Processes biometric data, in India

Information Technology Act, 2000 (No. 21 of 2000), s.43A; Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (G.S.R. 313(E), 11 April 2011), rr. 3, 4, 5, 6, 8 · Read the law's page

• This binds a body corporate that possesses, deals in, or handles the sensitive personal data or information of a person, meaning a password, a financial account or payment-instrument detail, a physical, physiological, or mental health condition, sexual orientation, a medical record or history, or biometric information, in a computer resource it owns, controls, or operates; information that is freely available in the public domain or obtainable under the Right to Information Act, 2005 is not sensitive personal data or information under these Rules.
• Implement and maintain a comprehensive, documented information security programme with managerial, technical, operational, and physical control measures commensurate with the information assets you protect and the nature of your business; certifying to the international Standard IS/ISO/IEC 27001, or to a Central-Government-approved industry code of best practice, satisfies this duty as a matter of law, provided the certification is audited by an independent, government-approved auditor at least once a year or after a significant upgrade to your process or computer resource.
• Obtain the data provider's written consent, by letter, fax, or email, before collecting their sensitive personal data or information, let them decline or withdraw that consent, publish a privacy policy on your website, and designate a Grievance Officer who must resolve a complaint within one month.
• Negligently failing to implement or maintain these practices, where it causes wrongful loss or wrongful gain to any person, exposes you to an uncapped compensation claim under section 43A of the Information Technology Act; no criminal penalty attaches to section 43A itself.
• This duty is in effect now and is repealed once section 44(2) of the Digital Personal Data Protection Act, 2023 commences, currently scheduled for 13 May 2027; the DPDPA's own security-safeguards duty (section 8(5)) does not commence until the same date, so these Rules remain the operative standard until then.

Directions under section 70B(6) of the Information Technology Act, 2000, No. 20(3)/2022-CERT-In (Indian Computer Emergency Response Team, Ministry of Electronics and Information Technology, 28 April 2022) · Read the law's page

• Connect all your ICT systems' clocks to the Network Time Protocol server of the National Informatics Centre or the National Physical Laboratory, or to an NTP server traceable to one of them, and ensure any other time source you use does not deviate from NPL or NIC.
• Report a listed cyber security incident, including a targeted attack, a data breach, a data leak, unauthorised access to your IT systems, an attack through a malicious or fake mobile app, or an attack on, or malicious or suspicious activity affecting, an AI or machine learning system, to CERT-In within six hours of noticing it or being notified of it, by email, phone, or fax; current reporting formats and channels are published on CERT-In's own website.
• Enable logs of all your ICT systems and retain them securely, within Indian jurisdiction, on a rolling 180-day basis, and provide them to CERT-In together with an incident report or when CERT-In orders or directs you to.
• Designate a Point of Contact to interface with CERT-In, using the format CERT-In publishes, and keep that designation current.
• If your own service is itself a data centre, a virtual private server provider, a cloud service provider, a virtual private network service, or a virtual asset (crypto) service provider, a narrower and heavier duty also applies: register and retain specified customer KYC information and financial-transaction records for five years. That narrower bound-party class is not one this profile's declared activities can identify on their own, so confirm applicability directly against the text if this describes your service.
• This binds a service provider, intermediary, data centre, body corporate, or Government organisation, the Information Technology Act's own general terms for essentially any commercial or professional actor operating a computer resource in India, not a licensed or sector-specific status; a company distributing software or operating a mobile app in India falls within this reach without needing a specific regulatory registration.
• Failing to furnish information CERT-In calls for, or to comply with a direction it issues, including these Directions, is punishable under section 70B(7) of the Information Technology Act with imprisonment for up to one year, a fine of up to one lakh rupees, or both.

Digital Personal Data Protection Act, 2023 (DPDPA), Data Protection Board and penalties, ss.18-26, 33, 39 · Read the law's page

• An app processing Indian personal data, including biometric identifiers, answers only to the Data Protection Board of India: the civil courts have no jurisdiction over a matter the Board is empowered to decide, and the Act arms no private plaintiff.

Digital Personal Data Protection Act, 2023 (DPDPA), No. 22 of 2023, breach notification, s.8(6) · Read the law's page

• An app must notify the Data Protection Board and each affected data principal of a personal data breach, including one covering a biometric identifier, without delay, and must supply the Board a detailed follow-up report within 72 hours of becoming aware of the breach.

Digital Personal Data Protection Act, 2023 (DPDPA), No. 22 of 2023, cross-border transfer, s.16 · Read the law's page

• Under India's Digital Personal Data Protection Act, an app may transfer the personal data of an Indian data principal, including a voiceprint or other biometric identifier, to any country or territory by default, unless the Central Government has notified that destination as restricted.

Digital Personal Data Protection Act, 2023 (DPDPA), No. 22 of 2023, data subject rights, ss.11-14 · Read the law's page

• An app must give a data principal a way to exercise their rights to access, correct, complete, update, or erase their personal data, including a stored voiceprint or faceprint, and to nominate another person to exercise these rights, directly against it, with escalation to the Data Protection Board available only after the app's own grievance process is exhausted.

Digital Personal Data Protection Act, 2023 (DPDPA), No. 22 of 2023, ss.2(t), 4, 6, 7, 8 · Read the law's page

• Under India's Digital Personal Data Protection Act, an app that collects, uses, or discloses the personal data of an individual in India, including a voiceprint, faceprint, or other biometric identifier, which the Act treats as ordinary personal data since it has no separate sensitive-category tier, needs a lawful basis under section 4, ordinarily the data principal's free, specific, informed, and unambiguous consent under section 6, or one of section 7's enumerated legitimate uses.