What are the provisions regarding data protection in the draft Personal Data Protection Bill, 2021, and how do they compare to the IT Act, 2000?

Detailed Legal Analysis

The draft Personal Data Protection Bill, 2021 (PDP Bill) introduces comprehensive provisions for data protection in India, significantly enhancing the framework established under the Information Technology Act, 2000 (IT Act). The PDP Bill aims to establish a robust legal framework for the processing of personal data, ensuring individuals' rights while balancing the needs of organizations.

Key provisions of the PDP Bill, 2021 include:

• Definition of Personal Data: The PDP Bill defines personal data as data that relates to an identifiable individual, thereby broadening the scope of data protection.
• Data Principal Rights: It grants numerous rights to individuals (data principals) including the right to access, correction, erasure, and data portability (Section 15-20).
• Consent Requirement: The Bill mandates explicit consent for processing personal data (Section 6), ensuring that individuals have control over their information.
• Data Protection Authority (DPA): It establishes a DPA to oversee compliance, handle grievances, and promote awareness (Chapter IV).
• Data Fiduciaries and Processors: The Bill differentiates between data fiduciaries (those who determine the purpose and means of processing) and data processors (those who process data on behalf of fiduciaries), holding them accountable (Section 4).
• Cross-Border Data Transfer: The Bill permits the transfer of personal data outside India under certain conditions, subject to the adequacy of the receiving country’s data protection laws (Section 34).
• Penalties and Offences: It outlines significant penalties for non-compliance, including fines of up to ₹15 crores or 4% of the global turnover (Section 30).

In comparison, the IT Act, 2000 primarily addresses cybercrimes and electronic commerce, with limited provisions regarding data protection. Key aspects of the IT Act include:

• Section 43A: It provides for compensation for failure to protect sensitive personal data, but lacks a comprehensive framework.
• Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011: These rules offer some guidelines on data protection but are not as extensive as the PDP Bill.

In summary, while the IT Act lays the groundwork for cyber regulations, the PDP Bill aims to create a more structured and rights-based approach to data protection, aligning with global standards such as the GDPR.