The ministry said it was extending the timeline “in response to the requests received from several stakeholders“. The draft was first published on November 18. Feedback from public was initially sought by December 17.
A data protection legislation for the country was first envisioned eleven years ago, and the process of formulating a draft was first started five years ago.
As per the DPDPB, any entity collecting data from users must obtain explicit consent for processing data. Such entities must also give users the option to opt-out of such processing of data and erase the stored data when consent is withdrawn.
Entities dealing with data can store their data in any jurisdiction that the government declares trusted. The list will be shared by the government from time to time.
The government has also proposed to establish a Data Protection Board, which will have a chairperson and several full-time and part-time members.
Discover the stories of your interest
Members will be deemed public servants during their tenure. The DPB will have the right to serve notice to appear, search and ask people to testify under oath.
Data fiduciaries which do not put in place adequate measures to protect user data face penalties of up to Rs 250 crore per instance. The total quantum of the fine will be decided by the DPB, as proposed in the DPDPB.
Any entity that has operations in India must adhere to the provisions of the data bill. The government will have rights on the data of Indian citizens irrespective of where it is stored in the world and can seek information from the companies as and when it needs it legally.
The draft of the bill has been lauded for being simple and smaller in size compared to the previous versions.
Experts have, however, raised several concerns on aspects such as the consent-led approach adopted by the bill, an inadequate legal matrix surrounding cross-border data transfers, lack of differentiation between sensitive and critical personal data, and age-gating among others.
