Let distributed teams work on sensitive data without multiplying uncontrolled copies

Section 2(k) of the Digital Personal Data Protection Act, 2023 defines a Data Processor as any person who processes personal data on behalf of a Data Fiduciary, and Section 8(2) provides that a Data Fiduciary may engage, appoint, use or otherwise involve a Data Processor to process personal data on its behalf for any activity related to offering of goods or services to Data Principals only under a valid contract. Section 8(1) makes the Data Fiduciary responsible for compliance in respect of any processing undertaken by it or on its behalf by a Data Processor. Indian service providers and capability centres routinely sit on the processor side of that arrangement.

Section 8(5) of the same Act requires a Data Fiduciary to protect personal data in its possession or under its control, including in respect of any processing undertaken by it or on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach. Section 8(7)(b) requires the fiduciary to cause its Data Processor to erase any personal data that was made available for processing. Entry 1 of the Schedule provides a penalty that may extend to two hundred and fifty crore rupees for breach of the Section 8(5) obligation. Copies retained after an engagement ends sit directly against both duties.

The CERT-In Directions of 28 April 2022 apply to service providers, intermediaries, data centres, body corporate, and Government organisations. Direction (ii) requires the cyber incidents listed in Annexure I, which expressly include unauthorised access of IT systems or data, data breach, and data leak, to be reported to CERT-In within 6 hours of noticing them or being brought to notice about them. Direction (iv) requires logs of all ICT systems to be enabled and maintained securely for a rolling period of 180 days, and provides that the same shall be maintained within the Indian jurisdiction.

Section 43A of the Information Technology Act, 2000, as amended, provides that where a body corporate possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, it shall be liable to pay damages by way of compensation. The Explanation defines reasonable security practices and procedures as those designed to protect such information from unauthorised access, damage, use, modification, disclosure or impairment, as may be specified in an agreement between the parties. For an outsourced provider, the client's security schedule is part of the legal test.

A press note issued through the Press Information Bureau by the Ministry of Communications and Information Technology on 24 August 2011 clarifies the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011, notified on 11.4.2011 vide notification no. G.S.R. 313(E). It records that any body corporate providing services relating to collection, storage, dealing or handling of sensitive personal data or information under contractual obligation with any legal entity located within or outside India is not subject to the requirement of Rules 5 and 6, while a body corporate providing services to the provider of information under a contractual obligation directly with them is subject to those rules. The carve-out is about consent and disclosure, not about security.

The SEBI (Listing Obligations and Disclosure Requirements) (Second Amendment) Regulations, 2023 inserted Regulation 27(2)(ba), under which details of cyber security incidents or breaches or loss of data or documents are to be disclosed along with the quarterly corporate governance report, as may be specified. Listed Indian IT services, engineering services, and business process companies sit inside that reporting obligation alongside their client contractual duties.

Article 28(3) of Regulation (EU) 2016/679 requires processing by a processor to be governed by a contract that stipulates, in particular, that the processor processes the personal data only on documented instructions from the controller, ensures that persons authorised to process the personal data have committed themselves to confidentiality, takes all measures required pursuant to Article 32, and respects the conditions for engaging another processor. Article 28(3)(g) requires that, at the choice of the controller, the processor deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies.

Article 32 of the same Regulation requires the controller and the processor to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, and names pseudonymisation and encryption of personal data among them. Article 83(4) places infringements of the obligations of the processor pursuant to Articles 8, 11, 25 to 39 and 42 and 43 in the tier of administrative fines up to 10 million euro, or up to 2% of total worldwide annual turnover of the preceding financial year, whichever is higher. The processor carries that exposure in its own name.

Commission Implementing Decision (EU) 2021/914 of 4 June 2021 sets out standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679. Recital 9 records that where the processing involves data transfers from controllers subject to the Regulation to processors outside its territorial scope, or from processors subject to the Regulation to sub-processors outside its territorial scope, the clauses should also allow the requirements of Article 28(3) and (4) to be fulfilled. Recital 10 explains the modular approach that lets the parties select the module matching their role. Offshore delivery and sub-processing chains are the situation these modules describe.

The Information Commissioner's Office publishes guidance on international transfers of personal information under the UK GDPR, covering when a transfer is a restricted transfer, adequacy regulations, the appropriate safeguards permitted including the UK IDTA, the Addendum and UK Binding Corporate Rules, and how to complete a transfer risk assessment, which UK legislation now refers to as a data protection test. A UK client's data reaching an Indian delivery centre is the transfer this guidance addresses.

Where a provider handles protected health information for a United States healthcare client, Section 164.504(e)(2) of Title 45 of the Code of Federal Regulations requires the business associate contract to establish the permitted and required uses and disclosures, and to provide that the business associate will not use or further disclose the information other than as permitted by the contract, use appropriate safeguards, report any use or disclosure not provided for by its contract including breaches of unsecured protected health information, and ensure that any subcontractors that create, receive, maintain, or transmit protected health information on its behalf agree to the same restrictions. Section 164.504(e)(1)(iii) makes a business associate non-compliant if it knew of a pattern of activity by a subcontractor amounting to a material breach and did not act.

The Federal Trade Commission's guidance on the Safeguards Rule sets out the elements of the required information security program, including encrypting customer information on the system and in transit, or securing it with effective alternative controls approved by the Qualified Individual where encryption is not feasible. Under the element on monitoring service providers, it states that contracts must spell out security expectations, build in ways to monitor the service provider's work, and provide for periodic reassessments of their suitability for the job. A vendor to a covered financial institution is on the receiving end of that clause.

ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection, Information security management systems, Requirements, is published by ISO and IEC as Edition 3, dated 2022-10. ISO describes it as the world's best-known standard for information security management systems and states that conformity means an organization has put in place a system to manage risks related to the security of data owned or handled by the company. Certification is against the management system within a defined scope; it is not a statement about any individual file.

ISO/IEC 27701:2025, Information security, cybersecurity and privacy protection, Privacy information management systems, Requirements and guidance, is published as Edition 2, dated 2025-10. ISO describes it as an international standard that sets out requirements for establishing, implementing, maintaining, and continually improving a Privacy Information Management System. Clients that place personal data with a provider increasingly ask for this alongside the information security certificate.

The AICPA describes System and Organization Controls, or SOC, as a suite of service offerings CPAs may provide in connection with system-level controls of a service organization or entity-level controls of other organizations, and states that CPAs can use these offerings to provide assurance reports that give users information needed to assess and address the risks associated with outsourcing services. The AICPA promulgates the professional standards for SOC engagements. A report describes controls over a defined system for a defined period; it does not travel with a document that has left that system.

Where a business process or managed-service engagement touches cardholder data, the PCI Security Standards Council states that the PCI Data Security Standard provides a baseline of technical and operational requirements designed to protect payment account data, and identifies the intended audience as entities that store, process, or transmit cardholder data or sensitive authentication data, or could impact the security of the cardholder data environment, including all entities involved in payment card processing and expressly including service providers. Applicability depends on the engagement and the data actually handled.