Digital Personal Data Protection bill now an Act; receives President's assent

The Digital Personal Data Protection bill, passed by Parliament this week, has received President's assent, Union Minister Ashwini Vaishnaw said on Saturday.

Digital Personal Data Protection (DPDP) law aims to protect the privacy of Indian citizens while proposing a penalty of up to Rs 250 crore on entities for misusing or failing to protect digital data of individuals.

Companies handling user data will be required to safeguard the individual's information, and instances of personal data breach have to be reported to the Data Protection Board (DPB) and the user.

"DPDP Bill becomes an Act. Received Hon'ble President's assent," Vaishnaw said in similar posts on X (formerly Twitter), and homegrown app Koo.

On August 9, the Rajya Sabha approved the DPDP bill that introduces several compliance requirements for the collection and processing of personal data, has provisions to curb misuse of individuals' data by online platforms, and entails up to Rs 250 crore penalty for any data breach.

Data of children can be processed after consent from guardians, as per the DPDP law. The Lok Sabha had approved the bill on August 7. The government expects to implement the Act within 10 months, IT Minister Vaishnaw had said earlier this week.

The bill lays down the manner in which companies should process users' data, and gives the government power to seek information from firms and issue directions to block content on the advice of a data protection board appointed by the Union government. It allows users the right to correct their personal data.

The bill applies to the processing of digital personal data in India, where the personal data is either collected in digital form or in a non-digitised format and subsequently digitised.

The bill defines 'personal data' broadly to include any data about an individual who is identifiable by or in relation to such data. 'digital personal data' is defined to mean personal data in digital form.

DPDP gives the government powers to exempt state agencies from the law.

"The Digital Personal Data Protection Bill, 2023 a bill to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto," the DPDP bill said.

It moots creation of Data Protection Board of India to handle grievances of individuals around personal data privacy if data fiduciaries or firms using personal data fail to address individuals' complaints.