Why in news?

European Union has passed a General Data Protection Regulation (GDPR) Law.

What is General Data Protection Regulation about?

• The GDPR redefines the understanding of the individual’s relationship with their personal data.
• It relates to an identifiable living individual and includes names, email IDs, ID card numbers, physical and IP addresses.
• This law grants the citizen substantial rights in his/her interaction with

1. Data controllers - Those who determine why and how data is collected such as a government or private news website.
2. Data processors - Those who process the data on behalf of controllers, such as an Indian IT firm to which an E.U. firm has outsourced its data analytics.

What is the significance of this law?

• Under the GDPR, a data controller will have to provide consent terms that are clearly distinguishable.
• The GDPR also requires data collectors to provide information on the ‘who’ and ‘how.’
• Individuals will also have the right to have personal data deleted under certain conditions.
• The reporting obligations and enforcement are made stronger under the GDPR.
• By this, data breaches have to be reported within 72 hours and failure to comply with the new laws could result in a fine up to 4% of global turnover or maximum amount of fine 20 million Euros.

What will be the implications for India?

• The GDPR has global implications as it applies to those outside the E.U. who either monitor the behaviour of EU residents or sell goods and services to them.
• The E.U. bloc is India’s largest trading partner, with bilateral trade in services alone running upwards of €28 billion (Rs.2.2 lakh crore).
• Therefore it will have a significant impact on Indian IT firms and other service providers with E.U. business.
• But only a third of Indian IT firms are making arrangements for the GDPR and a third unaware of such a law.
• This will likely mean fines, loss of business and missed opportunities, as well as diplomatic wrangling in trade talks between India and the E.U.