a Virtual Roundtable on 4th August 2023. Manipal Law School, (MLS) part of the Manipal Academy of Higher Education (MAHE) partnered FDPPI in this event.
The roundtable discussed several issues surrounding the bill including whether DPDPB2023 is a money bill, the rights and obligations under the bill, Whether DPB is well constituted, etc.
Dr Avinash Dadhich, Dean of MLS was the special guest and participated actively in the discussions.
The event also marked the first event conducted by FDPPI partnering MLS and look forward to more such events.
Personal Data Protection and Governance Management (PDPGM) in a corporate entity is a complex journey.
-It requires discovery and tracking of the data asset, Classification into different categories of data, Different Sensitivity types, Different Law jurisdictions, Different Value buckets etc.
-It also requires applying Organizational and Technical measures appropriate to each type of data and building a Privacy and Data Protection Culture across an organization.
-It also includes Data Governance aspect of “Monetization” and “Cross Border Transfer” strategies that are Law compliant.
Current approach of all organizations is for a Company to establish Privacy by Design Program involving management of “Legal basis” for personal data collection and processing, “Security measures” for protecting the Confidentiality, Integrity and Availability of digital information, which is monitored by the Data Protection Officer and periodically audited by an external Data Auditor.
In this process the Company is responsible for understanding the requirements, converting them into Policy and Technology controls and the Auditors verify and give their expert views.
In a scenario where the Privacy and Data Protection scenario is evolving and new laws are appearing every other day, new interpretations are evolving every day, a company engaged in productive business has to divert a large part of its resources to meet the requirements. In a large organization, there is a need to set up a Privacy Department and a DPO to supplement its CEO/CRO/CCO to achieve an acceptable level of compliance.
FDPPI as an organization with an objective of empowerment of the Data Protection eco system in India, has adopted an approach of Concurrent Consulting which involves a close interaction with the company in the designing and implementation of the Privacy and Data protection program with Concurrent audit and Continuous improvement.
In this model, a team of FDPPI is associated as an external PDPM consultant and works closely with the Company in assisting the designated Privacy Management team and the DPO. The project is managed by the designated Supporting members of FDPPI.
This is the “Partner In Progress” (PIP) approach of FDPPI where the FDPPI team would be involved in designing of the PDPM program, assisting the Company in its implementation and periodically reviewing the functioning of the PDPM program, suggesting and implementing corrections on a continuous PDCA cycle.
It is expected that this approach would be more suitable to the Indian market which is in the developmental stage where Privacy as a concept is new and companies have to put in extra efforts to adopt to the new global culture where Privacy infringements are considered one of the biggest regulatory threats which could result in penalties reaching upto a billion US dollar.
The engagement would be on a retainer basis with additional services sourced either from within the supporting member network or outside and billed as necessary. The team would design and implement the system on a best effort basis.
The system of an external data auditor which is inherent in the Indian law will ensure that the work of the FDPPI consultancy team is reviewed by an external auditor and should satisfy the puritans who fear conflict.
It is desired that after the system is stabilized, the FDPPI team can exit and handover the maintenance to an internal Privacy and Data Protection management team.
This arrangement is considered ideal when an organization is going through a Digital Transformation and implementing a switchover from the current privacy nd Data Protection regime under ITA 2000 to the DPDPB regime.
[PS: The enrolment for the program will be available on the virtual mode: Kindly visit https://fdppi.in/wp/fdppi-dnv-cdpp-2023/ for the current version of the program and enrolment]
You have heard about CIPP or DCPLA or CDPSE. Each Certification has a value. Each has an objective to make you conversant with some aspect of Data Protection. But FDPPI-DNV’s CDPP program is different. If it is supplemented with FDPPI-CLC’s CCLP it is even better.
CDPP.CCLP program of FDPPI is a one of kind program that imparts expertise on the knowledge of Indian Data Protection laws, past, present and future, Key Global data Protection laws of the present, and the Indian Cyber Laws, past, present and future.
The program is conducted over virtual interaction as well as through recorded program.
Option is provided to take participation certificate without taking the examination. If an online examination is successfully completed, the participants can get the fully empowered certificate. The examination will also be online and would be proctored.
The faculty will be Naavi, one of the veteran teachers of Cyber Law and Data Protection in India.
The curriculum for the two courses are given below.
FDPPI-DNV Data Protection Program
FDPPI-CLC Cyber Law Program
The Schedule for the program is as follows:
FDPPI-DNV Data Protection Program
FDPPI-CLC Cyber Law Program
10.30 am to 1.30 am on June 17,18 June 24,25 July 1,2 July 8,9 Recorded sessions would be made available including some from outside the sessions on these days. Total Video content would be more than 30 hours.
Recorded videos for 14 hours plus interactive sessions between 3.30 pm and 5.00 pm on June 17, 24 July 1, 2
The Fees for the programs is as follows:
Type
FDPPI-DNV Data Protection Program
FDPPI-CLC Cyber Law Program
Both Programs together
Participation only
35000
6000
40000
Examination
6000
2000
7000
Participation with Examination
40000
7000
45000
Basic Membership of FDPPI worth Rs 6000
Complimentary
Rs 5000 (valid for next 1 month)
Complimentary
Entry in the Indian National Register of Data Protection Professionals
The round table discussion on “Impact of DPDPB 2022 on Health Sector” was conducted by FDPPI in Bangalore on June 10, 2023 at The Pride Hotel, Richmond Circle, Bangalore.
It was well attended by many leading professionals from the Health industry, many entrepreneurs, IS professionals and a very useful discussion took place.
Dr Vikram Venkateswaran of Deloitte, Rajiv Panicker from DNV and Vinay Krishna of LedgerFi were on the headtable with Naavi to lead the discussions. Naavi presented a brief on DPDPB 2022 and it was followed by a series of incidents and how DPDPB 2022 applied and what compliance measures it indicated for the Hospitals and other entities.
During the event the system of Indian National Register of Data Protection Professionals was formally launched.
Some of the pictures below capture the moments during the program.
Today, during the Round Table in Bangalore on “Impact of DPDPB 2022 on Health Sector”, FDPPI is formally launching the Indian Register of Data Protection Professionals by issuing its certificate to one of the registered professional. Other certificates will be issued by tomorrow.
This event is a physical event and registrations are closed.
FDPPI has finalized arrangements with Proctor360 for proctoring the upcoming Certification examinations to be conducted under tNV program on Data Protection and FDPPI-CLC program on Cyber Law.
FDPPI has also finalized arrangements for issue of Certificates for the Examinations as well as the Indian Register of Data Protection Professionals with Certopus. The design and format are being finalized and the issue of Certificates will start shortly.
“Data” is a sequence of binaries having a humanly perceivable meaning. If it is in a chaotic distribution, we call it as “Gibberish” and does not give any meaning to a human observer. But when data is arranged in bits and bytes the computers with the right kind of interpreters can bring before us a text or audio or video.
If the observer has some innate knowledge, he understands the data as being related to an individual living or dead or of an inanimate object Experts in different domains can see the data and interpret as indicative of more sensitive meaning. Thus the classification of a binary sequence as personal or non personal data is purely human interpretation of binary information with the use of certain computing devices.
If this theory is accepted, it looks that “Data Protection Skill” should also merge between Personal Data Protection and Non Personal Data Protection.
Recognizing this futuristic scenario, FDPPI has launched two Certification programs one in association with DNV for Personal Data Protection and another in association with Cyber Law College for Non Personal Data Protection. The foundation for Data Protection Certification is DPDPB 2022 as an extension of ITA 2000 and GDPR.
The Foundation for Non Personal Data Protection is ITA 2000 extended into the amendments of 2008 and the upcoming DIA. The future of Data Protection Professionals is an area of super specialization where they will be conversant with laws applicable to personal data as well as laws applicable to non personal data. This “Super Speciality Trend” is a pioneering effort of FDPPI. At the end of the successful completion of the two programs the participants would be able to claim two Certifications namely CDPP (Certified Data Protection Professional) and CCLP (Certified Cyber Law Professional). CDPP Certification will be issued under the joint certification of FDPPI-CDPP and CCLP Certification will be issued under the joint certification of FDPPI-CCLP. The two Certifications are offered individually and can be taken separately.
CDPP program is a completely instructor led online program for 24 plus hours and would cost Rs 40000/- (with Examination)
CCLP program is partly instructor led and partly of recorded online sessions of approximately 20 hours and would cost Rs 7000/-(with Examination)
Those who donot want to take examination/s may opt to take participation certificates by attending the program/s at a reduced cost of Rs 35000/- and Rs 6000/- for CDPP and CCLP programs respectively.
These programs come with a guarantee of additional sessions if the Bills based on which the current curriculum is designed become laws with some changes. It is an one time automatic upgradation guarantee.
Kindly note that there are two separate programs. Both will start on June 17th. FDPPI-DNV program will be at 10.30 am and FDPPI-CLC program will be at 3.30 pm. Further instructions will be made to the registrants separately.
India started legislation on Data Protection first with ITA 2000. Initially there was no distinction between protection of non personal data and personal data and ITA 2000 was considered the legislation for “Cyber Security”. At that time “Compliance” was related to “Compliance of ITA 2000” and the framework being used for the IISF 309 (Indian Information Security Framework developed by Naavi). Many were using the ISO 27001 framework also while IISF 309 focussed on the ITA 2000/8 compliance directly.
Subsequently during the 2008 amendments, sections such as Section 43A were added to the ITA 2000 and the demand for special compliance provisions related to Personal Data was addressed.
After the demand for more focussed “Privacy Protection” arose from the Supreme Court decisions on Aadhaar and later the Puttaswamy judgement and the recommendations of the Justice Srikrishna Committee, the thought of having a replacement law for Section 43A was mooted. Halfway down the PDPB 2019 draft was changed to DPA 2021 trying to bring at least the data breach notification of non personal data into the personal data legislation. This was discarded in the latest DPDPB 2022.
However, it cannot be denied that the life cycle of Personal Data includes its status as non personal data either before the identity parameters are tagged to the core personally identifiable data or after anonymization. Hence the protection of “Personal Data” cannot be too distanced from “Protection of Non Personal Data”. Many of the CISOs in fact do double up as DPOs though it is not recommended because DPO requires lot more legal knowledge than CISO.
FDPPI followed the demand arising from GDPR and started its activity focussing more on protection of personal data. Naavi as a person came from the non personal data protection specialization and included personal data protection into his portfolio. Cyber Law College which is the training partner of FDPPI and which is the pioneering virtual education institution in India was conducting Cyber Law Courses and added Data Protection Courses to its portfolio.
Presently a need has arisen whereby DPOs and Privacy Managers should also have adequate exposure to ITA 2000 and the consequent legal issues which directly influence the Information Security obligations. Just as non compliance of DPDPB 2022 may result in administrative fines, non compliance of ITA 2000 may result in penalties and even imprisonment of corporate officials. Hence knowing ITA 2000 is necessary for Corporate employees aspiring to be Data Protection Professionals.
Very shortly, Government of India is coming up with a new law called Digital India Act to replace ITA 2000/8 and it will include several issues related to handling of personal data also.
It has therefore been decided that FDPPI will also provide the umbrella certification for ITA 2000 or DIA courses as we go forward.
Since Cyber Law College had contemplated a course on DIA almost together with FDPPI-DNV program on Personal Data Protection, a one day special offer has been provided applicable only for today as an Early Bird Incentive where by, a subscription of the FDPPI-DNV program (Rs 35000/- upto May 31st midnight) along with the Course on Cyber Laws would be available at Rs 41000/- with a Cash payback of Rs 1000/- in the form of PayTM/Amazon vouchers and also free copies of Naavi’s E book on ITA 2000.
Further the Certificate of the Cyber Law Course will also be endorsed under the umbrella of FDPPI and a separate category will be opened in the Indian National Register of Data Protection Professionals for Cyber Law Professionals.
Those interested may avail of this benefit.
The links for registration is available below with more information:
Cyber Law College which is the training partner of FDPPI (Foundation of Data Protection Professionals in India) is launching the next online program for “Certified Data Protection Professional” from June 17, 2023.
The program is being conducted on behalf of FDPPI and DNV-GL who will provide certifications for the participants and those who take an online examination.
The program will consist of 24 hours of online discussion on Saturdays and Sundays from 10.30 am to 1.30 pm as per the following schedule.
The training will be followed by an optional online Examination which will be optional.
All participants will be given “Participation Certificates” in the name of FDPPI and DNV-GL . Those who take the examination and complete it successfully will be provided the Certificate as “Certified Data Protection Professional” and would be featured in the “Register of Data Protection Professionals” created by FDPPI.
The Fee for the program is Rs 35000/- (Inclusive of GST)
Examination fee for Certification is Rs 6000/- (Inclusive of GST)
(If examination is taken along with the training, the total fee would be Rs 40000/- inclusive of GST)
The maintenance of the entry in the “Register of Data Protection Professionals” and complimentary membership (Basic No Voting) of FDPPI would be as per the rules of renewal by FDPPI.
Currently FDPPI is charging Rs 5000 and Rs 9000/- for entry into Level 2and 3 of the Register . Basic membership (Non Voting) is offered for Rs 6000/- (inclusive of GST) Those who go through this program and pass the examination will be eligible for waiver of the fee for Basic membership and registration in this register either at Level 2 or at Level 3 .
The total number of participants in this group may be limited. Hence early registration should help.
Early bird discount: For registration upto 31st May 2023. Waiver of Examination fee waived.
Cyber Law College has been conducting Cyber Law Course, details of which are available on www.cyberlawcollege.in. This is now been extended to the new Digital India Act that has been announced by the Government now. According to the announcement made by the Government, the draft of the new Digital India Act would be available in June 2023 and it will be discussed during this course as an extension.
This course will therefore be updating the professionals right from the day the draft is available.
FDPPI has so far certified 44 Data Protection Officers besides over hundred professionals who have completed individual modules of the Certification program. They are presently maintained as members of an exclusive DPO club.
Now FDPPI is creating an “Indian Register of Data Protection Professionals” which will consist of all professionals who exhibit a designated level of knowledge related to being a Data Protection Professional in India.
While FDPPI will continue to conduct training programs to develop these skills, direct claim to the entry into these registers will be open to those who are self trained or trained organizations other than FDPPI.
There will be three categories of registration. First category would be based on Self declaration of capability. For this purpose, the experience would also be a criteria. Second category would be based on getting trained through accredited FDPPI programs. The third category is for those passing the FDPPI examination.
All the persons who have currently been in the FDPPI DPO club will be considered as Registered members of level 2 and they need not pay any fees for entry into this register.
New Persons will be registered on the basis of self declaration (watch out for full information in the following announcement) at a fee of Rs 3000/- (Inclusive of GST) as Category-1 registrants.
Those who go through the training programs of FDPPI would be eligible for registration at Category- 2. If they pass the online examination, they will be eligible for Category-3 registration.
Fees for Caegory-2 would be Rs 5000 (inclusive of GST) and Fees for Category 3 would be Rs 9000/-(inclusive of GST). Category-3 registrants are expected to match the requirements to be specified by the Indian Data Protection Board for conducting annual and concurrent Data Audits.
FDPPI may waive the initial registration fee/bundle it with the training fee as it may desire from time to time for those who attend the paid Certification programs. (Eg: Training starting on June 17 where training and examination fee is Rs 40000/-includes the Category 3 registration fee of Rs 9000).
All registrations are renewable once in 3 years at a renewal fee of 50% of the cost of registration now indicated . (Subject to modification)
Since this register is meant to keep track of the skills required on an ongoing basis, the entries will get de-activated if not renewed. Renewal is once in 3 years and will involve a limited online refresher quiz. The renewal fee would be announced by FDPPI in due course.
Those of you who want to include your name in the register may kindly provide the details here.
