India Publishes New Personal Data Protection Bill

Indian government has recently proposed a new data privacy bill, Digital Personal Data Protection Bill 2022, the fourth attempt to try to pass the law. The new draft bill will allow cross-border personnel data transfers with exceptions and establishes a Data Protection Board to oversee compliance and impose penalties

Key features of the revised draft:

1. The government will have the power to specify the countries to which companies can transfer personal data. This will allow companies to send user data to servers located in countries on that list.
   
   
2. The government can exempt state agencies from processing data from the proposed law in the interest of national security
   
   
3. The government will establish a "Data Protection Board" for ensuring compliance with the proposed law. The board will also hear user complaints.
   
   
4. Companies of "significant" size - based on factors such as the volume of data they process - should appoint an independent data auditor to evaluate compliance with the provision of the law.
   
   
5. The Data Protection Board can levy financial penalties for non-compliance. Failure of entities to take reasonable security safeguards to prevent data breaches could result in fines of up to 2.5 billion rupees ($30.6 million) as per draft proposal. Distinction of data classes have been done away with. Compliance costs may increase.
   
   
6. Companies will be required to stop retaining user data if it no longer serves the purpose for which it was collected. Users shall have the right to correct and request for erasure of their personal data.
   
   
7. No company or organization will be allowed to process personal data that is "likely to cause harm” to children, and advertising cannot target children. Before processing any personal data of any personal data of a child, parental consent will be required.
   
   
8. The law will cover personal data collected online and digitized offline data. It will also apply to the processing of personal data abroad, if such data involves profiling Indian users or selling services to them.
   
   
9. The bill is watered down one on the previous bill and allows for expanded coverage in subsequent legislation.

An in-depth write up, tracing back to the Supreme Court ruling to the current bill can be found here.

HRPI Outlook: The new draft bill addresses worries over data localization and by allowing cross-border flow of data within trusted nations. However, the specific implementation date is still not clear.