FDPPI is your Privacy Companion

The round table discussion on “Impact of DPDPB 2022 on Health Sector” was conducted by FDPPI in Bangalore on June 10, 2023 at The Pride Hotel, Richmond Circle, Bangalore.

It was well attended by many leading professionals from the Health industry, many entrepreneurs, IS professionals and a very useful discussion took place.

Dr Vikram Venkateswaran of Deloitte, Rajiv Panicker from DNV and Vinay Krishna of LedgerFi were on the headtable with Naavi to lead the discussions. Naavi presented a brief on DPDPB 2022 and it was followed by a series of incidents and how DPDPB 2022 applied and what compliance measures it indicated for the Hospitals and other entities.

During the event the system of Indian National Register of Data Protection Professionals was formally launched.

Some of the pictures below capture the moments during the program.

Today, during the Round Table in Bangalore on “Impact of DPDPB 2022 on Health Sector”, FDPPI is formally launching the Indian Register of Data Protection Professionals by issuing its certificate to one of the registered professional. Other certificates will be issued by tomorrow.

This event is a physical event and registrations are closed.

FDPPI has finalized arrangements with Proctor360 for proctoring the upcoming Certification examinations to be conducted under tNV program on Data Protection and FDPPI-CLC program on Cyber Law.

FDPPI has also finalized arrangements for issue of Certificates for the Examinations as well as the Indian Register of Data Protection Professionals with Certopus. The design and format are being finalized and the issue of Certificates will start shortly.

“Data” is a sequence of binaries having a humanly perceivable meaning. If it is in a chaotic distribution, we call it as “Gibberish” and does not give any meaning to a human observer. But when data is arranged in bits and bytes the computers with the right kind of interpreters can bring before us a text or audio or video.

If the observer has some innate knowledge, he understands the data as being related to an individual living or dead or of an inanimate object Experts in different domains can see the data and interpret as indicative of more sensitive meaning. Thus the classification of a binary sequence as personal or non personal data is purely human interpretation of binary information with the use of certain computing devices.

If this theory is accepted, it looks that “Data Protection Skill” should also merge between Personal Data Protection and Non Personal Data Protection.

Recognizing this futuristic scenario, FDPPI has launched two Certification programs one in association with DNV for Personal Data Protection and another in association with Cyber Law College for Non Personal Data Protection. The foundation for Data Protection Certification is DPDPB 2022 as an extension of ITA 2000 and GDPR.

The Foundation for Non Personal Data Protection is ITA 2000 extended into the amendments of 2008 and the upcoming DIA. The future of Data Protection Professionals is an area of super specialization where they will be conversant with laws applicable to personal data as well as laws applicable to non personal data. This “Super Speciality Trend” is a pioneering effort of FDPPI. At the end of the successful completion of the two programs the participants would be able to claim two Certifications namely CDPP (Certified Data Protection Professional) and CCLP (Certified Cyber Law Professional). CDPP Certification will be issued under the joint certification of FDPPI-CDPP and CCLP Certification will be issued under the joint certification of FDPPI-CCLP. The two Certifications are offered individually and can be taken separately.

CDPP program is a completely instructor led online program for 24 plus hours and would cost Rs 40000/- (with Examination)

CCLP program is partly instructor led and partly of recorded online sessions of approximately 20 hours and would cost Rs 7000/-(with Examination)

Those who donot want to take examination/s may opt to take participation certificates by attending the program/s at a reduced cost of Rs 35000/- and Rs 6000/- for CDPP and CCLP programs respectively.

These programs come with a guarantee of additional sessions if the Bills based on which the current curriculum is designed become laws with some changes. It is an one time automatic upgradation guarantee.

For Registration and Payment follow these links

Payment for FDPPI-DNV Data Protection Program

Payment for FDPPI-CLC Cyber Law Program

Kindly note that there are two separate programs. Both will start on June 17th. FDPPI-DNV program will be at 10.30 am and FDPPI-CLC program will be at 3.30 pm. Further instructions will be made to the registrants separately.

India started legislation on Data Protection first with ITA 2000. Initially there was no distinction between protection of non personal data and personal data and ITA 2000 was considered the legislation for “Cyber Security”. At that time “Compliance” was related to “Compliance of ITA 2000” and the framework being used for the IISF 309 (Indian Information Security Framework developed by Naavi). Many were using the ISO 27001 framework also while IISF 309 focussed on the ITA 2000/8 compliance directly.

Subsequently during the 2008 amendments, sections such as Section 43A were added to the ITA 2000 and the demand for special compliance provisions related to Personal Data was addressed.

After the demand for more focussed “Privacy Protection” arose from the Supreme Court decisions on Aadhaar and later the Puttaswamy judgement and the recommendations of the Justice Srikrishna Committee, the thought of having a replacement law for Section 43A was mooted. Halfway down the PDPB 2019 draft was changed to DPA 2021 trying to bring at least the data breach notification of non personal data into the personal data legislation. This was discarded in the latest DPDPB 2022.

However, it cannot be denied that the life cycle of Personal Data includes its status as non personal data either before the identity parameters are tagged to the core personally identifiable data or after anonymization. Hence the protection of “Personal Data” cannot be too distanced from “Protection of Non Personal Data”. Many of the CISOs in fact do double up as DPOs though it is not recommended because DPO requires lot more legal knowledge than CISO.

FDPPI followed the demand arising from GDPR and started its activity focussing more on protection of personal data. Naavi as a person came from the non personal data protection specialization and included personal data protection into his portfolio. Cyber Law College which is the training partner of FDPPI and which is the pioneering virtual education institution in India was conducting Cyber Law Courses and added Data Protection Courses to its portfolio.

Presently a need has arisen whereby DPOs and Privacy Managers should also have adequate exposure to ITA 2000 and the consequent legal issues which directly influence the Information Security obligations. Just as non compliance of DPDPB 2022 may result in administrative fines, non compliance of ITA 2000 may result in penalties and even imprisonment of corporate officials. Hence knowing ITA 2000 is necessary for Corporate employees aspiring to be Data Protection Professionals.

Very shortly, Government of India is coming up with a new law called Digital India Act to replace ITA 2000/8 and it will include several issues related to handling of personal data also.

It has therefore been decided that FDPPI will also provide the umbrella certification for ITA 2000 or DIA courses as we go forward.

Since Cyber Law College had contemplated a course on DIA almost together with FDPPI-DNV program on Personal Data Protection, a one day special offer has been provided applicable only for today as an Early Bird Incentive where by, a subscription of the FDPPI-DNV program (Rs 35000/- upto May 31st midnight) along with the Course on Cyber Laws would be available at Rs 41000/- with a Cash payback of Rs 1000/- in the form of PayTM/Amazon vouchers and also free copies of Naavi’s E book on ITA 2000.

Further the Certificate of the Cyber Law Course will also be endorsed under the umbrella of FDPPI and a separate category will be opened in the Indian National Register of Data Protection Professionals for Cyber Law Professionals.

Those interested may avail of this benefit.

The links for registration is available below with more information:

Link for Data Protection Course:

Link for Cyber Law Course:

Last Day for Early Bird Discount is 31st May 2023

Naavi

Cyber Law College which is the training partner of FDPPI (Foundation of Data Protection Professionals in India) is launching the next online program for “Certified Data Protection Professional” from June 17, 2023.

The program is being conducted on behalf of FDPPI and DNV-GL who will provide certifications for the participants and those who take an online examination.

The program will consist of 24 hours of online discussion on Saturdays and Sundays from 10.30 am to 1.30 pm as per the following schedule.

The training will be followed by an optional online Examination which will be optional.

All participants will be given “Participation Certificates” in the name of FDPPI and DNV-GL . Those who take the examination and complete it successfully will be provided the Certificate as “Certified Data Protection Professional” and would be featured in the “Register of Data Protection Professionals” created by FDPPI.

The Fee for the program is Rs 35000/- (Inclusive of GST)

Examination fee for Certification is Rs 6000/- (Inclusive of GST)

(If examination is taken along with the training, the total fee would be Rs 40000/- inclusive of GST)

The maintenance of the entry in the “Register of Data Protection Professionals” and complimentary membership (Basic No Voting) of FDPPI would be as per the rules of renewal by FDPPI.

Currently FDPPI is charging Rs 5000 and Rs 9000/- for entry into Level 2and 3 of the Register . Basic membership (Non Voting) is offered for Rs 6000/- (inclusive of GST) Those who go through this program and pass the examination will be eligible for waiver of the fee for Basic membership and registration in this register either at Level 2 or at Level 3 .

The total number of participants in this group may be limited. Hence early registration should help.

Early bird discount: For registration upto 31st May 2023. Waiver of Examination fee waived.

Kindly register if interested here with payment.

Course on Cyber Law extended to Digital India Act

Cyber Law College has been conducting Cyber Law Course, details of which are available on www.cyberlawcollege.in. This is now been extended to the new Digital India Act that has been announced by the Government now. According to the announcement made by the Government, the draft of the new Digital India Act would be available in June 2023 and it will be discussed during this course as an extension.

This course will therefore be updating the professionals right from the day the draft is available.

FDPPI has so far certified 44 Data Protection Officers besides over hundred professionals who have completed individual modules of the Certification program. They are presently maintained as members of an exclusive DPO club.

Now FDPPI is creating an “Indian Register of Data Protection Professionals” which will consist of all professionals who exhibit a designated level of knowledge related to being a Data Protection Professional in India.

While FDPPI will continue to conduct training programs to develop these skills, direct claim to the entry into these registers will be open to those who are self trained or trained organizations other than FDPPI.

There will be three categories of registration. First category would be based on Self declaration of capability. For this purpose, the experience would also be a criteria. Second category would be based on getting trained through accredited FDPPI programs. The third category is for those passing the FDPPI examination.

All the persons who have currently been in the FDPPI DPO club will be considered as Registered members of level 2 and they need not pay any fees for entry into this register.

New Persons will be registered on the basis of self declaration (watch out for full information in the following announcement) at a fee of Rs 3000/- (Inclusive of GST) as Category-1 registrants.

Those who go through the training programs of FDPPI would be eligible for registration at Category- 2. If they pass the online examination, they will be eligible for Category-3 registration.

Fees for Caegory-2 would be Rs 5000 (inclusive of GST) and Fees for Category 3 would be Rs 9000/-(inclusive of GST). Category-3 registrants are expected to match the requirements to be specified by the Indian Data Protection Board for conducting annual and concurrent Data Audits.

FDPPI may waive the initial registration fee/bundle it with the training fee as it may desire from time to time for those who attend the paid Certification programs. (Eg: Training starting on June 17 where training and examination fee is Rs 40000/-includes the Category 3 registration fee of Rs 9000).

All registrations are renewable once in 3 years at a renewal fee of 50% of the cost of registration now indicated . (Subject to modification)

Since this register is meant to keep track of the skills required on an ongoing basis, the entries will get de-activated if not renewed. Renewal is once in 3 years and will involve a limited online refresher quiz. The renewal fee would be announced by FDPPI in due course.

Those of you who want to include your name in the register may kindly provide the details here.

FDPPI is embarking on celebration of the International Data Privacy Day 2023 with a unique project to obtain a “Data Privacy Pledge” from the community.

Those who take the pledge would be issued a certificate as below.

The pledge can be taken at this URL: https://forms.gle/o1jwDf1L3KuDDUd36

The pledge reads as follows:

Pledge of Data Privacy

On the occasion of International Data Privacy Day 2023,  I hereby take a voluntary pledge to uphold the cause of “Privacy as a Human Right” by taking all steps necessary for Protection and Privacy of Personal data which I shall come across in my Professional and Personal life with due regard to the Principles of Fairness and Lawfulness of processing.

In particular:

I shall adhere to the requirement of obtaining informed consent of the data principals whose personal information comes within my control and shall use, disclose such information only as per the choice of the data principal and in accordance with the applicable laws.

I shall adhere to the principle of Minimal and  purpose oriented Collection of personal data and shall ensure that it shall be shared only on a need to know basis.

I shall take necessary steps to stop using personal information if the purpose for which it came into my possession has been completed.

I shall take necessary steps to ensure that the personal data is kept updated from time to time.

I shall not disclose the personal information except as provided under law or in the genuine interest of the individual or the community.

I shall at all times take steps to ensure the security of the personal data from unauthorized access or modification or denial of access for authorized purposes.

I shall take all necessary steps to comply with the data protection law with regard to reporting of data breach or any other requirement of compliance.

I shall endeavour to keep myself aware of the data protection laws and also spread awareness in my organization and with my professional and personal contacts.

CLICK HERE TO TAKE THE PLEDGE

P.S: The pledge document would be available upto February 18, 2023.

FDPPI thanks the team of Dr Anirban Ghosh, Sathyavageeswaran, Ramesh Kauta and Subbarayudu Tallapragada for facilitating this “Data Privacy Pledge” as a concept.

Digital Personal Data Protection Bill 2022 is here.  It is time for organizations to start planning for compliance.

FDPPI is preparing itself to meet the demand for Consultancy regarding Data Protection Compliance in India by setting up a separate division to provide the services.

For this purpose FDPPI will be providing an affiliation to the Federation of Data Protection Consultants (FDPC) and provide a platform for rendering the services by accredited service providers.

FDPPI will continue its activities as a Privacy Advocacy platform and the consultancy would be undertaken by FDPC.  Every member of FDPC needs to be affiliated to FDPPI.

Accreditation will be based on application and review by the Board. A fee will be prescribed for accreditation. The accreditation fee will be waived upto December 31, 2022 for  supporting members and corporate members.

An appropriate accreditation form will be available for application.

FDPC will be managed as a profit center by a designated professional.

VISIT HERE FOR FURTHER INFORMATION, REGISTRATION AND ENQUIRY

FDPPI is dedicated as a Not for profit organization to render various activities related to Data Protection.

However, FDPPI is an organization which has adopted the banyan model of development where we will encourage multiple branches to grow and establish roots of their own so that the banyan tree is supported by many. Presently the stem is represented by the patron members who have dedicated themselves to the development of FDPPI. In due course other supporting members are expected to start developing themselves into supporting the tree by becoming its aerial routes that grow into the ground.

The Banyan tree is expected to be eternal and even after the trunk is lost, the tree will survive. FDPPI is one such organization which has to grow indefinitely.

In tune with this policy, FDPPI is in the process of re-launching its Consultancy operations under a special Data Protection Compliance Consultancy window. This window will be headed by a professional as a “Profit Center Manager”. Under the plan, the surplus generated by the division will be shared with the Profit Center manager as a variable revenue.

Naavi