Privacy and Data Protection

India’s 6-year long journey in the realm of data protection and privacy has finally culminated into the latest Digital Personal Data Protection Bill 2023 (2023 Bill). The 2023 Bill was tabled before the lower house of the Parliament (i.e. Lok Sabha) on 3 August 2023, and is now slated to be debated.

The Reserve Bank of India (RBI) has issued a master direction on outsourcing of information technology services by REs (as described below) on 10 April 2023 (Direction). The RBI had published a draft master direction for public feedback on 23 June 2022, pursuant to which the Direction has been released. The Direction aims to mitigate risks (as described below) faced by REs due to material outsourcing of information technology (IT) or IT enabled services as identified under the Direction (collectively, “IT services”) to providers of IT or IT enabled services (Service Providers).

In the year 2022, the Indian Government proposed the enactment of a comprehensive Digital India Act (DIA) to provide global and contemporaneous legal standards for catering to India’s evolving digital ecosystem.

After various legislative predecessors, on 18 November 2022, the Ministry of Electronics and Information Technology ('MeitY') issued the Digital Personal Data Protection Bill, 2022 ('the Bill') for public consultation.

In early August 2022, the Ministry of Electronics and Information Technology (MeitY) withdrew the Personal Data Protection Bill 2019 (2019 Bill), which was reworked on by the Joint Parliamentary Committee (JPC), promising that they would release a more comprehensive data protection framework to take into account the recommendations of the JPC.

The Indian Computer Emergency Response Team (CERT-In) had issued directions on 28 April 2022 (Directions) on information security practices, procedure, prevention, response and reporting of cyber incidents for safe and trusted internet. On 18 May 2022, the Ministry of Electronics and Information Technology (MEITY) issued clarifications in the form of frequently asked questions (FAQs) in respect of the much talked about Directions. The FAQs have been released at a pivotal juncture, with just about 5 weeks left before the Directions come into effect.