Industry Needs to Work Closely with Govt on New Data Protection Bill: Experts

The approval of the Digital Personal Data Protection (DPDP) Bill by the Cabinet presents a positive step towards instituting a data protection regime in the country and industry will need to work closely with the government so that the rules are simple and implementable, especially for the startup ecosystem, experts said on Thursday.

The clearance paves the way for the DPDP Bill to be introduced in Parliament in the upcoming Monsoon session, scheduled to begin on July 20.

“Parliamentary approval will likely be sought during the Monsoon session, and could further invite dialogue/resistance during discussions with stakeholders, which may render this exercise moot,” Abhishek Malhotra, Managing Partner, TMT Law Practice, told IANS.

The Cabinet had earlier approved a version of the Data protection Bill as well, which met with similar resistance.

“However, primarily, the DPDP Bill has received considerable endorsement from academicians, policymakers and industry players, and will enable India to safeguard citizen data with a light touch approach,” Malhotra added.

The data protection bill specifies norms on management of personal data of residents in India and requires explicit consent from people whose data is collected and used.

According to Malhotra, the penalty provisions will ensure that security considerations, data safety are paramount considerations for entities that have been at the receiving end of several data breaches during the post pandemic years.

“However, the government's role during enforcement, the institution of the Data Protection Board and formulation of delegated guidelines will provide practical direction, and must follow swiftly on the heels of the impending enactment of the Bill,” he noted.

Gowree Gokhale, leader of the IP, technology, media and telecom practice at Nishith Desai Associates said that the bill is a much-awaited legislation.

“The last version of the Bill was much simpler than the earlier versions. Various industries had given feedback on several aspects e.g. cross border transfer, handling of children’s data, deemed consent provisions, the powers of the board in levying penalties. Hopefully, the government has addressed industry concerns in the next version,” said Gokhale.

The industry will need to work closely with the government so that the rules are simple and implementable, especially for the start-up ecosystem, Gokhale added.

The Bill also outlines practices for entities that collect personal data, how that data should be stored and processed to ensure there is no breach.