Page Loader
Digital Personal Data Protection Bill, 2022: Everything to know
Along with six chapters, the draft Digital Personal Data Protection Bill, 2022, lists out 25 points based on seven principles

Digital Personal Data Protection Bill, 2022: Everything to know

Nov 18, 2022
09:51 pm

What's the story

The Union government released a draft of the Digital Personal Data Protection Bill, 2022, on Friday, seeking public feedback. A highlight of the draft is the proposed penalty of Rs. 250 crore on the data processor for failing to maintain the necessary security to prevent personal data breaches. In comparison, the previous 2019 draft bill had proposed a corresponding penalty of Rs. 15 crore.

Context

Why does this story matter?

In August 2022, the Electronics & IT Ministry withdrew the Personal Data Protection Bill 2019 after a parliamentary committee suggested 81 amendments to it. Many provisions in the draft—like data localization and hardware authenticity clauses—didn't come under the purview of data protection. This had come after a joint parliamentary committee deliberated the 2019 draft for two years before tabling its report in December 2021.

Information

First ever legislation to use 'she/her' pronouns as standard

The proposed legislation has been renamed from "Personal Data Protection Bill" to "Digital Data Personal Protection Bill, 2022." It aims to facilitate the processing of digital personal data information while recognizing the rights of citizens to protect and process their personal data. In a first, the draft legislation has used the terms "she" and "her" as the standard pronoun irrespective of an individual's gender.

Twitter Post

Government has sought public feedback on the draft Bill

Details

Data privacy laws of Australia, EU, Singapore reviewed

The draft was prepared after reviewing the data privacy legislation in Australia, European Union (EU), Singapore, and a prospective bill in the United States, too. It has six chapters—Preliminary, Obligations of Data Fiduciary, Rights and Duties of Data Principal, Special Provisions, Compliance Framework, and Miscellaneous. The draft proposes setting up a Data Protection Board of India to enforce the provisions of the new law.

Information

Individual's consent required before processing data

The individual's (Data Principal) consent before processing their information is mandatory, per the draft Bill. Data processing won't be allowed if it is likely to harm a child. Cross-border personal data transfer will be allowed only to select countries after a government assessment and verification.

Data processing

Provision to provide basic information in all 8th Schedule languages

To help citizens better assess the situation under which their personal data is sought, a provision also focuses on mandating the availability of basic information to them in all languages under the 8th Schedule of the Constitution. An individual's data can be processed only if it's done in accordance with the provisions of the Bill and if the purpose isn't forbidden under the law.