The Digital Personal Data Protection Bill, 2023, was passed by the Rajya Sabha on Wednesday, 8th August 2023. Bill provides for the processing of digital personal data in a manner that recognizes both the rights of the individuals to protect their personal data and the need to process such personal data for lawful purposes and for matters connected therewith or incidental thereto. 

 The bill protects digital personal data by providing the obligations of Data Fiduciaries, rights and duties of Data Principals, and financial penalties for breach of rights, duties and obligations. The bill also seeks to achieve the introduction of data protection law with minimum disruption while ensuring necessary change in the way Data Fiduciaries process data, enhance the Ease of Living and the Ease of Doing Business, and enable India’s digital economy and its innovation ecosystem. 

 The bill is developed based on seven major principles. It believes in the principle of consent, lawful and transparent use of personal data; principle of purpose limitation; the principle of data minimization; the principle of data accuracy; the principle of storage limitation, the principle of reasonable security safeguard, and the principle of accountability. 

 The bill also carries certain innovative features. It is concise and SARAL, that is Simple, Accessible, Rational &Actionable Law. It uses plain language, contains illustrations that make the meaning clear, contains no provisos, and has minimal cross-referencing. 

 The bill uses the word “she” instead of “he”, by which it acknowledges women in Parliamentary law-making. It provides individuals with the right to access information about personal data processed; the right to correction and erasure of data; the right to grievance redressal; and the right to nominate a person to exercise rights in case of death or incapacity. 

 To enforce his/her rights, an affected Data Principal may approach the Data Fiduciary in the first instance. In case he/she is not satisfied, he/she can complain against the Data Fiduciary to the Data Protection Board in a hassle-free manner. 

 The bill also safeguards the personal data of children as well. It does not permit processing which is detrimental to the well-being of children or involves tracking, behavioural monitoring or targeted advertising.