While the original framework of the Act had gleaned from the principles of established data protection laws such as the EU’s GDPR, the Bill passed by Parliament marks India’s unique approach to setting up a data protection regime.

In the formulation of this law, India has created very specific nuances for itself. For instance, while India has adopted an approach that allows for free flow of data across borders, the government has retained the ability to blacklist countries or jurisdictions to which data transfers may be restricted. Some of the powers that the government has retained for itself, such as the power to block access to information in certain cases or seek information without due safeguards, is unprecedented. It remains to be seen how these powers are ultimately exercised, especially given that there is a distinct lack of due process prescribed.

While India has come a long way, there is still more to be achieved. Just with respect to this Bill, important elements of how it will be operationalised are yet to be defined through subordinate legislation. There are also significant exemptions available to the government. By mere notification, the government (parts or all of it) can be exempt from the applicability of the entire law. In other instances, exemptions from material parts of the law will apply automatically to the functioning of the government. As one of the largest processors of personal data, it would have been monumental to have this law apply equally to the government, irrespective of the fact that it is seen to be a custodian of its citizens’ personal data.

There are also grey areas that will require privacy and legal professionals to apply their expertise and experience to decipher. The exemption from applicability of the law to publicly available data is one such instance. How does one know if certain data was ‘made’ publicly available by a data principal? How will this impact contractual arrangements a fiduciary may have with data aggregators? How will this impact targeted advertisements?

Notwithstanding these inevitable challenges, this is a reasonable legislation that focuses on enabling principles. Given that it is horizontally applicable, sector neutral and extraterritorially applicable, the impact across the economy within and outside India will be high. There will be undoubtedly an impact on compliance cost and business models; and so the authors remain hopeful that a transition period will be given to allow entities to align themselves with this new law.

At the time of writing this article, the government has enacted the DPDP Bill into an Act and we await the notification to enforce the law.

This article was originally published in Financial Express on 1 September 2023 Co-written by: Shahana Chatterji, Partner; Kirti Mahapatra, Partner. Click here for original article

Read Less-