The Data Security Council of India (DSCI), which was set up by Nasscom in August 2008, has recently announced its best practices framework for data security and privacy in Indian enterprises. DSCI is a self-regulatory and not-for-profit organization, with a sole mission to promote India as a secure destination for outsourcing. DSCI wants to promote these best practices among IT business process outsourcing (BPO), service providers, banking and financial services, manufacturing, e-governance, telecom, public sector units (PSU) and e-commerce verticals.
Many Indian IT BPO and knowledge process outsourcing (KPO) organizations serve clients from across various locations such as the U.S., U.K. and Australia. Hence these organizations are subject to these countries' data security and privacy protection regulations. According to DSCI, IT BPO players face major challenges when it comes to meeting multiple regulatory requirements and establishing the corresponding security controls. "After deep analysis of these compliance requirements and other emerging security risks, we decided to develop comprehensive best practices framework," says Kamlesh Bajaj, the CEO of DSCI. The IT amendment act 2008 also now necessitates that Indian enterprises implement reasonable security practices to protect personal data.
The DSCI framework
DSCI has developed a separate framework for data security and privacy. The security framework comprises of 16 best
The DSCI privacy framework is specially aimed at data protection practices for companies engaged in outsourcing. DSCI has developed nine best practice areas for protection of personal data, which include creating visibility over personal information, privacy policies, regulatory compliance intelligence, privacy contract management, and information usage.
Regulatory compliance intelligence practices can help organizations to build internal compliance mechanisms. "This will help organizations to understand compliance requirements and laws of different geographies. It will also create a mechanism which keeps tracks of data privacy regulation changes," says Bajaj. Data privacy related procedures should also be able to address questions as to the choice of jurisdiction and laws that govern specific issues, according to the DSCI privacy framework.
DSCI has already conducted seminars in various Indian cities such as Mumbai, Delhi, Calcutta, Chennai and Bangalore to create awareness about the framework. "We have also carried out Web seminars for four large service providers, and their responses have been very positive," claims Bajaj. At the moment, DSCI is conducting pilot tests with Indian organizations and plans to have publicly available case studies by December 2009. Since the framework only covers best practices, DSCI plans to develop an implementation methodology that provides information on the technical and operational aspects of security best practices.
As far as the DSCI framework's enforcement and certification are concerned, DSCI is yet to come up with a definite methodology. "We will scale up our operation in the first quarter of 2010. Leveraging various mediums like IT consulting firms and vendors is possible once we reach a particular level. We are also setting up an advisory group which will freeze on ideas for certification and rating of service providers," explains Bajaj. DSCI is yet to decide charges for the certification.
More details on the DSCI framework are available on the DSCI website.