Digital Personal Data Protection Bill passes the Lok Sabha floor

The Lok Sabha Monday passed the Digital Personal Data Protection (DPDP) Bill by a voice vote amid some slogan-shouting by Opposition members seeking a debate on the Manipur issue.

On Monday, the bill was presented for passing and consideration by Union Electronics and Information Technology Minister Ashwini Vaishnaw, who said that the DPDP will safeguard the digital personal data of 1.4 billion citizens.

The passage of the bill in the lower house brings India on the penultimate step of the country finally having its own digital data privacy law. The bill will now be presented for consideration and passing in the Rajya Sabha, following which it will be sent to the President for her assent and then be notified as a law.


“Today, about 90 crore (900 million) Indians are connected to the internet. Even the smallest of villages are connected. In such a connected world, this bill has been brought to protect the rights, ensure safety and privacy of citizens,” Vaishnaw said, while presenting the bill for consideration and passing in the Lok Sabha.

The bill, he said, had been discussed in several forums including the Joint Parliamentary Committee and the Parliamentary Standing Committee, over the years and then been presented before the house.

The bill, Vaishnaw said, relied on the principles of legality, purpose and storage limitation, data minimisation, accuracy, reasonable safeguards, and accountability.

Discussions on the bill, which lasted for less than an hour, saw some members raising objections against certain clauses. These included the composition, structure, and the lack of independence of the Data Protection Board (DPB), the alleged dilutions to the Right to Information (RTI) Act as well as setting the user consent threshold at 18.

“Some important points were made by opposition members including the lack of independence of the Data Protection Board, the need to re-look at the RTI amendment and age of consent for children. One hopes that there is a more substantive discussion on the Bill in the Rajya Sabha,” Aparajita Bharti, founding partner at policy consulting firm TQH Consulting said.

The Bill paves the way for India's first privacy bill that will give people much more control over their personal information and the manner in which it is processed by internet intermediaries.

In the event of a data breach or an intermediary not following the provisions mentioned under the bill, there are steep penalties of up to Rs 250 crore per instance, which can be levied by the Data Protection Board. The Data Protection Board is proposed to be set up as an independent body adjudicating the execution of the provisions under the DPDP Bill.

Users can consent to only certain aspects of their data being processed and can withdraw their consent from the data set being processed by companies at any time. Companies which process the personal data of users will also have to notify the users the nature of the data being taken as well as the purpose for which such data is being taken.

A stricter rule has been proposed for the processing of data of users below the age of 18, who will be placed under the category of children. The DPDP Bill has proposed that companies should get explicit parent consent before processing the data of children.

Only in exceptional circumstances where the data fiduciary is able to demonstrate that it can process the data of children in a “verifiably safe manner” will they be allowed to go ahead, the bill proposed. The IT ministry is likely to decide the provisions to determine verifiably safe processing of data.

The bill has also proposed easy cross-border flow and processing of personal data of Indian users, except in certain jurisdictions that may be notified by the Indian government from time to time.