Personal Data Protection Bill (Proposed)

The Personal Data Protection Bill aims to provide protection of personal data of individuals, and establishes a Data Protection Authority for the same. The Bill is yet to be passed.

JurisdictionIndia
CategoryPrivacy & Data Protection
StatusProposed
Latest development

Analysis

Key Requirements

The Personal Data Protection Bill (PDPB) proposes several key requirements for organizations handling personal data:

  • Consent-based processing: Organizations must obtain explicit consent from individuals before collecting or processing their personal data, with some exceptions for legitimate purposes. PRS India
  • Data minimization and purpose limitation: Personal data should only be collected and processed for specific, lawful purposes, and limited to what is necessary. Tripwire
  • Data security measures: Organizations must implement reasonable security safeguards to prevent data breaches and unauthorized access. PRS India
  • Data subject rights: Individuals have the right to access, correct, and erase their personal data, as well as the right to data portability. Secure Privacy
  • Breach notification: Organizations must inform the Data Protection Board of India and affected individuals in case of a data breach. PRS India
  • Cross-border data transfers: The bill allows transfer of personal data outside India, except to countries restricted by the central government. PRS India

Compliance Challenges

Organizations face several challenges in complying with the PDPB:

  • Data mapping and inventory: Identifying and categorizing all personal data processed by the organization can be complex and time-consuming. The One Technologies
  • Obtaining and managing consent: Implementing systems to obtain, record, and manage user consent for various data processing activities. Secure Privacy
  • Implementing data subject rights: Developing processes to handle data access, correction, and erasure requests from individuals. Tripwire
  • Ensuring data security: Implementing and maintaining robust security measures to protect personal data from breaches and unauthorized access. The One Technologies

Implementation Best Practices

To implement PDPB requirements effectively, organizations should:

  • Conduct regular data audits: Regularly review and document data processing activities to ensure compliance. The One Technologies
  • Implement privacy by design: Integrate data protection principles into all data processing activities from the outset. Pivot Point Security
  • Provide staff training: Offer comprehensive privacy awareness and training programs for all employees handling personal data. Pivot Point Security
  • Establish a privacy compliance monitoring process: Set up ongoing monitoring and auditing processes to ensure continued compliance. Pivot Point Security
  • Use privacy-enhancing technologies: Implement tools like data discovery and classification software to aid compliance efforts. BigID

Recent Updates

The PDPB has undergone several revisions:

  • The Digital Personal Data Protection Act 2023 was passed by both houses of the Indian Parliament in August 2023. PRS India
  • The Act is expected to come into force in phases, with specific provisions becoming effective on dates to be notified by the government. Benesch Law
  • The government is yet to announce the exact implementation timeline and compliance deadlines.

Related Regulations

The PDPB interacts with several other regulations:

  • Information Technology Act, 2000: The PDPB will complement and partially supersede data protection provisions in this Act. Carnegie Endowment
  • General Data Protection Regulation (GDPR): While not directly related, the PDPB shares similarities with the EU's GDPR in terms of data subject rights and consent requirements. Tripwire
  • California Consumer Privacy Act (CCPA): Another influential privacy law that shares some common principles with the PDPB. The One Technologies

Industry Impact

The PDPB is expected to have significant impacts across various industries:

  • Technology and e-commerce: These sectors will need to make substantial changes to their data collection and processing practices. Carnegie Endowment
  • Healthcare: The law will affect how patient data is handled and shared, potentially impacting telemedicine and health tech innovations. Future of Privacy Forum
  • Financial services: Banks and fintech companies will need to review their data practices, especially regarding cross-border data transfers. PRS India

Sources

Recent developments

  • — Government of India highlights full operationalisation timeline of the **Digital Personal Data Protection Act, 2023** via the DPDP Rules, 2025, reiterating phased compliance over 18 months and enforcement of individual rights to access, correct, and erase personal data.[7][6] (source)
  • — Policy update discussions focus on implementation of DPDP Rules, 2025, including obligations on data fiduciaries to establish consent, grievance mechanisms, and age verification for minors’ data, signalling stricter compliance expectations across sectors.[7][5] (source)
  • — Analyses of the **Digital Personal Data Protection Bill/Act, 2023** stress obligations for data fiduciaries (accuracy, security, deletion when purpose is met) and exemptions for certain government agencies, raising industry concerns over regulatory asymmetry and state surveillance powers.[5] (source)
  • — Coverage of the Lok Sabha’s passage of the Digital Personal Data Protection Bill, 2023 notes penalties up to ₹250 crore and extra-territorial application to processing outside India that targets Indian residents, with businesses warning of significant compliance and enforcement costs.[8] (source)
  • — Reports on the revised personal data protection draft (Digital Personal Data Protection Bill, 2022) highlight increased penalties up to ₹500 crore and relaxed cross‑border data transfer rules, which large tech firms and industry groups view as a positive step for data flows but still challenging for compliance.[9] (source)
  • — Policy commentary emphasizes data principal rights (information, correction, erasure, nomination, grievance redressal) and government powers to exempt certain data fiduciaries (including startups) from some obligations, prompting debate over innovation support versus potential consumer risk.[5] (source)
  • — Government communications on DPDP Rules, 2025 underline reinforced rights to data access, correction, and deletion, and introduce structured mechanisms for delegating these rights, which organizations interpret as requiring upgrades to identity management and rights‑request workflows.[7] (source)
  • — Industry reaction pieces describe the DPDP framework as India’s “GDPR‑style” regime; sectors including tech, finance, and e‑commerce anticipate major investments in compliance, data governance, and cross‑border transfer assessments.[8] (source)
  • — Analysis of draft provisions on the Data Protection Board’s penalty powers (including distinct caps for security safeguards, breach notification, and children’s data obligations) notes that companies expect more rigorous breach‑reporting and child‑data governance programs.[9] (source)
  • — Notification of the **Digital Personal Data Protection (DPDP) Rules, 2025** formally operationalises India’s personal data protection regime, setting an 18‑month phased compliance window that has driven extensive readiness projects in data mapping, consent mechanisms, and security controls across industries.[7] (source)

Read the full guide to Personal Data Protection Bill (Proposed)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates