India proposes permitting cross-border data transfers with certain countries in new privacy bill

guest · Nov 19, 2022

By Jagmeet Singh @jagmeets13, Manish Singh @refsrc - November 18, 2022

India has proposed a new comprehensive data privacy law that will mandate how companies handle data of its citizens, including permitting cross-border transfer of information with certain nations, three months after it abruptly withdrew the previous proposal following scrutiny and concerns from privacy advocates and tech giants.

The nation’s IT ministry published a draft of the proposed rules (PDF), called the Digital Personal Data Protection Bill 2022, on Friday for public consultation. It will hear views from the public until December 17.

“The purpose of this Act is to provide for the processing of digital personal data in a manner that recognizes both the right of individuals to protect their personal data and the need to process personal data for lawful purposes, and for matters connected therewith or incidental thereto,” the draft says.
Click to expand...

The draft permits cross-border interactions of data with “certain notified countries and territories,” in a move that is seen as a win for tech companies.

“The Central Government may, after an assessment of such factors as it may consider necessary, notify such countries or territories outside India to which a Data Fiduciary may transfer personal data, in accordance with such terms and conditions as may be specified,” the draft says, without naming the countries.
It also asks that companies do not store the data perpetually by default. “The storage should be limited to such duration as is necessary for the stated purpose for which personal data was collected,” a note from the ministry said.
Click to expand...

guest · Nov 19, 2022

Indian Government Publishes Draft of Digital Personal Data Protection Bill 2022
By Ravie Lakshmanan - November 19, 2022

The Indian government on Friday released a draft version of the much-awaited data protection regulation, making it the fourth such effort since it was first proposed in July 2018.

The Digital Personal Data Protection Bill, 2022, as it's called, aims to secure personal data, while also seeking users' consent in what the draft claims is "clear and plain language" describing the exact kinds of information that will be collected and for what purpose.
The draft is open for public consultation until December 17, 2022.
Click to expand...

"The Bill will establish the comprehensive legal framework governing digital personal data protection in India," the government said. "The Bill provides for the processing of digital personal data in a manner that recognizes the right of individuals to protect their personal data, societal rights and the need to process personal data for lawful purposes."

The legislation, in its current form, requires companies (i.e., data processors) to follow sufficient security safeguards to protect user information, alert users in the event of a data breach, and stop retaining users' data should individuals opt to delete their accounts.

"The storage should be limited to such duration as is necessary for the stated purpose for which personal data was collected," an explanatory note released by India's Ministry of Electronics and Information Technology (MeitY) reads.
Click to expand...

Furthermore, the draft imposes data minimization requirements as well as additional guardrails companies have to adopt in order to prevent unauthorized collection or processing of personal data.

What's also notable is that the legislation no longer mandates data localization, allowing tech giants to transfer personal data outside of Indian geographical borders to specific countries and territories.
Click to expand...

Log in or Sign up

India proposes permitting cross-border data transfers with certain countries in new privacy bill

guest Guest

guest Guest

Log in or Sign up

India proposes permitting cross-border data transfers with certain countries in new privacy bill

guest Guest

guest Guest

Useful Searches