News Update

Lok Sabha Greenlights Tough Data Protection Bill 2023 with Heavy Fines of Up to Rs 250 Crore

• ByStartupStory     |    August 8, 2023

The recent approval of the Digital Personal Data Protection Bill, 2023 by the Lok Sabha is a pivotal step toward reinforcing data security and safeguarding individual privacy within India’s digital landscape. The legislation establishes a robust framework governing the handling and processing of personal data, underpinned by substantial penalties ranging from Rs 50 crore to Rs 250 crore for any breaches.

This bill addresses the pressing need to protect personal data in an era of digital expansion. Its reach extends to encompass data collected within India, whether through online or offline means. Importantly, the bill’s stipulations apply even when data processing involves offering goods or services to Indian citizens from beyond the nation’s borders.

The bill was presented by Union Minister Ashwini Vaishnaw on August 3, with some calls from the opposition to refer it to the standing committee for further scrutiny. Despite these requests, Vaishnaw defended the bill’s classification as a “normal bill” and successfully steered it toward a parliamentary discussion.

Several key highlights of the Digital Personal Data Protection Bill, 2023 are as follows:

1. Data Security: The bill mandates entities to ensure the protection of user data, including instances when data is stored with third-party processors.
2. Data Breach Notification: Companies are required to promptly report data breaches to the Data Protection Board (DPB) and the affected users, ensuring transparency and timely action.
3. Special Provisions: Consent from guardians becomes obligatory for processing data related to minors and individuals under guardianship.
4. Data Protection Officer (DPO): Businesses are directed to appoint a Data Protection Officer and share their contact information with users.
5. Government Authority over Data Transfer: The central government is vested with the authority to regulate the transfer of personal data beyond India’s borders.
6. Appeals Mechanism: Appeals stemming from DPB decisions are directed to the Telecom Disputes Settlement and Appellate Tribunal, providing a recourse for enforcement.
7. DPB’s Authority: Empowered by the bill, the DPB is authorized to summon individuals under oath, inspect documents, and recommend blocking intermediary access.
8. Penalties: The DPB is authorized to impose fines of up to Rs 250 crore for breaches, failure to protect data, or not informing the DPB and users about breaches.

The Digital Personal Data Protection Bill, 2023 stands as a robust defense against data vulnerabilities and an affirmation of individual privacy rights within India’s digital ecosystem. As technology continues to shape daily interactions, this legislation serves as a proactive safeguard, ensuring the sanctity of personal data.

Follow Startup Story