Cabinet approves Data Protection Bill draft; to be tabled during Monsoon session of Parliament

The bill prescribes penalties ranging up to Rs 250 crore for data fiduciaries on account of failing to take safeguards to prevent personal data breaches.

The Union Cabinet, on Wednesday, granted its approval to the Digital Personal Data Protection Bill, clearing the way for it to be taken up by the Parliament in the upcoming Monsoon Session.

While there was no official Cabinet briefing on the matter, a top government official confirmed to reporters that the Cabinet had cleared the bill.

Another official source confirmed to DH that all online and offline data in India will fall under the legal domain of the Digital Personal Data Protection Bill, 2023.

Personal data can be processed under this bill only if an individual has consented to it, the source said, adding that there will be some exceptions, including when the authorities might need data on grounds of national security and law and order.

"The Bill passed by the cabinet comes post the public consultation process and reportedly some inter ministerial discussions as well. Some key areas of interest to industry would be permissibility of cross border data transfers, role and powers of the digital protection board, conflict with other overlapping sectoral laws and potential penalties,” said Avisha Gupta, technology law partner, Luthra & Luthra.

While the bill cleared by Cabinet is not yet in public domain, in mid-November 2022, the Centre had released for public consultation a version of the draft bill, which prescribed penalties ranging up to Rs 250 crore for data fiduciaries on account of failing to take safeguards to prevent personal data breaches.

That version had eased the data localisation mandate of the earlier version, which had alarmed many big multinational technology companies.

It had stated that the centre will, “after an assessment of such factors as it may consider necessary”, notify a list of countries or territories outside India to which the transfer of personal data will be allowed.

That draft allowed the Centre to appoint an independent regulator — the “Data Protection Board of India”. The future regulator will determine non-compliance with provisions of the Bill and also decide on penalties for it.

“While the bill leaves much to the design of the regulator, it is generally a positive step. We are cautiously optimistic that given the extensive consultations, the government would have addressed the concerns around grounds of processing, the over reliance on adequacy and the issues that extensive powers of interception could cause for Europe- India data transfers,” said Mathew Chacko, Partner, Spice Route Legal.

The Monsoon Session of Parliament is scheduled to begin on July 20, and run till August 11.