New digital personal data protection bill to be introduced in the Indian parliament

The Indian government informed the Supreme Court on 11 April 2023 that a new law, the Digital Personal Data Protection Bill 2022, to enforce individual privacy online is ‘ready’ and will be introduced in Parliament’s monsoon session in July. If passed by Parliament, the new law would replace the current Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, notified in 2011.

According to the government, the purpose of the new Bill is to ‘provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their data and the need to process personal data for lawful purposes’. Under the new Bill, ‘data’ is defined as a ‘representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by humans or by automated means. The Bill would ‘separately define data fiduciary as persons who determined the purpose and means of the personal processing of data; data principal as the individual to whom the personal data is related; data processor as any person who processes personal data on behalf of a data fiduciary’.