What are my rights regarding data protection under the Personal Data Protection Bill (PDPB) 2019, and when is it expected to be enacted?

Detailed Legal Analysis

Your rights regarding data protection under the Personal Data Protection Bill (PDPB) 2019 include a range of provisions aimed at safeguarding personal data, and while the bill has been pending for enactment, it is widely anticipated to be passed soon, although no specific date has been confirmed.

The PDPB 2019 seeks to establish a comprehensive framework for the protection of personal data in India. Here are some key rights and provisions outlined in the bill:

• Right to Access: Individuals have the right to request access to their personal data that is being processed by data fiduciaries (sections 15 and 16).
• Right to Correction: Individuals can request corrections to their personal data if it is inaccurate, incomplete, or outdated (section 16).
• Right to Erasure: Individuals have the right to request the deletion of their personal data under certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected (section 17).
• Right to Data Portability: The bill provides individuals the right to receive their personal data in a structured, commonly used, and machine-readable format and to transmit that data to another data fiduciary (section 20).
• Right to Object: Individuals can object to the processing of their personal data in certain situations, especially when data is processed for direct marketing purposes (section 19).
• Right to be Informed: Data fiduciaries are required to inform individuals about the purpose of data collection, the nature of data being collected, and the individuals’ rights regarding their data processing (section 7).

Additionally, the PDPB 2019 introduces obligations for data fiduciaries, including:

• Implementing reasonable security safeguards to protect personal data (section 25).
• Conducting Data Protection Impact Assessments (DPIAs) for high-risk data processing (section 27).
• Appointing a Data Protection Officer (DPO) for certain categories of data fiduciaries (section 30).

The PDPB also establishes the Data Protection Authority of India (DPA), which will oversee the compliance and enforcement of data protection laws (section 41). As of now, the bill is under consideration in the Indian Parliament, and while the timeline for enactment remains uncertain, the growing global emphasis on data protection suggests that its passage may be imminent.