Cabinet approves Data Protection Bill, to be introduced during the monsoon session of Parliament

The Draft Digital Personal Data Protection (DPDP) Bill, 2023, was approved on Wednesday by the union cabinet, which is led by Prime Minister Narendra Modi. A senior government official said that the bill will now be presented to Parliament during the upcoming monsoon session for approval.

The draught bill, which was released for public comment in November 2022, suggests a significant increase in the penalty amount of up to Rs 500 crore for breaking the provisions while also loosening the rules on, among other things, cross-border data flows.

Approximately 21,666 comments were made on the draft legislation, according to a Ministry of Electronics and Information Technology official, and “everyone was considered and included in the final bill, wherever possible.”

The official added that the bill had undergone a few minor changes, but he would not elaborate. “We interviewed about 48 organisations… The official said, “We drafted the bill in a way that it stands the test of time even as the technology keeps evolving. The Data Protection Board, a new regulatory body that the government will establish, will have the authority to fine a person up to Rs 500 crore if their non-compliance is deemed to be significant, according to the draft.

The bill suggests six different sanctions for non-compliance, including fines of up to Rs 250 crore for failing to implement reasonable security safeguards, Rs 200 crore for failing to notify the Board and affected users in the event of a personal data breach, and Rs 200 crore for failing to fulfil additional obligations pertaining to children.

The draft eliminates the provision for affected data principals to receive compensation and instead proposes to fine violators Rs 10,000 for providing unverifiable or false information when requesting any type of document, service, identity document, or filing a false or baseless complaint with the board or a data fiduciary (the party responsible for collecting and processing the data).

A “Data Principal,” according to the Bill, is “the individual to whom the personal data relates and, where such individual is a child, includes the child’s parents or legal guardian.” Organisations that collect data, like banks, must make it clear why they are doing so. In response to a question regarding the removal of the compensation clause, the official stated that the judiciary would decide on the affected parties’ compensation.

The official stated that “the affected party can take the data fiduciary to civil court for any breach or misuse of data.” The draft legislation will soon be presented to the Parliament for approval, at which point it will become law. Parliament’s monsoon session will take place from July 20 to August 11.