IT minister Ashwini Vaishnaw tables data protection bill in Lok Sabha

IT Minister Ashwini Vaishnaw

The long-awaited Digital Personal Data Protection (DPDP) bill was tabled in Parliament on August 3, bringing India closer to its first legislation that specifically addresses citizens' privacy and establishes guidelines for how individuals' data can be used by private or government entities.

The bill was introduced by Minister for Electronics and Information Technology (MeitY) Ashwini Vaishnaw in the Lok Sabha for consideration. It is worth noting that the bill was tabled exactly one year after the government withdrew the Personal Data Protection (PDP) bill.

Following this, the DPDP Bill can either be passed by both houses of Parliament and enacted into law, or the bill can be further studied by a Parliamentary Committee before it goes to a vote.

On August 1, the Parliamentary Standing Committee on IT and Communications tabled a report endorsing the DPDP bill, despite Minister of State for MeitY Rajeev Chandrasekhar stating that the bill had not been referred to a committee.

Earlier, the Union Cabinet approved the draft DPDP Bill which was first released in 2022. Since then, the draft has undergone several rounds of consultations, and the government has made several changes to the bill. The fresh draft, which was approved by the cabinet, was not made public till now.

Also read | 5 major changes expected in revised DPDP Bill that will be tabled in Parliament

Earlier, Moneycontrol reported that one of the changes to the Data Protection Bill may include the introduction of the Telecom Dispute Settlement and Appellate Tribunal (TDSAT) as an appellate body where users can appeal decisions of the Data Protection Board (DPB).

With the increasing number of data breaches and cyber attacks on Indian citizens, the DPDP bill is expected to bring a sense of accountability in the form of penalties, among other things.

However, concerns remain among civil society and experts on the sweeping exemptions granted to government bodies from the provisions of the bill.

For instance, retired Supreme Court judge BN Srikrishna, who led the committee that drafted the Personal Data Protection (PDP) Bill (predecessor of the DPDP Bill) in 2018, had pointed out that the exemptions that the government has given itself "were much worse" than in the PDP bill.

Also read | Data protection bill may ease compliance burden, but ambiguity gives govt more powers: Experts

"At least the previous one had provisions that if one had to access the data of an individual, they (the government) would have had to do it in a fair and reasonable manner. This bill does not even have those restrictions," he said.

Last year, the government withdrew the PDP Bill reasoning that its provisions had gone beyond the ambit of data protection (such as data localisation), making compliance difficult for startups. The DPDP Bill was brought in after that.