What are the key provisions of the Personal Data Protection Bill, 2019, that I should be aware of regarding the processing of personal data?

Detailed Legal Analysis

The Personal Data Protection Bill, 2019, is a significant legislative framework in India that aims to regulate the processing of personal data, ensuring the privacy and protection of individuals' data. Here are the key provisions that one should be aware of:

• Definition of Personal Data: According to Section 2(1)(28) of the Bill, personal data refers to data about an individual who is identifiable by such data, including name, contact details, location, and more.
• Processing of Personal Data: The Bill establishes that personal data can only be processed with the consent of the individual (Section 7). Consent must be free, informed, specific, and unambiguous.
• Data Principal Rights: The Bill grants various rights to data principals (individuals whose data is being processed), including:
  • Right to Access: As per Section 15, individuals can request access to their personal data and inquire about its processing.
  • Right to Erasure: Under Section 18, individuals can request the deletion of their data under certain conditions.
  • Right to Data Portability: Section 20 allows individuals to obtain their data in a structured format and transfer it to another data fiduciary.
• Data Fiduciary and Processor Obligations: The Bill defines data fiduciaries as entities that determine the purpose and means of processing personal data (Section 2(1)(15)). They have several obligations, such as:
  • Ensuring data security measures (Section 24).
  • Maintaining records of data processing activities (Section 26).
• Data Protection Authority: The Bill establishes the Data Protection Authority of India (DPA) to oversee and enforce compliance with the law, as detailed in Chapter VI.
• Cross-Border Data Transfer: Section 34 outlines that the Central Government may notify countries to which personal data can be transferred, ensuring similar levels of data protection.
• Penalties for Non-Compliance: The Bill specifies penalties for violations, including fines up to INR 15 crore or 4% of the annual global turnover, whichever is higher (Section 30).

In summary, the Personal Data Protection Bill, 2019, is designed to safeguard the personal data of individuals, establish accountability among data fiduciaries, and empower individuals with rights over their data. It is crucial for organizations to comply with these provisions to avoid legal repercussions.