India Releases Draft Digital Personal Data Protection Bill

BGA’s India team, led by Managing Director Ratan Shrivastava, wrote an update on India’s release of a draft of a long-awaited key data protection bill.

Context

• India’s Ministry of Electronics and Information Technology (MeitY) published the long-awaited draft Digital Personal Data Protection Bill, 2022 (Bill). First issued in 2018, this is the fourth iteration of the bill, with the last one issued in 2021 and subsequently withdrawn in August 2022.
• Since the withdrawal, Minister of Electronics and Information Technology Ashwini Vaishnaw and Minister of State Rajeev Chandrashekar have emphasized bringing out a simpler bill which can be easily understood and implemented. As a result, the draft bill has remarkably shrunk to only 30 clauses from the over 100 in the previous version. The government is currently engaged in stakeholder discussions and has invited comments and feedback on the draft bill from public and private stakeholders.

Significance

• At the outset, industry has hailed the business-friendly changes in the new draft, including the exclusion of non-personal data, relaxed regulations for social media, hardware product audits, diluted data localization norms and reduced bureaucratic involvement in the proposed Data Protection Board (DPB).
• Clarifications on definitions and specificity of key clauses remain. This is especially the case for matters of obtaining consent, penalties for organizations that fail to contain or inform the government of data breaches and the government’s involvement in the DPB and discretion to prescribe new rules from time to time. Since the notification of new rules after the implementation of an act does not have to undergo the same scrutiny in Parliament, concerns on clarity and transparency in the Bill remain.

Implications

• The draft bill is open for public feedback until December 17 and the comments can be submitted on the MyGov website. Given the short timeframe available, companies are advised to submit recommendations on specific issues to the government rather than compile a long list of concerns. This will allow the government to more easily evaluate these inputs as they prepare to table the final bill in Parliament.
• Both Minister Vaishnav and Minister of State Chandrasekhar have indicated that the proposed bill could likely be tabled in Parliament’s upcoming winter session. The government is likely to move the draft in a timely manner to ensure global appreciation of India’s data privacy efforts, which is presently a major chink in the country’s armor given the rate of rapid digitalization.
   

BGA will continue to keep you updated on developments in India. If you have questions or comments, please contact BGA India Managing Director Ratan Shrivastava at ​​​​​​ratan@bowergroupasia.com.