Naavi.org

Ujvala Consultants Pvt Ltd launched an online evaluation of Data Trust Score indicating the compliance of an organization for Indian data protection law namely the JPC modified version of PDPB 2019 or DPA 2021.

The evaluation is available through an online completion of questionnaires leading to a self evaluation which will be reviewed and fine tuned bu Ujvala Consultants Pvt Ltd on submission.

Now a similar facility has been extended to compliance of GDPR with the computation of DTS-GDPR with the completion of similar online submission process.

Details are available at www.ujvala.com

The DTS-GDPR would provide an opportunity to organizations to understand the policy requirements for GDPR compliance.  On submission of the self evaluation, a quick review of the DTS with adjustments for certain weightages would be provided.

On submission of existing policy documents, a general review of the “Adjusted DTS” would be provided indicating areas which need improvement. (Cost for this document review would be extra)

Subsequently, full fledged audit may also be conducted under the FDPPI certification program.(Cost for this audit would be extra)

We hope that this would be useful for SME/MSMEs since the cost of GDPR compliance at the level of Self Evaluation and Basic Review  would be available at Rs 5000/- for the Indian law and Rs 10000/- for the global law.

Naavi

After the successful launching of DTS online tool based on the several enquiries received,  Naavi and Ujvala Consultants Private Limited has decided to launch a tool similar to MyDTS for compliance of GDPR.

Since GDPR involves several Supervisory Authorities who may have different interpretations, it is a more challenging task to design a DTS mechanism for GDPR. Also there are already many detailed guidelines available for implementation of the different provisions of GDPR through WP29/EDPB documents as well as ICO-UK website. These need to be incorporated as best practices. There are already hundreds of penalty decisions which also need to be taken into account. Hence this task of creating a model compliance plan for GDPR with a DTS evaluation is several times more challenging than working a model for the proposed Indian law.

However, considering the need for development of an affordable GDPR compliance assessment tool, we shall design a system on best effort basis by adopting the MyDTS system to meet the compliance of GDPR.

I request the support of all experts to enable us succeed in our efforts by suggesting modifications as may be necessary.

Naavi

Naavi and Ujvala Consultants Pvt Ltd have been using the framework titled IISF-309 (Indian Information Security Framework 309) as the framework for conducting ITA 2008 compliance audit.

This framework recognized the following risk domains

Under this framework, Data Privacy Risk was focussed on compliance of Sections 43A, 72A, 43 and 66. Now PDPB 2019 (to be called DPA 2022 when passed) would replace Section 43A. Additionally it would be necessary for all organizations to report data breach of non personal data also to the Data Protection Authority to be created under PDPB 2019. Organizations may also need to keep track of “Anonymized personal data” which may be part of the information that the Government may direct sharing in certain circumstances.

However, for an organization engaged in processing of data, it will be necessary to be compliant both with ITA 2000 and PDPB 2019/DPA2022.

We have gone into the details of PDPB 2019 and created a Data Trust Score System that tries to measure and represent the effectiveness of the compliance of PDPB 2019/DPA 2022.

Since we already had the framework IISF 309 for compliance of ITA 2008, it has been now upgraded into DPCSI-ITA 2000 as an extension of DPCSI just like DPCSI-GDPR is an extension of the DPCSI for compliance of GDPR.

DPCSI-ITA 2000 which is the new avatar of IISF 309 will have 40 implementation specifications similar to the 50 Model Implementation Specifications of DPCSI. These 40 implementation specifications have been carved out of the DPCSI Model implementation specifications and tuned to meet the risks under ITA 2000/8.

Since we also have a DTS system geared to measure the implementation effectiveness of Personal Data Protection under PDPB 2019, which is also capable of being adopted to the implementation of GDPR compliance, a similar system would be extended to measure the compliance of ITA 2000/8 based on the 40 implementation specifications presently identified.

Watch out for more information on the DTS tools for GDPR compliance and ITA 2008 compliance to be made public soon.

Naavi

Today, I received a WhatsApp regarding four types of intelligence, namely,

1) Intelligence Quotient (IQ)
2) Emotional Quotient (EQ)
3) Social Quotient (SQ)
4) Adversity Quotient (AQ)

The forward defined the different types of intelligence as follows:

1. Intelligence Quotient (IQ): this is the measure of your level of comprehension. You need IQ to solve maths, memorize things, and recall lessons.

2. Emotional Quotient (EQ): this is the measure of your ability to maintain peace with others, keep to time, be responsible, be honest, respect boundaries, be humble, genuine and considerate.

3. Social Quotient (SQ): this is the measure of your ability to build a network of friends and maintain it over a long period of time.

This triggered a thought about the DPCSI  which is being suggested for Data Protection Compliance in India. and how the DPCSI incorporates all the four types of intelligence represented above  in its Standards and Implementation Specifications.

The 12 standards of the DPCSI framework are given below:

In the above standards,

Standards Law Based scoping, Data Classification, Privacy By design at entity level, represent the intelligence quotient and measure of the level of comprehension of the compliance requirements.

Emotional quotient is captured by the inclusion of Communication, Governance Committee, workforce control.

Social Quotient is captured by Distributed responsibility.

Adversity quotient is represented by the Risk appetite based charter.

The implementation specifications that go with this standard also reflect the four types of requirement of the framework which need to address the legal issues of compliance, technical architecture for compliance, the workforce and top management support and the need for external and internal communication with stake holders.

We can therefore feel confident that DPCSI is “Intelligent” and meets the expectations of Data Protection Professionals just as the above types of intelligence recognized by psychologists.

Naavi

To

All those interested in Data Protection law compliance in India

Dear Friends

I invite you all for the webinar on “Data Trust Score under DPCSI” scheduled for 11.00 am on Sunday, July 10, 2022. The webinar will be on Zoom. The meeting ID is 882 8084 0436. The pass code is : dts_07

The approximate duration would be one hour followed by discussions. During the session, I will try to explain how Data Protection compliance maturity of an organization can be expressed in terms of a “Data Trust Score” just as how the credit ratings express the investment worthiness of a financial instrument.

The framework based on which the model of DTS would be explained is the Data Protection Compliance Management System which is uniquely built as a “Unified system for compliance of Personal Data Protection under ITA 2000/PDPB2019 or DPA 2021/GDPR etc.

During the session, the use of an online tool that can be used for a self estimation of the data protection status of an organization would also be described.

Don’t miss this opportunity to be part of a revolutionary change in the way companies can handle their data protection compliance requirements. MSMEs in particular should be more interested since the tool would help them to start their journey to be compliant with the law as it emerges.

The objective of this interaction is to make compliance easier and more affordable so that we can together create a “Compliance Culture” in India.

Whether the Government passes the Personal Data Protection bill (PDPB 2019/DPA 2021) during monsoon or not, responsible companies need to start their journey towards compliance.

Even when changes are brought, the foundation principles of compliance will not change. Let vested interests continue their fight to avoid compliance responsibility.

We the responsible corporates shall show the way to respect and be compliant with the legislative intention already reflected under the concept of “Due Diligence” and . “Reasonable Security Practice” in ITA 2000/8.

Naavi

The IT community has gone through the phase of discussing the need for building an “Information Security” culture in the organization. There after we also went through the phase of building a “Privacy Culture”.

In both these phases, we focussed on the people in the organization and tried to educate them on security issues and privacy issues.

While the efforts for building an information security culture and privacy culture continue, they are now being subsumed by the new requirement of building a “Compliance Culture” in organizations.

This requirement is  typical of the Indian market where we always stretch the compliance requirement till we are forced to comply.

The time has therefore come now to build a “Compliance Culture” in an organization. In this context, an “Organization” is the aggregation of the senior executives who have gone through the implementation of measures in their respective work places to ensure that their subordinates are impregnated with the importance of information security and privacy and why they all need to change their attitudes to work and attitudinally re-orient themselves to practice better security and privacy ethics and technology in their day to day work.

FDPPI is now embarking on leading Indian organizations into this phase through its program.. “Data Trust Score, the future of Privacy Protection”.

“Data Trust Score” or DTS, is the suggested measure of “Maturity of Data Protection Law Compliance” in India. It is a suggested deliverable of a data auditor who audits the data protection practices of a company in India. It works like the “Credit Rating” assigned for financial instruments by Credit rating agencies such as CRISIL or ICRA.

FDPPI which has created an eco-system for certified Data protection audits based on the indigenously developed framework of DPCSI (Data Protection Compliance Standard of India) is adopting the DTS-DPCSI, as  model for calculation of DTS on the DPCSI framework.

DTS-DPCSI is the first of its kind concept and would be the forerunner of similar assessment yardsticks that will emerge in future for other frameworks also.

The life of a Data Protection Professional will not be complete without understanding the concept of DTS and how it can be applied in their work environment.

Let us start our journey in understanding the concept of DTS through a virtual presentation to be made by Naavi on 10th July 2022 at 11.00 am.

For registration, contact Naavi through email at : dts@ujvala.com

Naavi