Personal Data Protection Bill (Proposed)

· About Personal Data Protection Bill (Proposed)

Key Takeaways

  • The Personal Data Protection Bill remains a proposed measure and, on the information available, has not yet been enacted into law, so it does not create binding compliance duties unless and until adopted.
  • The bill’s stated purpose is to protect individuals’ personal data and to establish a Data Protection Authority to regulate compliance and enforcement.
  • Because the bill is not yet in force, there are no operative statutory deadlines or fines under the bill itself; any penalty exposure would arise only after enactment and commencement.
  • If the bill is adopted in a form similar to the 2019 draft, it would likely apply to organizations that process personal data and would also reach some non-domestic actors that target data subjects in the jurisdiction.
  • Privacy, security, and AI governance teams should track the bill’s final text, commencement date, and any phase-in schedule before building controls into policy, contracts, and incident response.
  • Until enactment, organizations should benchmark against ISO 27001, NIST CSF 2.0, and ISO/IEC 42001 to reduce implementation risk and shorten the future compliance gap.

What It Is

The Personal Data Protection Bill is a proposed privacy statute intended to regulate the processing of personal data and to create a Data Protection Authority for supervision and enforcement. The file summary indicates that it is yet to be passed, which means the current legal status is proposal-stage rather than enacted law. On the material available here, there is no confirmed commencement date, no confirmed operative phase-in schedule, and no confirmed adoption date because the bill has not completed the legislative process.

The most concrete publicly identifiable draft in the record is the Personal Data Protection Bill, 2019, which proposed a central regulator called the Data Protection Authority of India and set out a broad framework for personal data governance. That draft was introduced in Parliament but did not become law, so it should be treated as legislative history rather than current binding law. The later status of the bill in 2025–2026, based on the information provided, remains unchanged: still proposed and not in force.

Who Must Comply

If enacted in a form consistent with the draft bill, the law would likely apply to data fiduciaries/controllers and data processors that handle personal data, along with any regulated classes of significant or high-risk entities defined in the final text. The 2019 draft used an extraterritorial model, bringing in entities outside the country when their processing was connected to goods or services offered to individuals in the jurisdiction, or when behavior was monitored there.

Applicability thresholds in the earlier draft were tied more to the nature and volume of processing than to a simple revenue test. The proposal also contemplated additional obligations for certain higher-risk or systemically important entities, and it contained exemptions for state functions and selected processing activities. Because the bill has not been enacted, those thresholds and exemptions are not legally operative today and should be treated as provisional until a final text is published.

Core Requirements

  1. Lawful processing and notice — The draft framework would require personal data to be processed only for defined purposes and with transparent notice to individuals about the collection and use of their data.
  2. Consent and rights handling — A compliant program would need a lawful basis for processing, a mechanism for obtaining and recording valid consent where required, and procedures for honoring individual rights such as access, correction, and deletion.
  3. Purpose limitation and minimization — Organizations would need to collect only data necessary for the stated purpose and avoid reuse that is incompatible with the original processing purpose.
  4. Security safeguards — Controllers and processors would be expected to implement technical and organizational measures to protect personal data from unauthorized access, loss, alteration, and disclosure.
  5. Data breach management — The framework would likely require incident detection, containment, notification, and remediation processes, with reporting duties to the regulator and affected individuals in defined cases.
  6. Cross-border and vendor controls — Transfers of personal data and use of service providers would need contractual, due-diligence, and transfer-assessment controls if the final bill follows the draft’s logic.
  7. Governance and accountability — Covered entities would need internal ownership, recordkeeping, and compliance documentation to demonstrate adherence to the law and respond to regulator inquiries.

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | Proposed bill status | Not enacted as of 6 September 2026 | No operative statutory compliance deadline has started under the bill. | | Adoption | Not confirmed | No binding obligations arise until formal passage. | | Commencement | Not confirmed | Any obligations would begin only on the bill’s stated commencement date after enactment. | | Phase-in milestones | Not confirmed | Any staged rollout depends on the final text and implementing rules. |

Because the bill is still proposed, maximum fines and other sanctions cannot be stated as current legal penalties with confidence. If the final law tracks the 2019 draft style, penalties may include regulator orders, data-processing restrictions, and monetary penalties for specific violations, but those consequences are contingent on the enacted text and commencement rules. For now, the safest statement is that no enforceable penalty regime under this bill is currently in force.

How to Comply

  1. Build a data inventory — Map personal data types, business purposes, retention periods, transfers, vendors, and legal owners; this is the baseline for any future compliance regime.
  2. Adopt a control framework — Use ISO 27001 for security governance, NIST CSF 2.0 for risk management structure, and ISO/IEC 42001 where automated decision-making or AI supports processing decisions.
  3. Design consent and notice workflows — Prepare jurisdiction-specific privacy notices, consent capture logic, preference management, and withdrawal handling so they can be activated quickly if the bill passes.
  4. Contract with processors now — Update data-processing agreements, subprocessors, confidentiality terms, audit rights, and breach-notification clauses to reflect a controller/processor model.
  5. Implement rights operations — Create intake, identity verification, triage, response, and appeal workflows for access, correction, deletion, and objection requests.
  6. Harden security and incident response — Align logging, access control, encryption, vulnerability management, and tabletop exercises with ISO 27001 and NIST CSF 2.0.
  7. Prepare cross-border transfer assessments — Document transfer pathways, destination risks, and fallback arrangements so international data flows can be revalidated against the final law.
  8. Track legislative change management — Assign legal and privacy owners to monitor bill movement, draft rules, and commencement notices, then convert the gap analysis into an implementation plan immediately upon enactment.

Related Regulations

  • Digital Personal Data Protection Act, 2023 — If the proposed bill is in the same jurisdictional family, this is the most direct overlap because it addresses personal data governance in India and may supersede or coexist with any successor text.
  • Information Technology Act, 2000 and rules — Security incident, interception, and intermediary obligations can overlap with privacy compliance and may create parallel reporting or technical controls.
  • GDPR — The GDPR is the clearest international benchmark for notice, lawful basis, processor obligations, and cross-border transfer restrictions, but it is not automatically binding unless an organization is in scope in Europe.
  • CCPA/CPRA — California privacy law overlaps on consumer rights and vendor contracts, but its definitions and enforcement model differ from a bill built around a central data authority.
  • ISO/IEC 27701 — This standard does not conflict with the bill; it is a useful privacy-information-management overlay for organizations seeking auditable controls before the law is final.

FAQ

Does the Personal Data Protection Bill apply to companies outside the country?

Potentially, yes, if the final text follows the structure of the 2019 draft. That draft contemplated extraterritorial application to foreign entities that offer goods or services to individuals in the jurisdiction or monitor their behavior there. Because the bill is still proposed, this should be treated as expected scope rather than current law.

Is the bill in force now?

No. The information provided states that the bill is yet to be passed, so it is not currently enforceable. Organizations should treat it as a legislative proposal and monitor whether a later version is enacted and commenced.

Are there any current fines under this bill?

No current fines can be enforced under a bill that has not become law. If a future enacted version includes penalties, they will apply only from the commencement date and only to conduct within the scope of the final text. Until then, there is no live sanction regime under this bill.

What is the Data Protection Authority supposed to do?

The proposed authority would be the regulator responsible for supervising compliance, handling complaints, issuing directions, and enforcing the statute. In draft-style privacy laws, such a body usually also has rulemaking, investigation, and penalty-assessment powers. Its exact powers will depend on the final enacted text.

Should companies start compliance work before the bill is passed?

Yes. The operational work for data mapping, security hardening, vendor contracting, and rights handling is largely the same whether the final law is this bill or a closely related successor. Early preparation reduces implementation cost if the bill is adopted with a short commencement window.

How does this compare with the 2019 draft?

The 2019 draft is the clearest public version of a Personal Data Protection Bill and is the best source for likely design features such as a central authority, extraterritorial scope, and data-subject rights. However, because later versions may differ, no obligation should be treated as settled unless it appears in the final enacted text.

Sources

Put it into practice

More compliance guides