Decoding The New PDP Bill

The latest version has some wins for privacy but retains wide government exemptions

- Nehaa Chaudhari and Sreenidhi Srinivasan

A few months ago, for this paper, we had put down our wishlist for India’s new data protection law. We had wanted leaner, principle-based, personal data protection-focussed law, with a robust regulator and enabling of cross border data flows. How does our recently released digital personal data protection bill compare?

Narrow focus

The new draft law is certainly leaner – down to 30 sections from 99. 

● It is focussed on personal data and excludes non-personal data, which was a demand by the industry and civil society alike.

● It eliminates the categorisation of personal data into sensitive and critical.

● Those who had wanted the erstwhile definitions of sensitive and critical data to be clear and narrowly tailored might see this elimination as a win.

● But this also means that all the provisions of the new law – for example, restrictions on cross-border data flows – will now apply equally to a wider set of personal data, which was not the case earlier.

New regulator

The regulator is now a Data Protection Board, with its role limited to enforcement and penalties. It appears that other aspects of implementing the law are left entirely up to the central government (which it will do through rules) and not the specialised regulator.