The Union cabinet approved the Digital Personal Data Protection Bill, which requires consent before collecting personal information and imposes penalties for data breaches. The bill is likely to be presented in the upcoming session of Parliament.
First introduced in December 2019, the Personal Data Protection Bill had been withdrawn in August 2022 over feedback from stakeholders and various agencies. The government published a new draft Bill in November last year – titled the Digital Personal Data Protection Bill 2022 – and initiated a public consultation. According to the sources, the bill has kept all the provisions of the last draft that was released for consultation in November but has now proposed a lower penalty for data breaches.
A penalty of up to Rs 250 crore will be imposed on data fiduciaries and data processors for the data breach in their possession. They will be fined Rs 200 crore if they fail to inform the owners of the data or the proposed Data Protection Board of the breach, as per the sources. The earlier draft released in November proposed a much higher penalty of Rs 500 crore on the data fiduciaries, which are the point of collecting data such as an online e-commerce portal. Personal data can be processed under this bill only if an individual has consented to it. There are some exceptions when the government might need data on grounds of national security and law and order, the sources said.
21,666 comments were received from the public and a series of consultations were held with 46 sector organizations, associations, and industry bodies. Comments were also received from 38 government ministries and departments