Understanding the Digital Personal Data Protection Bill (DPDPB)

The Digital Personal Data Protection Bill, 2022 (DPDPB) has been released with the scope of protecting the privacy rights and freedom of individuals in India. The bill deliberates on the parties involved, governance, requirements, penalties, and grievance mechanisms to empower an individual and provide control over their personal data in digital format.

The draft bill sets out the rights and duties of the citizen and the obligations of the Data Fiduciary to use the collected data lawfully. It envisages the setting up of a Data Protection Board of India to determine non-compliance with the provisions of the draft bill and impose penalty for such non-compliance, as the composition of the board and its establishment, shall by determined by the central government.

Currently, data protection in India is governed by the Reasonable Security Practices and Procedures and Sensitive Personal Data or Information, 2011 and the Information Technology Act, 2008. The Digital Data Protection Bill, once enacted, will have significant implications for organisations operating in India - a clear indicator that organisations would need to re-assess their data privacy programs.