Privacy & Information Security Law Blog

Stephen Mathias from Kochhar & Co. reports that in early August 2023, the Indian Parliament passed the Digital Personal Data Protection Act (the “Act”), bringing to a close a 5-year process to enact an omnibus data privacy law in India. The Act was ratified by the President of India and will come into effect once notified by the Government. The Act significantly updates a previous draft, and departs substantially from the GDPR model of privacy laws.

On August 9, 2023, India’s upper house (i.e., Rajya Sabha) passed the Digital Personal Data Protection Bill (“DPDPB”), two days after India’s lower house (i.e., Lok Sabha) passed the legislation. The DPDPB now heads to India President Droupadi Murmu for signature.

Kochhar & Co. reports that, on November 18, 2022, the Government of India (“Government”) released the long-awaited fourth draft of India’s proposed privacy law, now renamed the Digital Personal Data Protection Bill.

Terms and Application

The draft law uses terminology similar to past versions: the data controller is called the “data fiduciary,” the data subject is called the “data principal,” and personal information is referred to as “personal data.” There is no separate category of sensitive personal data.   

Stephen Mathias from Kochhar & Co. reports that, on August 3, 2022, the Government of India withdrew the Indian Data Protection Bill (the “Bill”) that was pending before the Indian Parliament. As we previously reported, the Bill was expected to be tabled during the Monsoon session of Parliament, which commenced on July 18, 2022. While the Government was contemplating making certain changes to the existing Bill, it is now considering drafting fresh legislation, including a bill that addresses a broader range of issues in the digital ecosystem beyond data protection alone.

On July 24, 2022, the Financial Express published an article on Rajeev Chandrasekhar, the Indian Minister of State for Electronics and Information Technology, noting that the introduction of the Indian Data Protection Bill (the “Bill”) before Parliament will be delayed by a few months. The Bill was expected to be tabled during the Monsoon Session of Parliament, which commenced on July 18, 2022.

On April 28, 2022, India issued new guidance relating to “information security practices, procedure, prevention, response and reporting of cyber incidents for Safe & Trusted Internet.” Notably, the guidance requires “service providers, intermediary, data centre, body corporate and Government organizations” to report cyber incidents to India's Computer Emergency Response Team (“CERT-In”) within six hours of noticing such incidents or being notified about such incidents. Before this guidance, notification of a cyber incident was required "within a reasonable time” after occurrence or discovery.

Stephen Mathias from Kochhar & Co. reports that on December 16, 2021, the Indian Joint Parliamentary Committee (the “JPC”) submitted its report on India’s draft Data Protection Bill (the “Bill”). The Bill is now likely to be passed by Parliament in its next session, beginning in February 2022, and likely will enter into force in the first half of 2022. In its report, the JPC recommended a phased approach to implementing the law, beginning with the appointment of various government officers, such as the Data Protection Authority (“DPA”), with full implementation of the law to be completed within 24 months. The JPC’s report also contained a revised draft of the Bill. Certain key aspects of the revised Bill are summarized below.

On November 22, 2021, according to India Today, the Indian Joint Parliamentary Committee (the “JPC”) responsible for reviewing the Personal Information Protection Bill 2019 (“PDPB”) issued its report on the proposed law. The report comes nearly two years after the bill was first referred to the JPC. The JPC’s report will likely be presented with the PDPB 2019 in the Winter Session of Parliament, which begins on November 29, 2021. If passed, the PDPB would constitute the first comprehensive data protection law in India ...

On December 16, 2020, the Committee of Experts within India’s Ministry of Electronics and Information Technology (MeitY) (the “Committee”) issued a revised report on the Non-Personal Data Governance Framework (the “NPDF”) for India (the “Revised Committee Report”).

The Centre for Information Policy Leadership at Hunton Andrews Kurth (“CIPL”) and the Data Security Council of India (“DSCI”) have published a report on Enabling Accountable Data Transfers from India to the United States under India’s Proposed Personal Data Protection Bill (the “Report”).

On July 13, 2020, a Committee of Experts within India’s Ministry of Electronics and Information Technology (“the Committee”) published the first draft of a Non-Personal Data Governance Framework for India for public consultation.

On December 11, 2019, an updated version of India’s draft data privacy bill was introduced in the Indian Parliament (the “Draft Bill”) by the Ministry of Electronics and Information Technology (“MeitY”). The Draft Bill updates a prior version submitted to MeitY in July 2018.

On September 26, 2018, the Centre for Information Policy Leadership (“CIPL”) at Hunton Andrews Kurth LLP submitted formal comments to the Indian Ministry of Electronics and Information Technology on the draft Indian Data Protection Bill 2018 (“Draft Bill”).

On July 27, 2018, the Justice BN Srikrishna committee, formed by the Indian government in August 2017 with the goal of introducing a comprehensive data protection law in India, issued a report, A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians (the “Committee Report”), and a draft data protection bill called the Personal Data Protection Bill, 2018 (the “Bill”). Noting that the Indian Supreme Court has recognized the right to privacy as a fundamental right, the Committee Report summarizes the existing data protection framework in India, and recommends that the government of India adopt a comprehensive data protection law such as that proposed in the Bill.

Stephen Mathias of the law firm Kochhar & Co. reports from India that in a landmark judgment delivered in August 2017, the Supreme Court of India (“Court”) unanimously held that the right to privacy is a fundamental right under the Constitution of India. The Court also delivered six separate concurring judgments, with the main judgment being delivered by four of the nine judges.

On July 22, 2014, the Data Security Council of India (“DSCI”) announced that it has deemed Vodafone India Limited (“Vodafone”) a “DSCI Privacy Certified” organization. The certification, which is designed to help companies “demonstrate the privacy practices to relevant stakeholders and enhance trust,” is the first for a telecommunications company in India.

On October 19, 2013, the Center for Internet and Society (“CIS”), the Federation of Indian Chambers of Commerce and Industry, and the Data Security Council of India held a Privacy Roundtable in New Delhi, the last in a series of roundtables that began in April 2013. The events were designed to elicit comments on a draft Privacy Protection Bill, proposed legislation for a privacy and personal data protection regime in India. The law would regulate the collection and use of personal data in India, as well as surveillance and interception of communications.

On July 2, 2013, the Indian government released its ambitious National Cyber Security Policy 2013. The development of the policy was prompted by a variety of factors, including the growth of India’s information technology industry, an increasing number of cyber attacks and the country’s “ambitious plans for rapid social transformation.” The policy sets forth 14 diverse objectives that range from enhancing the protection of India’s critical infrastructure, to assisting the investigation and prosecution of cyber crime, to developing 500,000 skilled cybersecurity professionals over the next five years.

On August 24, 2011, the Government of India’s Ministry of Communications & Information Technology issued a clarification regarding India’s new privacy regulations, known as the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “Rules”), under Section 43A of the Information Technology Act 2000.

On April 11, 2011, India adopted new privacy regulations, known as the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “Rules”).  The Rules are final versions of the draft regulations issued in February 2011 and impose wide-ranging obligations on any “body corporate” (company) that “collects, receives, possesses, stores, deals or handles” personal information.  These obligations require companies to provide privacy policies, restrict the processing of sensitive personal data, restrict international data transfers and require additional security measures.  The Rules introduce an omnibus privacy law that is similar in many respects to existing EU data protection law, but which raises some fundamental challenges for India’s numerous outsourcing vendors, and their customers.

The Government of India’s Ministry of Communications & Information Technology has published three draft rules that would implement the Information Technology Act, 2000. These include: Reasonable Security Practices and Procedures and Sensitive Personal Information; Due Diligence Observed by Intermediaries Guidelines and Guidelines for Cyber Cafe. The first two of these rules could affect international companies that provide digital services or process data in India. The comment period on the rules ends February 28, 2011.

Scarcely a month after the world media was flooded with news of the catastrophic terrorist attacks in Mumbai, headlines are once again rife with articles on the global impact of events in India. This time, the news has focused on Satyam Computer Services (“Satyam”), previously one of India’s largest and most prestigious outsourcing providers, and a series of missteps that began in October 2008, when alarming allegations of possible involvement in a customer security breach surfaced in the media. After that news, there were allegations of misdeeds with customers, a failed ...