Abstract
Consultancy Agreements in its simplest form means an agreement which is entered upon by the consultant and client to define the terms of services such as fees, ownership, confidentiality, intellectual property rights etc. between them. Consultants handle a wide range of personal data daily in order toperform their services effectively. In dealing with such personal data, there is a high probability that the information provided may get lost, misused or exposed. The Digital Personal Data Protection Act, 2023 (“DPDP Act”) provides a legal framework for protection of personal data and distinguishes between Data Fiduciaries and Data Processors but provides limited provisions on classifying professional consultants who handle personal data. This article examines how consultants are classified and how responsibility is allocated between clients and consultants. It also examines whether conventional confidentiality clauses are sufficient to address security, breach reporting, subcontracting and data deletion. The GDPR’s provisions on processor arrangements and liability provide a comparative basis for developing a functional test for identifying a consultant’s role and appropriate contractual safeguards. The article maintains that although the Data Fiduciary continues to bear responsibility for processing conducted on its behalf, the consultancy agreement should expressly allocate the consultant’s operational duties and related financial consequences.
Keywords: Consultancy Agreements, Confidentiality, Contractual Liability, Digital Personal Data Protection Act, Data Fiduciary, Data Processor, Data Breach, Data Protection.
- INTRODUCTION
Consultants are hired by the business organizations to provide specialized and professional services such as recruitment, payroll, information technology, finance, marketing and legal compliance. Though they are not employees of the organizations, theirduties may require access to employee, customer or other personal data. If the consultant mishandles personal data and a breach occurs, the important question that arises is how responsibility should be divided between the client and the consultant.A POSH consultant handles complaint files, an HR professional requires access to employee records and a company secretary maintains registers. The consultant faces a combination of contractual claims, professional misconduct regulations, and limited criminal liability when that data leaks, while the client faces the regulator and the individuals suffer the consequences.The Digital Personal Data Protection Act, 2023 (“DPDP Act”)[1] provides a legal framework for protection and regulation of digital personal data of an individual and protects the right to privacy. The DPDP Act has introduced the concept of Data Fiduciary and Data Processor and embodied various duties and obligations on them.As per Section 2 (i) of the DPDP Act, a Data Fiduciary means any person who individually or in conjunction with other persons determines the purpose and means of processingwhereas Section 2(k) defines a Data Processor as any person who processes personal data on behalf of Data Fiduciary[2].However, a consultant should not automatically be considered a Data Processor merely because the agreement describes the consultant in that manner. Factors such as the nature of the services, degree of control and manner of handling personal data are relevant in determining the actual role of the consultant.
The operation and enforcement of the DPDP Act is being carried out in phases and the substantive provisions of the Act will be effective from May 13, 2027. Therefore, this article adopts a prospective approach to examine how consultant relationships may be regulated once the relevant provisions become applicable. It analyses the classification of role,allocation of responsibility for data breaches and adequacy of traditional confidentiality clauses. It insists that consultancy agreements should adequately address the statutory responsibility of the Data Fiduciary from contractual and operational responsibilities of the consultant and should include specific data-protection safeguards.
[1]Digital Personal Data Protection Act, No. 22 of 2023, India Code (2023).
[2]Digital Personal Data Protection Act, No. 22 of 2023, § 2(i), (k), India Code (2023).