Data Pricavy and FOSS Projects -- Indias DPDPA Impact

India is going to undergo a profound change in how digital personal data is collected, stored and processed with the DPDP Act 2023 finally coming into full force in May 2027. A number of conditions that protect and control the various data processing workflows will be applicable on anyone who collects or handles personal data in India. With consent, security and transparency being the central pillars around which the act is structured, its compliance is enforced by India’s first Digital-Only Quasi Judicial body - The Data Privacy Board of India, which can impose an array of eye-popping fines ranging all the way up to 250 crores.

What makes this interesting for us specifically, is that unlike other internationally well-known laws(like GDPR), that primarily are targeted at commercial companies, the Indian DPDPA expands the scope to cover a number of other categories of data users, including Individuals, Associations of persons(Both formal and informal), trusts and foundations and even the government itself. So this ends up covering individual contributors, FOSS project groups and even the open-source projects or foundations themselves, even in cases where there is no commercial angle to the interactions. All of them now need to study and adapt their workflows to stay on the right side of this new law, and this talk aims to address that in the following ways :

1. Giving a brief, 7-8 minute primer on the main features and provisions of the DPDP Act of 2023, along with the rules that have been notified under it, so the audience has a high level understanding of the new law.

2. A more detailed 10 minute deep-dive into the various ways the new law impacts open-source projects and contributors specifically, focusing on the potential impacts on governance and management of community projects, along with some potential solutions and workarounds to stay compliant.

3. The final 5-10 minutes would be us diving into a 2-3 common open-source scenarios, and seeing what the impact would be like in each of them.

4. Any Remaining time can be used for Q/A with the audience.

We expect the audience to take away a basic understanding of the new DPDP Act and its main provisions, an understanding of their new rights as individuals under the new law, and an appreciation of how they might have to modify their workflows around open-source contributor and user data management.