Personal Data Protection Bill: Entities May Face Penalty of Up to Rs. 250 Crore on Failing to Protect Data

Entities that misuse or fail to protect digital data users may face penalties up to Rs. 250 crore under the Digital Personal Data Protection Bill, 2023, which sets out the obligations of entities handling and processing data and the rights of individuals.

The bill introduced in Parliament on Thursday proposes setting up an Indian Data Protection Commission and providing protection to the Centre, the commission and its members for “action taken in good faith”.

The bill relaxes the penalty norms compared to the recommendations made in the draft DPDP released for public comment in November 2022.

“If the committee determines in its conclusion that a person has committed a serious breach of the provisions of this Act or the rules made thereunder, it may, after giving the person an opportunity to be heard, impose a fine specified in the Schedule,” the bill says.

Depending on the schedule, up to Rs. 250 Crores and a minimum of Rs. Entities that violate the norms can be fined Rs 50 crore.

“No suit, prosecution or other legal proceeding shall be instituted in respect of anything done or contemplated to be done in good faith by the Central Government, the Commission, its Chairman or any of its members, officers or employees under this Act or the provisions of this Act. Rules made thereunder ,” the bill states.

The provisions of the Act enable the Center to block access to content in the interest of the public upon obtaining a written reference from the Board.

Minister of State for Electronics and Information Technology Rajeev Chandrasekhar said that the bill, after being passed by Parliament, will protect the rights of all citizens, allow the innovation economy to expand, and allow the government to respond to national security as well as epidemics and earthquakes Wait for legal intervention in emergency situations.

“It will take a lot of (online) platforms to worry about and a lot of abuse and exploitation to break this once and for all. This is undoubtedly a piece of legislation that will bring about profound and lasting behavioral change against the misuse or exploitation of any Indian citizen’s personal data severe punitive consequences on any or all platforms,” said Chandrasekhar.