PDP bill reaches parliament


The much-awaited Personal Data Protection Bill, 2019 (PDP bill) was introduced in the Lok Sabha (lower house) of the parliament on 11 December 2019. The PDP bill has been substantially revised from the draft PDP Bill, 2018, which was proposed in July 2018 by a committee of experts set up by the government, chaired by retired Supreme Court judge, B.N. Srikrishna. Along with the bill, the committee had released their report, with views and deliberations giving context to the bill.

The PDP bill is an omnibus, cross-sector privacy law, with similarities to the EU’s General Data Protection Regulation and the California Consumer Privacy Act. The PDP bill, when enacted, will replace section 43A of the Information Technology Act, 2000, and its associated rules, which currently provide for the general data protection framework in India.

The PDP bill, however, will not affect any existing sector-specific laws if it is passed in its current form. It is expected to bring in a sea change in the manner in which personal data are collected and processed in India.

After receiving industry feedback, the PDP bill has diluted provisions with respect to data localization and cross-border data transfers, as well as provisions for criminal liability as compared to the PDP 2018. However, it introduces some new concepts and provisions such as “social media intermediaries”, a “consent manager”, the provision of a regulatory sandbox, etc.

On 12 December 2019, the PDP bill was referred to a joint parliamentary committee that has been instructed to give its report on the bill to the Lok Sabha on the first day of the last week of the Budget Session 2020 (February 2020). Further changes may be made in the bill on the basis of the comments received from the parliamentary committee.

The PDP bill will need to go through the following additional steps before it becomes law: (1) submission of the parliamentary committee report; (2) passing by both houses of parliament, the Lok Sabha and the Rajya Sabha; and (3) presidential assent followed by notification in the official gazette.

The business law digest is compiled by Nishith Desai Associates, a research-based international law firm with offices in Mumbai, New Delhi, Bengaluru, Singapore, Silicon Valley, Munich and New York. The firm specializes in strategic legal, regulatory and tax advice coupled with industry expertise in an integrated manner.