Digital data bill excludes personal processing, applies to foreign firms serving India

It defines the obligations of entities processing data and the rights of individuals regarding their personal information.

Who it concerns: The Bill applies to any person (including individuals, companies, firms, and the State) who processes digital personal data within India or outside India if connected to offering goods or services to individuals in India. It specifically regulates 'Data Fiduciaries' (those determining the purpose and means of processing) and 'Data Processors' (those processing on behalf of a Fiduciary). It does not apply to personal data processed by an individual for personal or domestic purposes, or data made publicly available by the individual or as required by law.

What the bill does

• Establishment of the Data Protection Board of India to oversee compliance and handle grievances.
• Requirement for Data Fiduciaries to obtain free, specific, informed, unconditional, and unambiguous consent from Data Principals, with the right to withdraw consent easily.
• Mandatory notice to Data Principals informing them of the personal data being processed, the purpose, and how to exercise their rights or file complaints.
• Rights of Data Principals to access information about their data, request correction or erasure, and nominate a person to exercise rights in case of incapacity or death.
• Special provisions for the processing of personal data of children (under 18), requiring verification of age and consent from parents or lawful guardians.
• Additional obligations for 'Significant Data Fiduciaries' (as notified by the Central Government), including the appointment of a Data Protection Officer.
• Provision for appeals to the Telecom Disputes Settlement and Appellate Tribunal and alternate dispute resolution mechanisms.
• Penalties for non-compliance, with sums realized credited to the Consolidated Fund of India.

Also in the document

• The Bill explicitly excludes personal data processed by individuals for personal or domestic purposes from its scope.
• It applies to processing of digital personal data outside India if it is in connection with offering goods or services to Data Principals within India.
• The Bill designates the Telecom Disputes Settlement and Appellate Tribunal as the Appellate Tribunal for appeals under this Act.
• Consent requests must be presented in clear and plain language, with the option to access them in English or any language specified in the Eighth Schedule to the Constitution.