Does India need a data security law?

Does India need a data security law which is not there and in the absence of which the country is missing out on a good bit of offshored business? Nasscom seems to think there is no need for a new law but this is at variance with what several industry experts feel.

A Nasscom spokesperson told the ongoing BPO summit here that the association had conducted a detailed study of a possible gap in this regard and found that there was enough data regulation and foreign regulators also found the Indian situation adequate.

On the other hand, Vikram Talwar, CEO of Exlservice felt that "we would like to see a comprehensive law, stringently put together and stringently implemented." The implications of this will be "huge". In particular, he was of the opinion that "data theft should be made a non-bailable offence".

Talwar further explained that it was as important to have a law as it was to take quick action when an illegality was committed. The speed with which the law took its course in India in the MphasiS case was highly satisfactory.

There were bits and pieces of provisions in various Indian laws which could be used to take necessary action but there was something to be said in favour of putting it all together in one statute.

Harris N Miller, president of the Information Technology Association of America which represents over 500 leading IT-related companies in the US and Nasscom?s counterpart, said during an earlier visit that ITAA was engaged in a continuous dialogue to evolve a strategy which creates a win-win situation for the IT companies of both the countries.

"India does not have a particular law to prosecute someone who violates the protection of data privacy. That's one of the things Nasscom is working with your government about what is the best approach. I don't advocate the EU privacy directive as it will hurt Indian offshore companies as it wants you to go through this complicated safe harbour provision which basically says you can't send data outside Europe without getting specific permission of the individuals. But India does need to come up with a set of best practices and laws so that there is a hundred per cent assurance," he asserted.

About the same feeling is shared by Avinash Vashistha, managing partner of neoIT, the offshoring consultancy. He is of the view that "a data privacy act similar to the data act of the EU or safe harbour act of the US is a must. Significant BPO opportunity will stay away from India till this need is addressed."

What Indian companies were doing on their own is "commendable but nowhere near to being sufficient to give confidence to clients to offshore high end business processes," he added.

As Miller had indicated, Nasscom was working with the government of India on a law on data security when Arun Shourie was minister but that process has been stalled with the change of government.