Research and Articles

1. Major overhaul of current data protection law in India:

The erstwhile data protection regime under the Information Technology Act, 2000, was limited in scope to electronic information, largely concentrating on sensitive personal data and information. It was a notice-and-consent-based regime, with minimal compliances. The PDP Bill is a far more complex and far-reaching than the current law.

2. Extra-territorial application:

It applies to entities outside India if they have a business connection to India or carry on profiling of individuals in India.

3. New data regulator (the Data Protection DPA, the “DPA”), adjudicating officers, and appellate tribunal:

The PDP Bill introduces a specialized regulatory approach to data protection. The DPA will be the first cross-sector data protection regulator in India and has significant regulation-making powers.

4. Subordinate legislation:

The PDP Bill delegates a host of important matters, including the specification of types of data, classes of regulated entities, and codes of practice to the Central Government and the DPA. A true compliance picture will form only when these rules and regulations are framed.

5. Wider categories of data protected:

Most parts of the PDP Bill apply to all ‘personal data’. Higher benchmarks of compliance are prescribed for ‘sensitive personal data’ and ‘critical personal data’ (which are subsets of ‘personal data’).

Non-personal data / anonymized data does not qualify as ‘personal data’, and the compliance requirements applicable to personal data do not apply to these forms of data. However, as discussed below, the PDP Bill provides an important exception for the Government to direct organizations to provide their non-personal in certain circumstances.

6. Data localization for sensitive data:

A copy of all ‘sensitive personal data’ must be stored in India but may be transferred outside India. ‘Critical personal data’ (which will be defined by the Central Government) must be processed only in India, with exceptions. Organizations processing sensitive personal data should prepare their infrastructure for data localization.

7. Cross-border transfer restrictions:

Mere personal data (that is non sensitive personal data or critical personal data) has been exempted from cross-border transfer restrictions.

Sensitive personal data may be transferred outside India if there is:

(a) Explicit consent of the individual, and

(b) Either:

1. A regulator-approved contract or intra-group scheme for the transfer; or
2. A regulator-approved transferee entity or country.

Data notified as ‘critical personal data’ may be transferred outside India on certain narrow grounds.

8. Privacy principles:

The principles underlying the PDP Bill are largely in line with global regulation, and include consent (with exceptions), purpose limitation, storage limitation and data minimization.

9. Rights-based law:

The rights conferred on individuals include:

• the right to data portability;
• the right to be forgotten;
• and the rights to access, correction, and erasure.

Data fiduciaries (those that determine the purpose and means for processing) will need to implement processes to honor these rights when exercised by individuals.

10. Consent managers:

A new concept of registered ‘consent managers’ who liaise between individuals and data fiduciaries, including for the exercise of the above rights, has been introduced.

The idea of ‘consent managers’ is innovative but relatively untested. It appears intended to mitigate the concern of ‘consent fatigue’ and help educate the uninitiated. These entities will be a new class of players in the data ecosystem. It will be interesting to keep an eye on the implementation of the consent manager framework.

11. Three types of regulated entities:

In increasing order of compliance obligations, these are:

1. Data processor (akin to the eponymous GDPR concept);
2. Data fiduciary (akin to the GDPR ‘data controller’); and
3. Significant data fiduciary (a subset of data fiduciary).

Significant data fiduciaries (“SDFs”) are treated as full-fledged regulated entities and are required to implement independent data audits, appoint a data protection officer, and carry out data protection impact assessments prior to carrying out any processing with a risk of significant harm, among other obligations. SDFs include ‘social media intermediaries’ with over a certain number of users.

12. Data breach notification:

In case of a data breach, the DPA is to be intimated, who may require that the data breach be reported to affected individuals and that remedial action be taken.

13. Special provisions on children’s data:

The PDP Bill provides for age verification; parental consent; and raised obligations for ‘guardian data fiduciaries’ (a class of designated entities whose services are directed at children or who process large volumes of children’s personal data).

14. Innovation sandbox for artificial intelligence and emerging technology:

The innovation sandbox is supervised by the regulator, and eligible data fiduciaries can avail of relaxations from certain obligations of the PDP Bill up to a maximum period of 3 years.

15. Government requests for anonymized and non-personal data:

The Central Government has been given the power to direct that anonymized / non-personal data be shared by any entity with the Central Government, in certain circumstances.

This is a provision directed at the use of data for public good; Rules in this connection are awaited to flesh out more detail. A separate government-appointed committee is also examining this subject.

16. GDPR-like penalties:

The PDP Bill provides for civil compensation; financial penalties such as fines (up to 4% of global turnover); and criminal penalties in the limited case of unauthorized de-identification of data.