Digital Data Protection Bill 2023 passed in Lok Sabha: A breakdown of key points

The Lok Sabha has passed the Digital Personal Data Protection Bill, 2023. This legislation sets out the responsibilities of entities handling and processing digital data while upholding the rights of individuals in India. The bill introduces substantial penalties, ranging from a minimum of Rs 50 crore to a maximum of Rs 250 crore, for those found violating its provisions.

The primary objective of the Digital Personal Data Protection Bill, 2023 is to establish a comprehensive framework for the protection of personal data. This framework extends its jurisdiction to personal data collected within India, both online and offline data that has been subsequently digitized. Moreover, if data processing occurs outside India but involves offering goods or services to individuals within the country, the bill's regulations will apply.

Union Communications, Electronics and Information Technology Minister Ashwini Vaishnaw presented the bill in the Lok Sabha on August 3. Despite calls from the opposition to refer the bill to the standing committee for further examination, Vaishnaw defended its nature as a "normal bill" and moved it for discussion.

Also Read: Apple iPhone 14, iPad Pro, MacBook Air, Apple Watch Series 8, AirPods Pro big discounts on Vijay Sales: Check deals

Key highlights of the Digital Personal Data Protection Bill, 2023 include:

Data Security: Entities dealing with user data are required to ensure the protection of personal data, even if it is stored with third-party data processors.

Data Breach Notification: In the event of a data breach, companies are mandated to promptly inform the Data Protection Board (DPB) and affected users.

Special Provisions for Children and Physically Disabled Persons: Processing data of minors and individuals with guardians must be done only with the consent of guardians.

Appointment of Data Protection Officer (DPO): Firms are required to appoint a Data Protection Officer and share their contact details with users.

Government Authority over Data Transfer: The bill empowers the central government to regulate the transfer of personal data to foreign countries or territories beyond India.

Appeals Mechanism: Appeals against DPB decisions will be adjudicated by the Telecom Disputes Settlement and Appellate Tribunal.

DPB's Authority: The DPB has the authority to summon and examine individuals under oath, inspect documents of companies handling personal data, and recommend blocking access to intermediaries that repeatedly breach the bill's provisions.

Penalties: The DPB will assess penalties based on the nature and severity of the breach, with potential fines of up to Rs 250 crore for instances of data breaches, failure to protect personal data, or failure to inform the DPB and users of a breach.

Also read: ‘Will regulate AI,' says MoS IT Rajeev Chandrasekhar on Digital India Bill

Also read: 'Misinformation tends to travel faster than truth': MoS IT Chandrasekhar on need for Digital Data Protection Bill