The Digital Personal Data Protection Act, 2023 i.e. India Data Protection Law

The Digital Personal Data Protection Bill, 2023 was introduced in Lok Sabha on August 3, 2023. The Bill seeks to provide for the protection of personal data and the privacy of individuals.

Applicability AND Non Applicability: The Bill applies to the processing of digital personal data within India where such data is: (i) collected online, or (ii) collected offline and is digitised. It will also apply to the processing of personal data outside India if it is for offering goods or services in India. Personal data is defined as any data about an individual who is identifiable by or in relation to such data. Processing has been defined as a wholly or partially automated operation or set of operations performed on digital personal data. It includes collection, storage, use, and sharing. BILL does not apply to: (i) non-digital data; (ii) data processed for personal or domestic purposes; and (iii) data made publicly available by a data principal or any other person under a legal obligation.

Consent: Personal data may be processed only for a lawful purpose after obtaining the consent of the individual. A notice must be given before seeking consent. The notice should contain details about the personal data to be collected and the purpose of processing. Consent may be withdrawn at any point in time. Consent will not be required for ‘legitimate uses’ including: (i) specified purpose for which data has been provided by an individual voluntarily, (ii) provision of benefit or service by the government, (iii) medical emergency, and (iv) employment. For individuals below 18 years of age, consent will be provided by the parent or the legal guardian. Language - Data principals or users can access information made available to them in English, or choose any language specified in the Eighth Schedule of the Constitution of India.

Notice: While obtaining consent, data fiduciaries must give data principals a notice: containing a description of the personal data and the purpose for which it will be processed; details of the way data principals may exercise their rights to withdraw consent and grievance redressal; and details on how data principals may file a complaint with the Data Protection Board (DPB).

Rights and duties of data principal: An individual, whose data is being processed (data principal), will have the right to: (i) obtain information about processing, (ii) seek correction and erasure of personal data, (iii) nominate another person to exercise rights in the event of death or incapacity, and (iv) grievance redressal. Data principals will have certain duties. They must not: (i) register a false or frivolous complaint, and (ii) furnish any false particulars or impersonate another person in specified cases. Violation of duties will be punishable with a penalty of up to Rs 10,000.

Obligations of data fiduciaries: The entity, determining the purpose and means of processing, (data fiduciary), must: (i) make reasonable efforts to ensure the accuracy and completeness of data, (ii) build reasonable security safeguards to prevent a data breach, (iii) inform the Data Protection Board of India and affected persons in the event of a breach, and (iv) erase personal data as soon as the purpose has been met and retention is not necessary for legal purposes (storage limitation). In the case of government entities, storage limitation and the right of the data principal to erasure will not apply.

Significant data fiduciaries: Certain data fiduciaries may be designated as significant data fiduciaries. Certain factors must be taken into regard such as: (i) volume and sensitivity of personal data processed, (ii) risks to the rights of data principals, (iii) security of the state, and (iv) public order. These entities will have certain additional obligations including: (i) appointing a data protection officer(DPO), and (ii) undertaking an impact assessment (DPIA) and compliance audit.

Exemptions: Rights of the data principal and obligations of data fiduciaries (except data security) will not apply in specified cases. These include: (i) prevention and investigation of offences, and (ii) enforcement of legal rights or claims. The central government may, by notification, exempt certain activities from the application of the Bill. These include: (i) processing by government entities in the interest of the security of the state and public order, and (ii) research, archiving, or statistical purposes.

Processing of personal data of children: While processing the personal data of a child, the data fiduciary must not undertake: (i) processing that is likely to cause any detrimental effect on the well-being of the child, and (ii) tracking, behavioural monitoring, or targeted advertising.

Cross-border transfer: The Bill allows the transfer of personal data outside India, except to countries restricted by the government through notification. Regulatory data transfer restrictions like the Reserve Bank of India’s payments data localization mandate will continue to apply.

Data Protection Board of India: The central government will establish the Data Protection Board of India. Key functions of the Board include: (i) monitoring compliance and imposing penalties, (ii) directing data fiduciaries to take necessary measures in the event of a data breach, and (iii) hearing grievances made by affected persons. Board members will be appointed for two years and will be eligible for re-appointment.

Blocking power: The central government or any authorized officer can order blocking of public access to the data fiduciary’s platform, upon a reference by the Board. Blocking can only be ordered if it is necessary or expedient in the interests of the general public, and before issuing a blocking order data the fiduciary should be given an opportunity to be heard. The government can order any intermediary to assist in giving effect to the blocking order.

Penalties: The schedule to the Bill specifies penalties for various offences such as up to: (i) Rs. 200 crore for non-fulfilment of obligations for children, and (ii) Rs. 250 crore for failure to take security measures to prevent data breaches.

Rules under DPDP Act: Since The IT Act,2000 Government has given itself broad powers to make subordinate legislation or decisions on any aspect permitted under the law, which continues in this bill also and includes rules for consent manager, process and format for reporting data breaches, matters related to the processing of children’s data, significant data fiduciaries and process for impact assessment

Note: The DPDP Bill when passed by Rajyasabha would require President's assent and then notification by Government (Which could be part-by-part notifications) Then it will become the DPDP Act, 2023 i.e. Data Protection Law of India