The Data Knowledge

EVERYTHING YOU NEED TO KNOW ABOUT THE DIGITAL PERSONAL DATA PROTECTION BILL, BY THE EXPERTS OF MGC GLOBAL RISK ADVISORY.

India finally has its standalone law on data protection; where individuals and organisations assume greater control over the manner in which their personal data is collected, stored, processed, transferred, disclosed and used.

After nearly six years of extensive deliberations and consultations between the central government, technology companies’, civil society representatives & other stakeholders, the Digital Personal Data Protection Bill 2023 (‘DPDP’), was tabled and approved in the Indian Parliament (in the Lok Sabha on August 3, 2023 and the Rajya Sabha on August 09, 2023) and received the Hon’ble President’s assent on August 12, 2023.

The DPDP is now India’s comprehensive framework (referred to as ‘DPDP Act’ or ‘the legislation’) for the protection and processing of personal data. The DPDP Act defines rights for data principals (often called “data subjects” in global privacy laws) and responsibilities for organisations handling personal data (termed “data fiduciaries” in the DPDP). It aims to safeguard Indian citizens’ privacy, suggesting penalties of up to Rs 250 crore (~US$30 million) for organisations that mishandle or neglect the protection of individuals’ digital data.

While the Information Technology Act 2000 (as amended) read with its supplementary rules, have provided the legal cornerstone to ensure the protection of personal information, India clearly needed a comprehensive legal framework to address the overarching principles of data protection.