India Proposes Important New Privacy Bill

Kegler Brown Global Business News

3-4 months ago, India abruptly withdrew its bill related to data protection and privacy. It has now proposed a new comprehensive data privacy law known as the Digital Personal Data Protection Bill (2022) that would mandate how companies must handle the personal information of Indian citizens and permits cross-border transfer of information with certain nations.

According to the proposed bill, its purpose “is to provide for the processing of digital personal data in a manner that recognizes both the right of individuals to protect their personal data and also the need to process personal data for lawful purposes, and for matters connected therewith or incidental thereto.”

Similar to Europe’s General Data Protection Regulation Act (GDPR) and the California Consumer Privacy Act (CCPA) in the U.S., India’s draft bill would apply to businesses operating in the country and to any entities processing the data of Indian citizens and residents. And much like these regulations, India’s bill proposes a financial penalty of up to $30.6 million in the event a firm fails to provide “reasonable security safeguards to prevent a personal data breach.” Additionally, another $24.5 million fine could be levied if the firm fails to disclose the breach to the local authority and its users.

One other key provision of the bill requires that a “data fiduciary” (i.e., an entity that processes user data) give an itemized notice to users on data sought to be collected, in clear and plain language. It also mandates that the user should be allowed the right to give, manage, or withdraw consent from sharing his or her information.

As next step, the draft bill (attached) will undergo extensive consultation, including receiving public comments until December 17, and the government is planning to introduce it in Parliament by the next budget session, which would likely be in March or June of 2023.

We will keep you updated as the bill makes its way through the process and the final form is submitted to Parliament early 2023.

Vinita Mehra is a director and chair of the firm’s Global Business practice, where she monitors the subcontinent’s regulatory environment and works with businesses in the U.S. and India on adjusting business strategy in light of meaningful changes. She can be reached directly at [email protected] or 614-255-5508.