The new data bill will mark a paradigm shift

India is probably the last significant nation with no active data protection regime. The new bill, with its simplicity and innovations, fills that gap. No law can satisfy all constituencies, but that cannot impede progress

- Rahul Matthan

The Digital Personal Data Protection Bill was passed by the Lok Sabha yesterday. Even though there are a few provisions in this draft that I'd have preferred were left out, I believe this is the closest we have ever come to a law that is appropriate for our current stage of maturity in data protection.

India is probably the last significant nation without an active data protection regime. As a result, notwithstanding the depth of our tech industry, we have none of the institutional infrastructure that is commonplace elsewhere in the world - both within private sector entities for them to comply, or in the executive branch of the government to enforce.

This is why I have been opposed to the enactment of a compliance heavy, General Data Protection Regulation (GDPR) style regulation in India, even though this is widely believed to be the gold standard for data protection.

The new bill retains much of the simplicity that was the hallmark of the draft version made available for consultation. While it emphasises consent as the primary grounds for processing, the notice requirements are simple, doing away with much of the complexity that previous versions had.

Most of the other data protection principles retention restrictions, purpose specifications, data security, and the like have been included, though with none of the detail that GDPR-style laws possess.

But where the proposed law really shines is in some of its less obvious innovations.