Personal Data Protection Bill (PDPB) – India’s emerging privacy paradigm

The Personal Data Protection Bill 2019was introduced in the Indian Parliament in December 2019 and is currently undergoing analysis by JPC. JPC has recommended that ambit of the Data protection bill in India  needs to expand to focus more on the digitization and localization of data. JPC also wants that the final Data protection bill to include nonpersonal data (not merely securing personal data), which comprises of sensitive and critical data.

The draft PDPB covers the data privacy of personal data of individuals across the data life cycle that includes collection, transfer, process, disclosure and disposal. Draft PDPB has few elements which are similar to other leading global data protection regulations like EU’s General Data Protection Regulation (GDPR). Draft PDPB also covers the obligations of the data fiduciary, such as lawfulness in processing the personal data, purpose limitation, collection limitation, storage limitation, quality of personal data, etc.

The draft PDPB in the present state also outlines provisions of tough penalties in response to data security breaches. The draft data privacy law calls for data fiduciaries to proactively develop privacy strategies to address privacy obligations and shift the way they approach data privacy. The data fiduciaries will have to establish organization-wide privacy responsibility and accountability for data privacy and might even warrant revamp of a few business processes to streamline data visibility.

The draft PDPB has the following key areas that have been covered as part of the framework which should support India with robust data privacy structure.

The draft Personal Data Protection Bill (PDPB) also has some restrictions around cross-border data transfer of critical personal data but the bill is yet to provide explicit clarity around definition of the same. Further, as some of the areas of the draft bill, such as data categories definition under critical data, declaration for data fiduciaries as a significant data fiduciary, data breach notification timeline, etc. would have dependency on data protection authority. Few operational pieces like privacy notice for a multilingual country like ours, would pose constraints on implementation.

In the case of developed regions like Australia, Canada and Europe, the privacy laws have been in existence for a fairly long duration. Developing countries like Brazil have only recently witnessed the rising tide for the adoption of privacy regulations to protect the personal data of its citizens.