DIGITAL

PERSONAL
DATA
PROTECTIO
N ACT
2017 2023
A committee was formed by MeiTY - Ministry of Electronics and The newest version of the bill has been released, and passed in the
Information Technology Lok Sabha on 7th August. On 9th August, the Rajya Saba passed it
This committee in turn released the Data Protection Bill 2021 and is now officially in action.
towards the end of 2021

The suggestions made have not been publicly displayed or discussed

anywhere, despite an RTI application being filed

2022

BACKGROUND
DEFINITIONS

“BOARD” REFERS TO THE NEWLY A DATA FIDUCIARY IS A PERSON WHO “DATA PRINCIPAL,” A TERM DEFINED FOR
ESTABLISHED DATA PROTECTION BOARD “DETERMINES THE PURPOSE AND MEANS THE FIRST TIME, MEANS THE PERSON TO
OF INDIA OF PROCESSING OF PERSONAL DATA.” WHOM THE DATA RELATES
EXTENT OF THE ACT

 The Act applies within India in two

main cases
 The law also applies to the
processing of personal data online
as well
- However, this is only when the
processing is linked with the
profiling of or offering of goods
and services to a person in India
RULES FOR DATA
FIDUCIARIES

 Before asking for any data, the fiduciary must give the Data Principal
a notice with an itemized list of all the data being requested and the
purpose

 The notice must be available in English or any language of the

principal’s choice under the Eighth Schedule of the Constitution

 The Data Principal’s consent must be free, clear/transparent, and

informed
RULES FOR DATA FIDUCIARIES

 If a Data Principal withdraws consent, the fiduciary needs to stop

processing within a “reasonable amount of time.”

 A Data Fiduciary cannot refuse to offer a service because the Data

Principal has refused to provide unnecessary personal data

 Data Fiduciaries must make sure the data they use is accurate and
complete
RULES FOR DATA FIDUCIARIES

 “Reasonable security safeguards” must be taken to prevent a

breach of data

 Once data is not required to be retained, Data Fiduciaries must let

go of it immediately

 An effective mechanism must be set up to address the Data

Principals’ grievances
PROTECTION OF CHILDREN UNDER
THE ACT

 No Data Fiduciary may take personal data from a child without

parental consent

 They cannot process any data that might cause harm to a child

 They may not track, monitor or send targeted ads directed at

children
SIGNIFICANT DATA FIDUCIARIES

Appoint a Data Protection Officer and an Independent Data auditor

Undertake other measures such as Data Protection Impact

Assessment and periodic audits
RIGHTS AS A DATA PRINCIPAL

 Get confirmation whether a Data Fiduciary has processed or is

processing our data

 Obtain a summary of the personal data being processed

 Get a single list of all the Data Fiduciaries with whom our personal
data has been shared

 Readily available means of registering a grievance with a Data

Fiduciary
DUTIES OF A DATA PRINCIPAL

 We must comply with all the provisions of the Act while

exercising our rights

 We may not register any false or frivolous grievance or complaint

 We may not give false data, suppress information, or impersonate

another person
PENALTIES

Failure by a Data Principal or Fiduciary to take Failure to notify the Board and concerned Data
reasonable security safeguards to prevent breach of data Principals in case of a data breach - up to ₹200 crore
- up to ₹250 crore
 Non-fulfillment of obligations regarding
children - up to ₹200 crore

Non-fulfillment of obligations of a
PENALTIES Significant Data Fiduciary - up to ₹150
crore

Non-compliance with the duties of a

Data Principle - up to ₹10
CONCLUSION

 Creating this Act is a huge step for India, which with the growing
technology sector will have to adapt to our new circumstances

 It is not perfect and will need amendments as new developments

come up

 As a side note, this Act uses the pronouns “she” and “her” to refer
to all genders, something which rarely ever happens in legal
documents