Personal Data Protection Bill: Entities May Face Penalty of Up to Rs. 250 Crore on Failing to Protect Data

Entities misusing or failing to protect digital data users may face penalty of up to Rs. 250 crore, according to the Digital Personal Data Protection Bill 2023 which lays down obligations of entities handling and processing data as well as rights of individuals. 

The bill which was introduced in Parliament on Thursday moots creation of Data Protection Board of India and provides protection to the Centre, the board and its members, on "action taken in good faith".

The bill has relaxed penalty norms compared to the proposal made in the draft DPDP that was circulated for public consultation in November 2022.

"If the board determines on conclusion of an inquiry that breach of the provisions of this Act or the rules made thereunder by a person is significant, it may, after giving person an opportunity of being heard, impose such monetary penalty specified in the schedule," the bill said.

Under the schedule, maximum of Rs. 250 crore and minimum Rs. 50 crore can be imposed on entity violating the norms.

"No suit, prosecution or other legal proceedings shall lie against the central government, the board, its chairperson and any member, officer or employee thereof for anything which is done or intended to be done in good faith under the provisions of this Act or the rules made thereunder," the bill said.

Provisions under the bill enable the Centre to block access to content in the interest of general public on getting reference in writing from the board.

Minister of State for electronics and IT Rajeev Chandrasekhar said that the bill after it is passed by Parliament, will protect rights of all citizens, allow innovation economy to expand and permit the government's lawful and legitimate access in national security and emergencies like pandemics and earthquakes etc.

"It will take a lot of the concerns and lot of misuse and exploitation that is done by many of these (online) platforms. Puts a break on that once and for all. This is certainly a legislation that will create deep lasting behaviourial change and create high punitive consequences for any or all platforms that misuse or exploit personal data of any Indian citizen," Chandrasekhar said.