Personal Data Protection Bill - Ministry of Electronics ...

1 I THE Personal data Protection bill , 2018 CHAPTER I PRELIMINARY 1. Short title, extent and commencement.. 1 2. Application of the Act to processing of Personal data .. 1 3. Definitions. In this Act, unless the context otherwise requires, .. 2 CHAPTER II data Protection OBLIGATIONS 4. Fair and reasonable processing.. 6 5. Purpose limitation.. 6 6. Collection limitation.. 7 7. Lawful processing.. 7 8. Notice.. 7 9. data quality.. 8 10. data storage limitation.. 8 11. Accountability.. 9 CHAPTER III GROUNDS FOR PROCESSING OF Personal data 12. Processing of Personal data on the basis of consent.. 9 13. Processing of Personal data for functions of the State.. 10 14. Processing of Personal data in compliance with law or any order of any court or tribunal. 10 15. Processing of Personal data necessary for prompt action.

2 10 16. Processing of Personal data necessary for purposes related to employment.. 10 17. Processing of data for reasonable purposes.. 11 CHAPTER IV GROUNDS FOR PROCESSING OF SENSITIVE Personal data 18. Processing of sensitive Personal data based on explicit consent.. 11 19. Processing of sensitive Personal data for certain functions of the State.. 12 20. Processing of sensitive Personal data in compliance with law or any order of any court or tribunal.. 12 21. Processing of certain categories of sensitive Personal data for prompt action.. 12 ii 22. Further categories of sensitive Personal data .. 13 CHAPTER V Personal AND SENSITIVE Personal data OF CHILDREN 23. Processing of Personal data and sensitive Personal data of children.. 13 CHAPTER VI data PRINCIPAL RIGHTS 24. Right to confirmation and access.

3 14 25. Right to correction, etc.. 14 26. Right to data Portability.. 15 27. Right to Be Forgotten.. 16 28. General conditions for the exercise of rights in this Chapter.. 16 CHAPTER VII TRANSPARENCY AND ACCOUNTABILITY MEASURES 29. Privacy by Design.. 17 30. Transparency.. 18 31. Security Safeguards.. 18 32. Personal data Breach.. 18 33. data Protection Impact Assessment.. 19 34. Record-Keeping.. 20 35. data Audits.. 20 36. data Protection Officer.. 21 37. Processing by entities other than data fiduciaries.. 22 38. Classification of data fiduciaries as significant data fiduciaries.. 22 39. Grievance Redressal.. 23 CHAPTER VIII TRANSFER OF Personal data OUTSIDE INDIA 40. Restrictions on Cross-Border Transfer of Personal data .. 23 41. Conditions for Cross-Border Transfer of Personal data .. 24 CHAPTER IX EXEMPTIONS 42.

4 Security of the State.. 25 43. Prevention, detection, investigation and prosecution of contraventions of law.. 25 iii 44. Processing for the purpose of legal proceedings.. 26 45. Research, archiving or statistical purposes.. 27 46. Personal or domestic purposes.. 27 47. Journalistic purposes.. 28 48. Manual processing by small entities.. 28 CHAPTER X data Protection AUTHORITY OF INDIA 49. Establishment and incorporation of Authority.. 29 50. Composition and qualifications for appointment of members.. 29 51. Terms and conditions of appointment.. 30 52. Removal of members.. 30 53. Powers of the chairperson.. 31 54. Meetings of the Authority.. 31 55. Vacancies, etc. not to invalidate proceedings of the Authority.. 31 56. Officers and Employees of the Authority.. 31 57. Grants by Central Government.. 32 58. Accounts and Audit.

5 32 59. Furnishing of returns, etc. to Central Government.. 32 60. Powers and Functions of the Authority.. 33 61. Codes of Practice.. 35 62. Power of Authority to issue directions.. 36 63. Power of Authority to call for information.. 37 64. Power of Authority to conduct inquiry.. 37 65. Action to be taken by Authority pursuant to an inquiry.. 38 66. Search and Seizure.. 39 67. Coordination between the Authority and other regulators or authorities.. 40 68. Appointment of Adjudicating Officer.. 41 CHAPTER XI PENALTIES AND REMEDIES 69. Penalties.. 41 70. Penalty for failure to comply with data principal requests under Chapter VI.. 42 71. Penalty for failure to furnish report, returns, information, etc.. 42 iv 72. Penalty for failure to comply with direction or order issued by the Authority.. 43 73. Penalty for contravention where no separate penalty has been provided.

6 43 74. Adjudication by Adjudicating Officer.. 43 75. Compensation.. 44 76. Compensation or penalties not to interfere with other punishment.. 45 77. data Protection Funds.. 45 78. Recovery of Amounts.. 46 CHAPTER XII APPELLATE TRIBUNAL 79. Establishment of Appellate Tribunal.. 47 80. Qualifications, appointment, term, conditions of service of members.. 48 81. Vacancies.. 48 82. Staff of Appellate Tribunal.. 48 83. Distribution of business amongst benches.. 48 84. Appeals to Appellate Tribunal.. 49 85. Procedure and powers of Appellate Tribunal.. 49 86. Orders passed by Appellate Tribunal to be executable as a decree.. 50 87. Appeal to Supreme Court of India.. 50 88. Right to legal representation.. 50 89. Civil court not to have jurisdiction.. 51 CHAPTER XIII OFFENCES 90. Obtaining, transferring or selling of Personal data contrary to the Act.

7 51 91. Obtaining, transferring or selling of sensitive Personal data contrary to the Act.. 51 92. Re-identification and processing of de-identified Personal data .. 52 93. Offences to be cognizable and non-bailable.. 52 94. Power to investigate offences.. 52 95. Offences by companies.. 52 96. Offences by Central or State Government departments.. 53 CHAPTER XIV TRANSITIONAL PROVISIONS 97. Transitional provisions and commencement.. 54 v CHAPTER XV MISCELLANEOUS 98. Power of Central Government to issue directions in certain circumstances.. 55 99. Members, etc., to be public servants.. 55 100. Protection of action taken in good faith.. 55 101. Exemption from tax on income.. 55 102. Delegation.. 55 103. Power to remove difficulties.. 56 104. Power to exempt certain data processors.. 56 105. No application to non- Personal data .

8 56 106. Bar on processing certain forms of biometric data .. 56 107. Power to make rules.. 56 108. Power to make regulations.. 58 109. Rules and Regulations to be laid before Parliament.. 59 110. Overriding effect of this Act.. 60 111. Amendment of Act 21 of 2000.. 60 112. Amendment of Act 22 of 2005.. 60 THE FIRST SCHEDULE .. 61 THE SECOND SCHEDULE .. 62 1 THE Personal data Protection bill , 2018 WHEREAS the right to privacy is a fundamental right and it is necessary to protect Personal data as an essential facet of informational privacy; WHEREAS the growth of the digital economy has meant the use of data as a critical means of communication between persons; WHEREAS it is necessary to create a collective culture that fosters a free and fair digital economy, respecting the informational privacy of individuals, and ensuring empowerment, progress and innovation.

9 AND WHEREAS it is expedient to make provision: toprotect the autonomy of individuals in relation with their Personal data , to specify where the flow and usage of Personal data is appropriate, to create a relationship of trust between persons and entities processing their Personal data , to specify the rights of individuals whose Personal data are processed, to create a framework for implementing organisational and technical measures in processing Personal data , to lay down norms for cross-border transfer of Personal data , to ensure the accountability of entities processing Personal data , to provide remedies for unauthorised and harmful processing, and to establish a data Protection Authority for overseeing processing activities; BE IT ENACTED by Parliament in the Sixty-Ninth Year of the Republic of India as follows: CHAPTER I PRELIMINARY 1.

10 Short title, extentand commencement. (1) This Act may be called the Personal data Protection Act, 2018. (2) It extends to the whole of India. (3) The provisions of Chapter XIV of this Act shall come into force on such date, as the Central Government may by notification appointand the remaining provisions of the Act shall come into force in accordance with the provisions in that Chapter. 2. Application of the Act to processing of Personal data . (1) This Act applies to the following (a) processing of Personal data where such data has been collected, disclosed, shared or otherwise processed within the territory of India; and (b) processing of Personal data by the State, any Indian company, any Indian citizen or any person or body of persons incorporated or created under Indian law. 2 (2) Notwithstanding anything contained insub-section (1), the Act shall apply to the processing of Personal data by data fiduciaries or data processors not present within the territory of India, only if such processing is (a) in connection with any business carried on in India, or any systematic activity of offering goods or services to data principals within the territory of India; or (b) in connection with any activity which involves profiling of data principals within the territory of India.