The Indian government introduced the Digital Personal Data Protection Bill, 2023, in the Lok Sabha to safeguard private data. It includes penalties of up to Rs. 250 crore for data breaches. Digital platforms must obtain explicit consent from users before processing their data and allow them to withdraw consent anytime. Exceptions to consent include medical emergencies, court orders, disasters, and government agency requirements.
The Bill permits cross-border data transfers, except to blacklisted countries, benefiting companies operating in India. It establishes an independent Data Protection Board to handle breaches and impose fines of up to Rs. 250 crore for non-compliance. Penalties of up to Rs. 200 crore can be imposed for non-compliance with children’s data protection.
Digital platforms must provide notices in all 22 official languages outlining data processing purposes and user rights. Users who have already provided data must be allowed to withdraw consent for their cyber security.
The Bill does not categorise data as sensitive or critical and excludes anonymized, non-personal, and offline personal data. It includes provisions for alternative dispute resolution to avoid litigation.
The Bill’s inception dates back to 2017, when the Supreme Court recognized the right to privacy. A committee chaired by Justice BN Srikrishna drafted it, tabled it in 2019, and later withdrew for revisions following suggestions from a joint parliamentary committee.
Union Minister Rajeev Chandrasekhar highlighted the punitive solid measures in the amended Bill and the government’s commitment to data security and privacy. However, the Opposition raised concerns that the Bill could lead to a surveillance state. The government denied classifying it as a money bill.
The Bill aims to balance privacy protection with innovation and economic growth. It grants the government access to content in the interest of national security and emergencies.
The Bill is now open to discussions and suggestions from the Opposition. Specific legal requirements will be clarified after the government defines the rules post-enactment.
