India released a
new draft data protection bill on Friday, November 18, three months after
withdrawing a previous bill that alarmed big technology companies. The new
draft will be presented in the next session of parliament. The new draft aims
to protect digital personal data, seeks to allow transfer of data outside
India, and calls for penalties regarding data breaches.

The 2022 draft
data protection bill proposes to set up a Data Protection Board of India, which
will administer functions as per provisions of the bill.

One of the major
changes in the new draft is that the government has raised the penalty to up to
Rs 500 crore for violating provisions proposed under the draft Digital Personal
Protection Bill 2022 issued on Friday. This is a major change from the 2019 draft
personal protection bill which proposed a penalty of Rs 15 crore or 4% of the
global turnover of an entity.

The new draft also
proposes a penalty of up to Rs 250 crore in case the Data Fiduciary or Data
Processor fails to protect against personal data breaches in its possession or
under its control.

Ashwini Vaishnaw,
India’s telecom and IT minister, said the joint parliamentary committee which
reviewed the 2019 bill suggested 88 amendments to a bill of 91 sections. This
led the government to decide there was ‘no option’ but to withdraw the original
bill completely, the minister said.

The salient
features of India’s draft data protection bill are:

Indian government, in a symbolic gesture to empower women, has drafted the bill
with the normative she/her instead of the usual he/him.

new draft bill is based on seven principles: use of personal data by
organisations in a lawful manner; purpose limitation; data minimisation;
personal data accuracy; storage limitation; prevention of breach of personal
data; and accountability for data processing.

new draft bill was prepared after previewing data protection legislations of
Australia, European Union (EU), Singapore, and a prospective one of the USA.

new draft bill has six chapters and a total of 25 points.

provision has been made to make basic information on data protection available
in languages under the 8th schedule of the Indian Constitution.

Additionally, the
draft data protection bill also states that if personal data is likely to cause
harm to a child, its processing will not be allowed. For data transfers across
international borders, transfer of personal data to certain notified countries
will be allowed, but only after assessment of relevant factors by the