Skip to content

CS Professional · Artificial Intelligence, Data Analytics and Cyber Security - Laws and Practice · Data Analytics

An Indian company uses analytics software on its customers' purchase data and also wants to share a customer-level dataset with an outside analytics vendor. Which approach best balances analytics value with data protection obligations under Indian law?

The best approach is to mask or remove direct identifiers, share data only for the purpose covered by consent, and bind the vendor by contract. Purchase data tied to an identifiable person is personal data, and the company stays responsible under the Digital Personal Data Protection Act, 2023.

  1. AShare the dataset after removing or masking direct identifiers, and only for the purpose for which consent was given, with contractual safeguardsCorrect
  2. BShare the full identifiable dataset because the vendor is a registered company
  3. CShare it freely because purchase history is not personal data
  4. DShare it only after converting it to a spreadsheet format

Explanation

Under the Digital Personal Data Protection Act, 2023, personal data should be processed for the lawful purpose for which consent was given, and the data fiduciary remains responsible for processors. Masking identifiers and binding the vendor by contract reduces risk. Purchase data linked to an identifiable person is personal data, and file format has no bearing on compliance.

Did you get it right without looking?

One question tells you little. A timed set on Data Analytics shows your real accuracy, how long you take and where you lose marks.

More Data Analytics questions