India Inc envisages GDPR as the next big business opportunity: Study

71 per cent Indian enterprises say Global Data Privacy Regulation(GDPR) will help bring a sense of privacy in business and innovation in ideas, according to a recent survey conducted by Deloitte Touche Tohmatsu India LLP (DTTILLP or Deloitte India or Deloitte) in alliance with Data Security Council of India (DSCI).

The joint study reaffirms, organisations that are GDPR ready will gain a competitive advantage, as they will be able to use personal data in their innovations and digitization, helping provide better delivery to their clients through the following measures:

• Provide better customer experiences (60 per cent)
• Enhance productivity of internal operations (54 per cent)
• The personalisation of product and services deliveries (47 per cent)
• Creation of new products and services (46 per cent)      

In addition, particularly small & mid-size EU companies would open up for business possibilities to Indian firms, given the ease of data transfer between organisations.

With respect to sectors, IT/BPM, Health, e-commerce, Manufacturing and Pharma are the five frontrunners of the GDPR readiness journey. 

Commenting on the survey launch Vishal Jain, Partner, Deloitte India said,” Digital transformation and advanced technologies have enabled enterprises to enhance customer experience. This requires a fair balance between data privacy and accessibility.

GDPR brings in a renewed focus to data privacy. While this is a new compliance imperative, it also provides a competitive advantage for businesses. In fact, our survey findings also infer that GDPR can be the new business opportunity for Indian firms.

The need of the hour for India Inc is to develop a strategic roadmap of adoption for this policy that is transparent and further allows them to build the next layer of customer trust."

Rama Vedashree, CEO, DSCI said “EU has been a key geography for Indian IT and has been servicing customers across several verticals including the public sector.

Innovations in global services delivery models, best in class processes and standardization, attention to data protection has kept India’s IT growth story flying high. Scaling its people, process maturity and harnessing technology solutions for rigorous implementation has enabled driving conformance to data protection regulations in various geographies. Given EU GDPR, and impending India’s Data Protection Law, stepping up focus on Data protection practices and capability building, is a key imperative to satisfy expectations of customers and consumers

The joint survey from Deloitte and DSCI is an effort to analyse the current state of preparedness of Indian organisations basis the requirements mandated by the European Union’s (EU) General Data Protection Regulation (GDPR). 

According to the survey in India, even as 28 per cent of the small organisations are yet to initiate their journey towards GDPR, 71 per cent of survey respondents expressed that this regulation will help bring a sense of privacy in business and innovation in ideas.

Out of the organisations that have taken action for GDPR readiness, 80 per cent have conducted general awareness campaigns for all their relevant stakeholders to identify their processes, which access personal or sensitive data.

While Right to Data Portability, Right to Erasure and Right to Restriction of Processing was recognised as most challenging data subject rights, 62 per cent of respondents felt avoiding legal & contractual liabilities, fines & penalties as the biggest motivator for compliance followed by the need to get a competitive edge.

The report also notes that IT/BPM sector was the most responsive sector in terms of taking any steps towards GDPR readiness with 84 per cent of IT organisations having started readiness journey. This was followed by health and E-commerce sectors with 81 per cent and 80 per cent organisations respectively initiating their process.

As a step forward, this survey laid emphasis on the need for a dedicated privacy team and a Data Protection Officer (DPO) as their absence may pose a problem for organisations once the regulations for data privacy of various countries broaden after the enforcement of GDPR. This team would set the ground for Data Protection Impact Assessment (DPIA) that would help organisations identify, assess, and mitigate or minimize privacy risks with data processing activities.

Furthermore, it suggest that it is important for Indian organisations, especially Business Process Management (BPM) organisations, call centres and Business Process Outsourcing (BPO) organisations, to assess their role under GDPR as that of a Data Controller (DC), Data processor (DP) or both, since regulatory requirements for a Data Controller may vary from those for a Data Processor.