The proliferation of digital lending platforms led the Reserve Bank of India ('RBI'), India's banking regulator, to appoint a Working Group on Digital Lending ('the Working Group') to make recommendations for its regulation, especially from the perspective of ensuring data security, privacy, confidentiality, and consumer protection¹. Pursuant to the submission of the report by the Working Group on 18 November 2021², the RBI announced, in a press release dated 10 August 2022³,  its acceptance of, and intention to implement, certain recommendations made by the Working Group, and consequently released the Guidelines on Digital Lending on 2 September 2022⁴ ('the Guidelines'). Arun Prabhu, Partner at Cyril Amarchand Mangaldas, provides an introduction to the Guidelines, including their scope, applicability, and storage obligations.

The Indian Computer Emergency Response Team ('CERT-In'), the Government nodal agency that deals with cybersecurity threats in India, issued a direction relating to 'Information security practices, procedures, prevention, response, and reporting of cyber incidents for safe & trusted internet'¹ ('the Direction') to impose stringent requirements for cybersecurity reporting and introduce broader compliance requirements. Subsequently, CERT-In released frequently asked questions² ('the FAQs') to clarify certain aspects of the Direction. The Ministry for Electronics and Information Technology ('MeitY') has since held a meeting on 10 June 2022 with stakeholders to provide informal clarifications on certain aspects of the Direction and the FAQs. Aaron Kamath, Varsha Rajesh, and Aniruddha Majumdar, from Nishith Desai Associates, discuss the contents of the Direction, as well as its impact on the industry.

On 28 April 2022, the Indian Computer Emergency Response Team ('CERT-In') published Direction No. 20(3)/2022-CERT-In¹ ('the Direction'), which detailed six new rules relating to information security. Among these new rules, entities are now required to report certain cybersecurity incidents to CERT-In within six hours of discovery. OneTrust DataGuidance breaks down this new requirement, considering additional guidance from CERT-In's frequently asked questions² ('the FAQs') issued on 18 May 2022, as well as India's existing legislation.

The processing of children's personal data, from collection to destruction, generally carries with it special considerations. Indeed, the level of protection afforded to children is often higher, due to in part their capacity to understand the consequences of providing their information and the potential risks associated with their use or misuse. In part one of this series, OneTrust DataGuidance considers the rules in the APAC region which govern children's personal data, featuring perspectives from Australia, China, India, and Japan.

For insight into handling children's personal data in New Zealand, the Philippines, and Singapore, please see part two here.