Explained: What is the New Personal Data Protection Bill 2023?

The Digital Personal Data Protection Bill 2023 also known as DP Bill is a proposed law that appeals to regulate the protection of personal data in India. 

The bill states: “The purpose of this Act is to provide for the processing of digital personal data in a manner that recognizes both the right of individuals to protect their personal data and the need to process personal data for lawful purposes, and for matters connected therewith or incidental thereto.”

The bill was approved by the Union Cabinet on July 5, 2023, and it will be presented to the Parliament on August 3, 2023. 

The bill was presented to the public in November 2022 for suggestions and many experts suggested different changes. But, there were not many changes amended in the new draft.

What is the Digital Personal Data Protection Bill ?

➡️ #DPDPBill introduced in #Parliament is a very significant milestone in PM @narendramodi ji's vision of Global Standard Cyber Laws for India's $1T #DigitalEconomy & #IndiaTechade

➡️ @GoI_MeitY has developed this bill after… pic.twitter.com/a8tHXJl537

— Rajeev Chandrasekhar 🇮🇳 (@Rajeev_GoI) August 3, 2023

What Is the Applicability of This Bill?

This bill is applicable for all the data that is in digitised form whether it is collected online or offline. Further, this bill also applies to digital data that is collected outside India but it is used to provide goods and services to individuals of India. 

The draft of the bill states: “The provisions of this Act shall apply to the processing of digital personal data within the territory of India where:

(a) such personal data is collected from Data Principals online; and

(b) such personal data collected offline, is digitized.”

 “The provisions of this Act shall also apply to processing of digital personal data outside the territory of India, if such processing is in connection with any profiling of, or activity of offering goods or services to Data Principals within the territory of India,” it adds.

The Digital Personal Data Protection Bill excludes the following categories from the provisions of this bill: 

“(a) non-automated processing of personal data;

(b) offline personal data;

(c) personal data processed by an individual for any personal or domestic

purpose; and

(d) personal data about an individual that is contained in a record that has been in existence for at least 100 years.”

This bill also reserves the right of individuals where personal data can only be used after consent. 

The Digital Personal Data Protection Bill, 2023 (DP Bill) reserves the right of individuals to control their personal data. The bill states that personal data can only be used after consent unless an exception applies.

The draft mentions: “Consent of the Data Principal means any freely given, specific, informed and unambiguous indication of the Data Principal's wishes by which the Data Principal, by

a clear affirmative action, signifies agreement to the processing of her personal data

for the specified purpose.”

“For the purpose of this sub-section, “specified purpose” means the purpose

mentioned in the notice given by the Data Fiduciary to the Data Principal in

accordance with the provisions of this Act.” 

To conclude, the Digital Personal Data Protection Bill, 2023 can be a significant piece of legislation that will have a major impact on the way personal data is processed in India. The bill is designed to protect the privacy of individuals and to give them control over their personal information.