An in-depth analysis of the potential impact of India’s Digital Personal Data Protection Act, 2023 on the social sector in India.
Imagine this: a non-profit aims to empower girls through STEM and coding programs. The organisation would probably collect a significant amount of information about enrollment numbers, progress, and outcomes. This is valuable data, which can help gauge understand the impact and effectiveness of the program, and its success in helping the girls find suitable jobs. With the introduction of the Digital Personal Data Protection Act, 2023 (DPDPA), however, the manner in which Social Purpose Organisations (SPOs) such as these collect, store and use such data might have to change.
Many countries have implemented laws to protect their citizens’ data. Similarly, the DPDPA marks a significant shift in India’s attempts at data legislation. Because the Act applies to the collection, processing and storage of digital personal data – both online and offline – it is expected to have significant implications for the social sector, which collects a considerable amount of beneficiaries’ data for research and program delivery.
Data provides valuable insights into the characteristics and profiles of the individuals or communities being served, allowing organisations to design targeted and inclusive interventions. For instance, Educate Girls equips field workers with mobile tools to gather student and school data. This has helped make a significant difference in the lives of over 2,40,000 girls in Rajasthan by enabling consistent attendance and learning progress tracking. Similarly, Akshaya Patra provides nutritious midday meals to 2 million children across 10 Indian states. They’ve optimised their food transportation costs using big data analytics for efficient route planning. The implementation of DPDPA will have a far-reaching impact on this aspect of SPO functioning.
Ethics and privacy
One of the key features of DPDPA is the requirement for consent, making it mandatory for data-collecting entities to obtain permission from users before collecting their data. Notably, the Act also specifies that this data must be deleted upon task completion.
Given that SPOs in India collect vast amounts of data, often from beneficiaries in grassroots areas who may be unaware of their privacy rights, this is a welcome step in establishing some rigour and ethics around data collection and processing. It ensures that user data cannot be misused once the intended purpose is served. Additionally, as stated in Section 9 subsection 1 of the DPDPA, organisations catering to individuals under 18 must now be mindful of obtaining consent from the parents or guardians of these individuals. However, implementing this might be a challenge. If the broad mandate requires that data be destroyed after its use, who specifies the contours of data use? For instance, socio-demographic data might continue to be useful long after its intended ‘use’.
An increased compliance burden
While there is a wealth of high-quality data in the Indian social sector, the sources are often disparate. SPOs often emphasise the necessity for a more robust culture of decision-making grounded in evidence. They also underscore a lack of skills and capacity among grassroots organisations that collect data.
Data infrastructure within social impact organisations is also often underdeveloped. At the same time, there is fierce competition for the skills needed to use data better, as sectors of every kind are competing to attract, upskill, and retain data talent, as highlighted by Talent Management in the Indian Social Sector, a study jointly undertaken by the Indian School of Development Management (ISDM) and CSIP, Ashoka University.
The new law designates stakeholders in the social sector as data fiduciaries, necessitating robust data management systems to prevent breaches. Sections 8(8) and 10 of the DPDPA emphasise enhancing the accuracy of the data management system. Compliance will require that organisations make significant financial investments in robust data systems, infrastructure and personnel, or face hefty fines. The social sector in India already faces funding challenges, and making big investments in data architecture and technology may not be a priority.
Concerns about access
Individuals, researchers, and thinktanks are crucial in addressing societal challenges and devising solutions through extensive primary research. However, collecting field data is not always feasible. For instance, conducting comprehensive surveys or interviews in remote or economically disadvantaged areas might be financially unfeasible. To offset the cost of travel, accommodation, and hiring local enumerators to gather first-hand data, social sector organisations often rely on the Right to Information (RTI) as a valuable source of information. But with the introduction of the DPDPA, it remains to be seen how SPOs are able to use the RTI Act to get the information they seek.
Looking ahead
The DPDPA is a significant step towards protecting digital data privacy in India. For SPOs, it presents both opportunities and challenges.
To lessen their compliance load, SPOs can adopt a policy of data minimisation, only collecting and maintaining as much data as required to meet their objectives. They can also obtain informed consent from beneficiaries for data collection and usage, by being transparent with them about data practices.
SPOs should engage in advocacy with government organisations and groups to push for funding and support. They can develop collaboration and workable solutions for compliance by working with data protection specialists, legal advisors, and technology vendors. They can recruit skilled professionals and establish custom-tailored data architecture systems. Data fiduciaries will require thorough training to understand the rights they hold under the law, to ensure that data collection is done ethically and responsibly. SPOs can also pool resources and capacities and collaborate to ensure compliance for everyone in the social impact space, with the aim of having the larger organisations offset some of the burden on smaller, more grassroot level organisations.
The DPDPA also opens avenues for philanthropists and tech companies to build relevant Digital Public Goods (DPGs) for the SPOs that help them comply with the Act, thereby eventually contributing to a culture of data-driven decision making.
The Act is an opportunity for SPOs to strengthen their commitment to ethical data practices. While the compliance journey may be challenging, it is a path worth pursuing.
Advocacy for support, collaboration, and capacity building are key strategies for SPOs to navigate the complexities of data protection while continuing their essential work at the grassroots level.
The views expressed in this post are those of the author and do not reflect those of the International Development LSE blog or the London School of Economics and Political Science.
Image credit: The image is created at https://www.midjourneyai.ai/
