In the inaugural episode of Legal Lounge, we explore the Digital Personal Data Protection Bill 2023, which was passed by the Rajya Sabha in August 2023. The Bill addresses the pressing need for data protection and accountability of Internet companies, mobile apps and businesses that handle citizens’ data, amid India’s surging digital footprint in post-pandemic landscape.

With a growing reliance on technology by Indians, how important is it to safeguard personal information and ensure responsible data handling? Are businesses transparent about the way they collect and process data? Do users truly understand how their data is used, stored and shared? Do they comprehend the privacy policies or their accessibility ? What does it take for these businesses to comply with data protection regulations?

What would be the Bill’s role in the structure of tech regulations in India? Some say that India lacks comprehensive legislation for addressing data protection, could this Bill address the issue? Can it safeguard the use of personal data, while establishing the rights and duties of users and businesses? Can the Bill be a game-changer in the world of data protection and privacy or serve as the foundation for India’s evolving digital landscape?

Arun S. Prabhu, Partner at Cyril Amarchand Mangaldas explores it all.

He says: Compared to the old regime, this Bill would herald a significant shift towards simple, transparent and enforceable rights surrounding information and lead businesses to rethink data handling and weigh data as a potential liability due to substantial fines.

The Bill is likely to impact business owners, e-commerce businesses as well as global businesses and would help consumers make informed consent choices. It would allow people to control how their data is used, and how the rules change with government agencies. The loopholes or ambiguities in the legislation, if any, could still allow for exploitation or infringement of data privacy and must be critically assessed. The Bill addresses the processing of personal data of children, in terms of parental consent and preventing tracking or targeted ads.

Furthermore, it needed to be examined how financial penalties imposed on non-compliant data fiduciaries could impact innovation, competition, small businesses and start-ups. This Bill could potentially impact deal-making or M&A (Mergers & Acquisitions) and remodel the C-suite level for companies. It is likely that businesses would not only consider investor, shareholder and customer needs but also take into account the distinct viewpoints of their data principals.

The role of generative AI in this new world is important and so is the assessment if it would offer policy benefits in equal measure. To conclude, the Digital Personal Data Protection Bill 2023 will create a culture of compliance. Building public awareness and imparting education about data protection is vital to empower citizens to exercise their rights and make informed choices regarding their personal data.

In sum, collaborative efforts between government, industry, and stakeholders would be essential in shaping a robust data protection ecosystem in India.