Union IT Minister Ashwini Vaishnaw announced on Wednesday that the Indian government is anticipating the implementation of the Digital Personal Data Protection law within 10 months. This statement follows the recent passage of the Digital Personal Data Protection Bill 2023 in the Rajya Sabha.
Vaishnaw highlighted the government’s proactive approach to initiating the implementation process and stressed that this kind of comprehensive legislation typically requires a window of 6 to 10 months for framing. “We have started work on implementation. This kind of legislation will require a 6-10 month kind of frame. We will take every step with proper checks and balances. It is a guesstimate. We might do it faster than that,” he said.
Expounding on the core tenets of the legislation, Vaishnaw elucidated that collected data must be utilized by the law and exclusively for its intended purpose. Moreover, the volume of data collected will be constrained based on the actual necessity.
Vaishnaw also underscored the rights of citizens to rectify their data at their discretion, further adding that data will be retained by entities only for the duration required and will be safeguarded through the establishment of reasonable protective measures.
The provisions of the Digital Personal Data Protection Bill 2023 extend beyond the borders of India. “The provisions of the bill will apply to data of Indian citizens stored overseas as well. Any person in India, even foreign nationals will get protection under the bill,” he added.
To reinforce privacy safeguards, the legislation will institute an independent Data Protection Board (DPB) designed with a digital focus. Vaishnaw underlined that this DPB will ensure equitable access to justice across the nation, aligning with the principles of inclusivity.
What is the Digital Personal Data Protection Bill 2023?
The Digital Personal Data Protection Bill, 2023, introduces a comprehensive framework for managing digital data processing by companies, establishes mechanisms for dispute resolution, and establishes the formation of the Data Protection Board of India.
The bill has garnered both praise and criticism. While private industry players welcome the reduction of stringent requirements present in earlier drafts, concerns have been raised over the bill’s extensive exemptions for government entities, leading to potential surveillance implications.
Key highlights of the 2023 Digital Personal Data Protection Bill include mandates for data security, immediate data breach notifications to both the Data Protection Board (DPB) and affected users, specific provisions for minors and individuals with disabilities requiring explicit consent for data processing, the compulsory appointment of a Data Protection Officer within companies, government authority over cross-border data transfers, a structured appeals mechanism for DPB decisions, and an empowered DPB capable of summoning individuals, scrutinizing documents, and recommending access-blocking for non-compliant intermediaries.
