Shardul Amarchand Mangaldas & Co. welcomes DRDP Bill

Delhi: Shardul Amarchand Mangaldas & Co., welcomed the introduction of the Digital Personal Data Protection Bill, 2023 (“DPDP Bill”) by the Indian Government. They said that the introduction of the DPDP Bill in the Lok Sabha this Monsoon Session marks an important milestone in India’s journey towards a comprehensive data governance framework.

Manish Sehgal, Partner, Deloitte India said “The moment we have been waiting for the past few years has finally arrived! The much-anticipated privacy bill (referred as Digital Personal Data Protection Bill, 2023), was tabled in the Parliament on Thursday August 3rd 2023. Once enacted, it will enable individuals (referred as Data Principals) to govern their own personal (digital) data and will drive enterprises (referred as Data Fiduciary) to process personal data of individuals in a lawful manner, for specific purposes only. In view of the bill’s extra territorial coverage, enterprises based outside India serving individuals in India will also be expected to adhere to the provisions of this bill once enacted. Enterprises will have to review the current ways of working especially for personal data of individuals such as their employees, customers, merchants, vendors, etc. to be able to honor the rights that individuals may exercise, such as right to access, update, erase their personal data etc. Non-adherence of obligation listed in the bill may attract sanctions and commercial penalty as high as INR 250Cr.

As more guidance will be released in days / months to come, its highly recommended that enterprises don’t wait and start their readiness journey right away with fundamental step of data hygiene i.e. where is the data within the enterprise, who accesses it, who processes it and how data flows from one function to another. Right processes, tools & solutions, governance, accountability and most importantly awareness amongst people are core to be ready. Once the bill will be enacted, transformation is imminent and enterprises should embrace it, not just for compliance purposes but to establish and operate in a privacy enabled environment.”

Shahana Chatterji, Partner, Shardul Amarchand Mangaldas & Co said “The Digital Personal Data Protection Bill, 2023 prepared by MEITY is a forward-looking legislation that will have a horizontal application across sectors and will also impact businesses of all sizes.

As such, the DPDP Bill strikes an important balance in protecting users’ rights and promoting innovation in digital businesses. Its key business-friendly provisions include eliminating criminal penalties for non-compliance, facilitating international data transfers etc. On the other hand, it also provides for a comprehensive set of rights guaranteed to data principals which aims to create a transparent and accountable data governance framework going forward.

We laud the introduction of the DPDP Bill as an important step towards building a new legal architecture for digital businesses and the ushering in of India’s “techade” and remain supportive of MEITY’s ongoing regulatory efforts. We also appreciate MEITY’s efforts in conducting extensive public and stakeholder consultations for developing a robust legal framework that will set a new international precedent as far as data protection frameworks go. We hope that MEITY continues to follow this approach of multi-stakeholder engagement for future rulemaking under this new law.”

Kirti Mahapatra, Partner, Shardul Amarchand Mangaldas & Co said “The Digital Personal Data Protection Bill, 2023 (“DPDP Bill”) marks the onset of a new data protection regime in India, the bill is ready to set a benchmark amongst similar legal frameworks, globally. We further laud MEITY for undertaking an extensive consultative exercise in preparing the DPDP Bill. The removal of criminal penalties, distinctions between different categories of data, and restrictions on cross-border data flows from the DPDP Bill are a few prime illustrations of MEITY addressing concerns on key issues under the earlier versions of the DPDP Bill. Such a business-friendly regulatory approach is further geared towards the promotion of ease of doing business in India for technology companies in India, while holding digital businesses accountable for protecting Indian users’ personal data and providing such users a comprehensive set of rights.

We are hopeful of the fact that MEITY shall continue to engage with the various stakeholders as it proceeds to build robust and progressive data protection regime through rules and regulations under the DPDP Bill. We are confident that this law will set India up in its efforts for building a new regulatory architecture in the Indian technology sector and in the growth of a three-trillion-dollar Indian digital economy.”