India Poised to Enact Digital Personal Data Protection Bill

On August 9, 2023, India’s upper house (i.e., Rajya Sabha) passed the Digital Personal Data Protection Bill (“DPDPB”), two days after India’s lower house (i.e., Lok Sabha) passed the legislation. The DPDPB now heads to India President Droupadi Murmu for signature.

The final text of the DPDPB as passed has not yet been released, but India’s Ministry of Electronics & Information Technology released a description of the DPDPB’s “salient features” which include:

• Obligations of “data fiduciaries” (i.e., persons, companies and government entities who process data), including as to security safeguards, data breach notification, data minimization, data erasure, responding to “data principal” (i.e., the person to whom the data relates) grievances, audits, data protection impact assessments, and children’s data;
• Rights of data principals, including rights of access, correction, erasure, grievance redressal including by the data fiduciary and then by “Data Protection Board”, and to nominate a person to exercise rights in case of death or incapacity; and
• Financial penalties for breach of rights, duties and obligations.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts