Digital Personal Data Protection Act (DPDPA), 2023, was finally been passed in both the houses of parliament and has been signed by the President of India. The bill was introduced in Lok Sabha on August 3, 2023, and was passed by Lok Sabha on August 7, 2023, and unanimously by Rajya Sabha on August 9, 2023.
The process of drafting data protection law in India was notably lengthy, as is customary for the passage of any legislation in the country. However, the execution phase proceeded relatively swiftly. Numerous experts have voiced concerns about the persistent flaws and gaps within the laws. To be fair, any law gets evolved over the time to be perfect.
Personal Data Protection Bills of 2019 & 2022, which was predecessor to this bill, has been withdrawn by central government along with its multiple amendments. Personal Data Protection bill was mired with multiple concerns for transparency, data localization and was considered quite compliance intensive. One positive aspect of delay in drafting DPDPA 2023 is that it provided ample time for the legal community, data experts, policy makers, and industry stakeholders to engage in thorough debate and discussion to address all the intricacies of this act. This is evident in the comprehensive nature of the act, which addresses various aspects of data, including social media, WhatsApp, and personal data. The stringent legislation we have today is a result of these in-depth discussions.
The Act's main goal is to set up a comprehensive structure for safeguarding and managing Personal Data. As stated in legislation, the Act allows processing of digital Personal Data in a manner that recognizes both the rights of the individuals to protect their Personal Data and the need to process such Personal Data for lawful purposes and matters connected therewith or incidental thereto. The Act will encompass the handling of Personal Data within India, including both online and digitized offline data. Additionally, it will also pertain to the processing of such data beyond India concerning the provision of goods or services in India. This act provides precise definition of Data, Processing of Personal Data, rights, and duties of an individual and consent. The role and obligations of Data fiduciary is underscored. They play key role in implementing the act and have been provided with clear operational guidelines.
It is crucial to establish mechanisms that hold the government accountable as a data custodian, said Dr Kislay Pandey, a leading corporate lawyer of India. The DPDPA already exhibits industry-friendly characteristics when it comes to financial data and is in accordance with established regulatory standards. Nonetheless, achieving harmony among data processors and fiduciaries is essential to create an equitable environment across various sectors. Specific measures need to be taken to explicitly regulate emerging technologies like AI and tapping into their potential to bolster data protection. “To reinforce the legislation's strength, it is imperative that we incorporate emerging technologies within its framework. It is impractical to revise the legislation every time a new technology emerges. Simultaneously, we must take measures to prevent unnecessary fragmentation of the law”, Dr Kislay Pandey explains. He further said, “To ensure the efficacy of data protection and privacy regulation in India, it is vital to establish mechanisms for holding government accountable as significant data custodians. There should be further clarity in definitions to provide exemptions for data storage for legitimate purposes.”. Dr Pandey is a top Supreme Court Lawyer specializing in Corporate and Data laws and was part of many key discussions that led to this policy formulation.
Crafting and enacting policies in India is a complex undertaking. The legislative process involves accommodating diverse perspectives and sometimes negotiating with vested interests. It is not realistic to expect policies and laws to be flawless upon their initial introduction. However, the country is making progress on the journey toward achieving more effective and refined policies over time.
(At The Quint, we are answerable only to our audience. Play an active role in shaping our journalism by becoming a member. Because the truth is worth it.)