Digital Privacy Regulations

Just one month to go for comments on the EDPB's new #ePrivacy guidelines, so here's a reminder of why you *should* respond if your company has digital activities: - The new EDPB guidelines concern the scope of Art. 5(3) of the ePrivacy Directive, which was never only about #cookies but about the storing of information + access to information on devices. - That ePrivacy provision only allows such storage / access if there is (i) consent, (ii) strict necessity to provide an information society service [= digital service] explicitly requested by the user or (iii) storage/access for the sole purpose of transmission of an electronic communication. - The new EDPB guidelines consider that this provision also covers (i) temporary, ephemeral "storage" (e.g. RAM and CPU cache) + (ii) dispatch of information without active access to the device (e.g. IP addresses sent automatically as part of the IP layer of communication packets) [= passive "access"]. - This broad interpretation suggests an intention to cover certain tracking methods that the EDPB (+ the #dataprotection authorities it comprises) considers should be more strictly regulated, such as the use of device fingerprinting, user identifiers, IP addresses, URL parameters, pixels, etc. [whether #GDPR applies or not] - This has more significant & broader consequences than you might imagine, and it very likely affects your company. To illustrate: (i) Even if you only have one website, there may be elements on it that could be challenged (e.g. an ad banner [even pure contextual advertising] or a “sign up for a newsletter” popup that appears to an individual who has not yet seen it on his or her device). (ii) If you use IP addresses for anti-fraud checks, if you use URL parameters to track how many people read your newsletters, this will be covered - even though you never actually read that information from a device but get that information automatically when the device sends a request to your server. (iii) To use a bit of an extreme example: even the developer of the “phone” core application on your smartphone needs to pay attention, as the phone number of the recipient of a call could be considered to be “stored” on the sender’s phone (temporarily) and “accessed” by the recipient as a result of the communication protocol – so any further use by the recipient beyond the communication (e.g., lists of past calls) could be regulated under Article 5(3) ePrivacy Directive following the EDPB’s approach. Want help in figuring out how this affects your company and whether you should respond to the public consultation? Or perhaps you want to respond but don't want your company name to be mentioned? Reach out! For more information on what these guidelines mean: - "Shorter" read: https://lnkd.in/eUrrHbwx - Longer read: https://lnkd.in/ekdviZ_K (part I) and https://lnkd.in/eDV4NSRX (part II)

🔐 Digital Personal Data Protection Act, 2023 (India) – Explained Simply 🇮🇳 India has taken a major step toward strengthening data privacy with the Digital Personal Data Protection Act, 2023 (DPDP Act). This law empowers individuals and holds organizations accountable for how personal data is handled. Let’s break it down 👇 --- 🎯 Purpose of the Act ✔ Protect individuals’ personal data ✔ Ensure responsible and transparent data usage ✔ Give citizens control over their own data --- 📌 What is Personal Data? Personal data includes any information that can identify an individual: Name, phone number, email Aadhaar, PAN details Location, photos, IP address, and more --- ⚖️ Key Principles of the DPDP Act ✔ Consent First – Clear, informed, and revocable consent is mandatory ✔ Purpose Limitation – Data must be used only for the intended purpose ✔ Data Minimization – Collect only what is necessary ✔ Data Security – Protect data from breaches and misuse --- 👤 Rights of Individuals (Data Principals) ✔ Access & Correction – View and update your personal data ✔ Right to Erasure – Request deletion of your data ✔ Withdraw Consent – Opt out anytime ✔ File Complaints – Report misuse or mishandling --- 🏢 Duties of Organizations (Data Fiduciaries) ✔ Ensure lawful data processing ✔ Implement strong security safeguards ✔ Maintain transparency in data usage ✔ Respond to user requests promptly --- ⚠️ Penalties for Non-Compliance 💰 Fines up to ₹250 crore (or more) for serious violations --- 👶 Special Protection for Children ✔ Parental consent is mandatory ✔ Restrictions on targeted advertising for children --- 💡 Why This Matters? The DPDP Act marks a shift toward privacy-first digital governance, aligning India with global standards and building trust in the digital ecosystem. --- 📌 Key Takeaway: 👉 Your data, your rights 👉 Organizations must be accountable 👉 Privacy is now a legal priority in India --- #DPDPAct #DataProtection #Privacy #CyberSecurity #GRC #Compliance #IndiaTech #InformationSecurity #DataPrivacy #DigitalIndia

🇪🇺🇪🇺In #GDPR We Trust. Today, the European Commission published the Digital Simplification Package, presenting a proposal to amend several core provisions of the GDPR. The initiative is part of a broader strategy to streamline the EU digital acquis and support the development and operation of #AI systems. The proposal introduces a clarification that information is not personal data for a controller if that controller cannot identify the individual with means reasonably likely to be used. It adds new definitions, including terminal equipment, web browser, media service, media service provider, online interface and scientific research. The purpose-limitation principle is modified so that further processing for archiving, scientific, historical or statistical purposes is always considered compatible with the initial purpose. Changes relevant to AI development include a new ground under Article 9(2)(k) GDPR allowing processing of special categories of data in the context of developing or operating an AI system or AI model, subject to additional safeguards in Article 9(5). Controllers will be required to implement organisational and technical measures to avoid collecting or otherwise processing special categories of data in training, testing or validation datasets. If such data are still identified, they must be removed, or, where removal would require disproportionate effort, protected from influencing outputs or being disclosed. Article 88c introduces a specific framework for processing personal data for the development and operation of AI systems under Article 6(1)(f), subject to the balancing test and an unconditional right to object. This processing must also include safeguards such as data-minimisation during source selection and training, protection against disclosure of residually retained data, and enhanced transparency towards data subjects. The proposal also adjusts Article 12 by allowing controllers to refuse under Article 15 because the data subject abuses the rights conferred by this GDPR for purposes other than the protection of their data,, modifies Article 13 by introducing exemptions from privacy notices in circumscribed, not data-intensive relationships or for research (no need for privacy notices if prociding info is likely to render impossible or seriously impair the achievement of the objectives of the research) Personal-data breach notifications move to a 96-hour deadline and will later be channelled through the NIS2 single entry point. The EDPB should prepare EU-wide templates for DPIAs, data-breach notifications and lists of processing operations requiring or exempt from DPIAs. New Articles 88a and 88b introduce rules for storing and accessing data on terminal equipment, consent management and machine-readable signals that controllers and browser providers must support within set timelines.

 𝐏𝐫𝐢𝐯𝐚𝐜𝐲 𝐂𝐨𝐦𝐦𝐢𝐬𝐬𝐢𝐨𝐧𝐞𝐫 𝐟𝐢𝐫𝐞𝐬 𝐰𝐚𝐫𝐧𝐢𝐧𝐠 𝐬𝐡𝐨𝐭 𝐨𝐧 𝐭𝐫𝐚𝐜𝐤𝐢𝐧𝐠 𝐩𝐢𝐱𝐞𝐥𝐬 Australia's Privacy Commissioner Carly Kind isn't backing down on digital tracking practices. After closing the TikTok pixel investigation in May 2024, many in the MadTech space thought they could relax. Might be time to think again. 𝐊𝐞𝐲 𝐭𝐚𝐤𝐞𝐚𝐰𝐚𝐲𝐬 𝐟𝐫𝐨𝐦 𝐭𝐡𝐞 𝐎𝐀𝐈𝐂'𝐬 𝐍𝐨𝐯𝐞𝐦𝐛𝐞𝐫 2024 𝐠𝐮𝐢𝐝𝐚𝐧𝐜𝐞: 𝑭𝒐𝒓 𝒐𝒓𝒈𝒂𝒏𝒊𝒔𝒂𝒕𝒊𝒐𝒏𝒔 𝒖𝒔𝒊𝒏𝒈 𝒕𝒓𝒂𝒄𝒌𝒊𝒏𝒈 𝒑𝒊𝒙𝒆𝒍𝒔: ▪️ You're responsible for ensuring compliance, not just your third-party providers ▪️ Sensitive information must NOT be disclosed through pixels without consent ▪️ Your privacy policies must clearly explain pixel usage ▪️ Regular reviews of tracking technologies are now expected 𝑻𝒉𝒆 𝒂𝒄𝒄𝒐𝒖𝒏𝒕𝒂𝒃𝒊𝒍𝒊𝒕𝒚 𝒓𝒆𝒂𝒍𝒊𝒕𝒚 𝒄𝒉𝒆𝒄𝒌: Outsourcing data handling doesn't transfer legal liability. If your service provider breaches the Privacy Act while acting as your agent, you're directly liable too. 𝑪𝒍𝒆𝒂𝒏 𝒓𝒐𝒐𝒎𝒔 𝒂𝒓𝒆𝒏'𝒕 𝒂 𝒎𝒂𝒈𝒊𝒄 𝒔𝒐𝒍𝒖𝒕𝒊𝒐𝒏: The OAIC is signalling that data clean rooms should be viewed as compliance tools, not ways to avoid Privacy Act obligations entirely. 𝑾𝒉𝒂𝒕 𝒕𝒉𝒊𝒔 𝒎𝒆𝒂𝒏𝒔 𝒇𝒐𝒓 𝒚𝒐𝒖𝒓 𝒃𝒖𝒔𝒊𝒏𝒆𝒔𝒔: ✅ Conduct due diligence on all third-party pixels ✅ Review data minimisation practices ✅ Update privacy policies with clear pixel disclosures ✅ Implement ongoing compliance monitoring Commissioner Kind's message is clear: "The digital domain is not a regulation-free space." With active investigations underway and enforcement action anticipated, now is the time to audit your tracking practices. The privacy landscape is evolving fast. Are you keeping up? Key insights from Peter Leonard (Principal, Data Synergies & Adjunct Professor, UNSW Law and Justice) analysing Privacy Commissioner Carly Kind's recent statements and the OAIC's November 2024 guidance on tracking pixels. #PrivacyLaw #DataCompliance #MarTech #AdTech #OAIC #DigitalMarketing #Privacy #Australia

Dear Reader, It is the season of digital transformation, and across Africa’s bustling digital ballrooms, data has become the most coveted currency of all. Mobile money moves faster than whispers at a soirée, biometric systems promise certainty with a glance, and artificial intelligence courts both efficiency and excess. Yet, as with all great transformations, not everyone has been minding their manners. As we reflect on the past year this Privacy Day, Africa’s regulators are no longer mere observers of the spectacle. They have stepped onto the floor firm, deliberate, and increasingly assertive reminding governments and global technology giants alike that privacy is not a polite suggestion, but a legal right. One thing is clear, data protection in Africa has entered its enforcement era. Across the continent, Africa’s digital transformation is accelerating from mobile money to digital IDs, AI systems, health platforms, and cross-border digital trade. With this transformation comes an unavoidable truth, data protection is no longer an aspirational policy, it is a legal and regulatory imperative. We are also witnessing a shift in regulatory confidence and maturity. With recent enforcement actions telling a powerful story. Here are some highlights: 📌 Kenya’s High Court decision in Republic v Tools for Humanity (2025) reaffirmed that biometric and AI-driven systems require valid consent, DPIAs, and accountability. 📌 Nigeria’s NDPC enforcement against Meta (2025) demonstrated that African regulators will assert jurisdiction over global platforms and impose significant penalties. 📌 Uganda’s PDPO determination against Google (2025) confirmed that foreign tech companies processing African data must comply with local laws. 📌 South Africa’s Information Regulator action against the Department of Justice (2025) sent a strong message, public institutions are not exempt from privacy obligations. Equally important is the emergence of cross-border regulatory cooperation. Collaboration between DPA’s such as Kenya’s ODPC and Uganda’s PDPO in handling cross-border complaints signals the future of enforcement in a continent defined by regional integration and digital trade. As we go into 2026, here are my reflections: 📌 Africa is no longer a passive recipient of global privacy norms it is shaping its own enforcement narrative. 📌 Big Tech and public institutions alike must be accountable. 📌 AI, biometrics, and large-scale data systems are now central regulatory priorities. 📌 Collaboration among African DPAs will define the next phase of effective enforcement. As we look ahead, Africa’s data protection story is one of agency, constitutional grounding, and growing regulatory power. The challenge and opportunity is ensuring that innovation continues with trust, dignity, and rights at its core. Privacy is not a barrier to Africa’s digital future. It is its foundation. Happy International Privacy Day. #dataprotection #dataprivacy #compliance

To CEOs & Boards of Indian Banks and Fintechs: DPDP Rules Are Live – Your immediate Action Clock Has Started.. November 14, 2025 – the Digital Personal Data Protection (DPDP) Rules, 2025 were notified. This isn’t another draft. Effective immediately- core obligations under India’s first comprehensive privacy law apply to every institution processing customer data. Board-Level Decisions Required: 1. Mandate DPO Appointment (India-based, Board-reporting) - Significant Data Fiduciaries (most digital banks, payment gateways, lending platforms) must have a named DPO by Nov 2026 - but start the search now - Board resolution needed: DPO to have direct escalation to Audit Committee; contact details public on website. 2. Approve ₹X Cr Privacy Budget for FY26 - Consent management platforms (₹2–5 Cr for mid-sized fintechs) - DPIA tooling + breach notification automation - Mandatory 72-hour DPB reporting capability (align with RBI’s 6-hour SOC rule) 3.Sign Off on Consent Overhaul - Kill legacy “implied” consents. - Mandate verifiable, granular, withdrawable consent at onboarding (app + branch). - Board to review sample notice in English + 3 regional languages. CEO’s Sprint: - Map all data flows (KYC → lending → marketing) - Confirm Significant Data Fiduciary (SDF) status - Add DPDP audit clauses to all vendor contracts Risk if you delay: - ₹250 Cr per breach (DPB) - ₹150 Cr for DPO non-compliance - RBI show-cause for misalignment with Digital Lending Guidelines Opportunity if you lead: - First-mover trust in a ₹100+ Tn digital economy - Consent-as-a-moat for customer retention #Views are personal #DPDPAct #BoardAgenda #FintechCEOs #BankingBoards #PrivacyByDesign

A Landmark Moment for Digital Rights in India - India has taken a historic leap in digital rights with the notification of the Digital Personal Data Protection Rules, 2025, placing transparency, accountability, and user empowerment at the core of the country’s digital transformation. Meaningful Consent & User Control - The Rules transform consent into a clear, informed and revocable choice. Data Fiduciaries must now present simple, itemised notices and offer equally easy consent-withdrawal options, ensuring citizens truly control how their personal data is used. Mandatory Breach Disclosure - Organisations are now required to promptly notify both users and the Data Protection Board in the event of a data breach. Consent Managers: A New Privacy Infrastructure - By formalising a regulated Consent Manager framework, India creates a secure, interoperable system for permission-based data sharing. Purpose Limitation & Data Minimisation - Large digital platforms must delete user data after three years of inactivity, unless required by law. This curbs data hoarding and reduces long-term exposure in case of breaches, promoting more responsible data governance. Strong Protections for Children - The Rules introduce India’s strongest safeguards for children’s data, including verifiable parental consent, Digital Locker–based age checks, and strict limits on tracking and behavioural monitoring. Oversight of High-Impact Platforms - Significant Data Fiduciaries must conduct annual Data Protection Impact Assessments and algorithmic audits, ensuring deeper scrutiny of automated systems, large-scale processing, and cross-border flows. Digital-First Data Protection Board - The new Data Protection Board will function as a fully digital regulator, using techno-legal tools for hearings, inquiries and appeals. Building a Trusted Digital Economy: Overall, the DPDP Rules, 2025 lay a strong foundation for a trusted digital economy where every citizen’s personal data is respected, protected, and responsibly processed. This is a major milestone in India’s privacy journey and a significant step towards building a Digital Bharat where trust is the core enabler of innovation. #DigitalIndia #DataProtection #DPDPAct #DataPrivacy #CyberSecurity #PrivacyByDesign #DigitalTransformation #TechPolicy #DigitalRights #PersonalDataProtection #GovTech #DigitalGovernance #RegTech #InfoSec #CyberLaw #IndiaTech #DigitalTrust #DataGovernance #PublicPolicy Data Security Council of India Vinayak Godse Venkatesh Murthy. K Adv (Dr.) Prashant Mali ♛ [MSc(Comp Sci), LLM, Ph.D.] Dr. Pavan Duggal

Exploring the Relationship Between GDPR and New Digital Regulations: Following the release of the Second Report on the application of the General Data Protection Regulation (GDPR) by the European Commission, I want to share some insights into how the GDPR intersects with new digital regulations. The EU has introduced several initiatives that either complement the GDPR or clarify its application in specific areas to achieve distinct objectives. Here’s a look at how these new digital policies interact with the GDPR, particularly with the Digital Services Act, the Digital Markets Act, and the AI Act: 1. Digital Services Act (DSA): The DSA is designed to create a safer online environment for both individuals and businesses. It aligns with the GDPR by prohibiting online platforms from displaying advertisements based on profiling that uses "special categories of personal data". This reinforces data protection, ensuring that user privacy is maintained in the digital advertising space. 2. Digital Markets Act (DMA): To promote fairer and more competitive digital markets, the DMA restricts 'gatekeeper' platforms from combining and cross-using personal data across their core services and other services without explicit user consent, as mandated by the GDPR. This measure ensures that users have control over how their data is used and prevents monopolistic practices in digital markets. 3. AI Act: The AI Act delineates specific EU data protection rules for areas where artificial intelligence is employed. For instance, it sets guidelines for the use of AI in remote biometric identification systems, addresses the processing of sensitive data to detect biases, and regulates the further processing of personal data in regulatory sandboxes. These provisions ensure that AI technologies adhere to GDPR principles, promoting responsible and ethical AI development. These initiatives highlight the EU's commitment to integrating GDPR principles into various digital policies, ensuring that technological advancements do not come at the cost of personal data protection.

Why the EU's New GDPR Cross-Border Enforcement Proposal Matters for Data Privacy On June 27, 2025, the Permanent Representatives Committee of the Council of the European Union approved the text for a Proposal for a Regulation that establishes additional procedural rules for the enforcement of the General Data Protection Regulation (GDPR) in cross-border cases. This proposal is significant as it outlines the procedures for handling complaints and conducting investigations by supervisory authorities, ensuring that enforcement of GDPR is consistent across member states. Key provisions include: - Guidelines for efficient complaint handling and decision-making. - Requirements for the admissibility of complaints, including necessary content and procedures for rejection. - Cooperation procedures among supervisory authorities, including timelines for decisions and information exchange. - Rights for parties involved in investigations to be heard. - Established dispute resolution processes, including referrals to the European Data Protection Board (EDPB). - Transitional provisions that delay certain rules' applicability for 15 months after the regulation's entry into force. The next steps involve the Presidency addressing the European Parliament, which will review the proposal. Staying informed about this regulatory development is crucial for businesses and organizations operating in the EU, as it will impact compliance strategies and data protection practices. Monitoring the progress of this proposal will help stakeholders prepare for potential changes in enforcement and operational requirements related to data privacy. For further details, you can read the letter from the Committee and the approved text of the proposal (attached).