The bill will be implemented following a "digital-by-design" principle.
The Centre is likely to release draft rules under the Digital Personal Data Protection Act within a month, according to Information and Broadcasting Minister Ashwini Vaishnaw. The rules will be simple and framed after consultation.
What is the Digital Personal Data Protection Bill?
The Digital Personal Data Protection (DPDP) Bill is a significant legislative development aimed at safeguarding personal data in the digital age. It was approved by Parliament on August 9, 2023, six years after the Supreme Court's landmark judgement in the Puttaswamy case (2017), where the Right to Privacy was recognised as a fundamental right under the Indian Constitution.
Key Provisions
- The DPDP Bill introduces strict regulations on how personal data can be collected, processed, and stored by entities. It underlines organisations must obtain clear consent from individuals before processing their data.
- In cases where personal data is compromised, the bill outlines penalties of up to Rs 250 crore.
- The bill defines "personal data" expansively to include any data that can identify an individual, whether collected directly in digital form or digitised after collection.
- While the bill enforces stringent regulations for private entities, it provides the government with the authority to exempt certain state agencies from these rules. This has been a point of contention, with debates on the balance between national security and individual privacy.
- The government has assured that the rights of Indian citizens will not be compromised, regardless of whether their data is stored in India or overseas. This provision aligns with global standards while protecting domestic interests.
Child Protection
The DPDP Bill places special emphasis on protecting the personal data of minors (defined as individuals below age 18). Section 9 mandates that before processing the data of minors, entities must obtain parental consent and verify the child's age.
Implementation
The bill will be implemented following a "digital-by-design" principle. This means that the platforms and portals used for enforcement will be developed by in-house government agencies such as the National Informatics Centre (NIC) and the Digital India Corporation (DIC).
The final rules for implementing the DPDP Bill are expected to be released for public consultation within a month. The consultation period will last for 45 to 60 days, with the possibility of an extension.
This will be a critical phase where stakeholders, including the public, can provide feedback on the draft rules before they are finalised and sent back to Parliament for approval.