Kochhar & Co. reports that, on November 18, 2022, the Government of India (“Government”) released the long-awaited fourth draft of India’s proposed privacy law, now renamed the Digital Personal Data Protection Bill.

Terms and Application

The draft law uses terminology similar to past versions: the data controller is called the “data fiduciary,” the data subject is called the “data principal,” and personal information is referred to as “personal data.” There is no separate category of sensitive personal data.   

The law applies only to personal data that is collected either online, or offline where the personal data is in a digitized format. The law will apply to processing of personal data outside India if the processing relates to any profiling of principals in India or offering goods or services within India. The law also exempts processing of data in India of persons located outside India under a cross-border contractual arrangement. This exemption may cover participants in the offshore outsourcing industry. The Government also may exempt certain data processing by its agencies from the application of the draft law.

Rights of Data Principals

Rights provided to data principals include the right to information, right to correction and the right to erasure where the purpose of processing the data is no longer being served. 

Grounds for Collection and Processing of Personal Data

Consent is a primary ground for collection and processing of personal data. Consent must be “freely given,” “specific,” and “informed.” To satisfy consent requirements, an “unambiguous indication of consent” must be provided through a “clear affirmative action” for processing of the personal data for the specified purpose.

Data fiduciaries must obtain verifiable parental consent before processing the personal data of children less than 18 years of age. Data fiduciaries also must not engage in tracking or behavioral monitoring of children, targeted advertising directed at children, or any data processing which is likely to cause harm to children. The Government may create exemptions from these requirements.

With the consent of the data principal, a data fiduciary may disclose or transfer personal data to other data fiduciaries, or engage a data processor by contract. Data processors may appoint sub-processors if the contract permits.  

Other grounds for collection and processing of personal data include: compliance with law or a court judgment; dealing with epidemics and threats to law and order; network security, prevention of fraud, credit scoring and recovery of debts; where processing of certain personal data is “necessary,” the person voluntarily provides her personal data and “it is reasonably expected that she would provide such personal data;” and where the processing is for a “fair and reasonable purpose,” to be further defined.

Notice Requirements

The notice requirements are now more limited, requiring an itemized disclosure of the types of personal data that would be collected and the purposes of using the personal data. 

Data Breach, Data Security and Integrity, and Retention Requirements

Data fiduciaries must maintain the accuracy of personal data, implement appropriate technical and organizational security measures, and take reasonable security safeguards to prevent data breaches. If a data breach occurs, the draft law requires notifying both the Indian data protection authority (called the Data Protection Board of India) and the relevant data principal(s), in a form and manner to be prescribed.

Data may not be retained when the purpose for which the data was collected is no longer being served and the data is not required for legal or business purposes. The Government is exempt from data retention obligations. 

Significant Data Fiduciary

The draft law retains the concept of a Significant Data Fiduciary (“SDF”). The Government will notify entities of their status as an SDF. The Government will determine SDF status based on criteria relating to the volume of data, the risk of harm, the potential impact on the sovereignty and integrity of India and the risk to electoral democracy.

SDFs must appoint (1) a data protection officer and (2) an independent data auditor to audit compliance with the law. Privacy impact assessments also may be required. These obligations are in addition to the obligations of every data fiduciary, which include appointing a contact person to whom a data subject may communicate grievances, publishing a grievance procedure and responding to complaints within seven days. Data principals may appeal decisions of data fiduciaries to the Data Protection Board of India. 

Data Localization

Unlike prior versions, the draft new law does not include any direct data localization provisions.  The Government has the right to provide notice as to which countries personal data may be transferred.

Enforcement

The draft new law prescribes penalties for noncompliance up to 50 million Rupees (approximately $60 million), depending on the violation. For example, failure to take reasonable security safeguards to prevent personal data breaches may result in a penalty of up to 25 million Rupees (approximately $30 million).