THE PERSONAL DATA PROTECTION BILL, 2019

1 THE PERSONAL data PROTECTION bill , 2019 ARRANGEMENT OF CLAUSES CHAPTER IPRELIMINARY1. Short title and Application of Act to processing of PERSONAL IIOBLIGATIONS OF data FIDUCIARY4. Prohibition of processing of PERSONAL Limitation on purpose of processing of PERSONAL Limitation on collection of PERSONAL Requirement of notice for collection or processing of PERSONAL Quality of PERSONAL data Restriction on retention of PERSONAL Accountability of data Consent necessary for processing of PERSONAL IIIGROUNDS FOR PROCESSING OF PERSONAL data WITHOUT CONSENT12.

2 Grounds for processing of PERSONAL data without consent in certain Processing of PERSONAL data necessary for purposes related to employment, Processing of PERSONAL data for other reasonable Categorisation of PERSONAL data as sensitive PERSONAL IVPERSONAL data AND SENSITIVE PERSONAL data OF CHILDREN16. Processing of PERSONAL data and sensitive PERSONAL data of VRIGHTS OF data PRINCIPAL17. Right to confirmation and Right to correction and Right to data No. 373 of 2019AS INTRODUCED IN LOK SABHACLAUSES(ii)20. Right to be General conditions for the exercise of rights in this VITRANSPARENCY AND ACCOUNTABILITY MEASURES22.

3 Privacy by design Transparency in processing of PERSONAL Security Reporting of PERSONAL data Classification of data fiduciaries as significant data data PROTECTION impact Maintenance of Audit of policies and conduct of processing, data PROTECTION Processing by entities other than data Grievance redressal by data VIIRESTRICTION ON TRANSFER OF PERSONAL data OUTSIDE INDIA33. Prohibition of processing of sensitive PERSONAL data and critical PERSONAL data Conditions for transfer of sensitive PERSONAL data and critical PERSONAL VIIIEXEMPTIONS35.

4 Power of Central Government to exempt any agency of Government from applicationof the Exemption of certain provisions for certain processing of PERSONAL Power of Central Government to exempt certain data Exemption for research, archiving or statistical Exemption for manual processing by small Sandbox for encouraging innovation, IXDATA PROTECTION AUTHORITY OF INDIA41. Establishment of Composition and qualifications for appointment of Terms and conditions of Removal of Chairperson or other Powers of Meetings of Vacancies, etc.

5 , not to invalidate proceedings of Officers and other employees of Powers and functions of Codes of (iii)51. Power of Authority to issue Power of Authority to call for Power of Authority to conduct Action to be taken by Authority pursuant to an search and Co-ordination between Authority and other regulators or XPENALTIES AND COMPENSATION57. Penalties for contravening certain provisions of the Penalty for failure to comply with data principal requests under Chapter Penalty for failure to furnish report, returns, information, Penalty for failure to comply with direction or order issued by Penalty for contravention where no separate penalty has been Appointment of Adjudicating Procedure for adjudication by Adjudicating Compensation or penalties not to interfere with other Recovery of XIAPPELLATE TRIBUNAL67.

6 Establishment of Appellate Qualifications, appointment, term, conditions of service of Staff of Appellate Distribution of business amongst Appeals to Appellate Procedure and powers of Appellate Orders passed by Appellate Tribunal to be executable as a Appeal to Supreme Right to legal Civil court not to have XIIFINANCE, ACCOUNTS AND AUDIT78. Grants by Central data PROTECTION Authority of India Accounts and Furnishing of returns, etc., to Central XIIIOFFENCES82. Re-identification and processing of de-identified PERSONAL Offences to be cognizable and Offences by Offences by XIVMISCELLANEOUS86.

7 Power of Central Government to issue Members, etc., to be public PROTECTION of action taken in good Exemption from tax on Act to promote framing of policies for digital economy, Bar on processing certain forms of biometric Power to make Power to make Rules and regulations to be laid before Overriding effect of this Power to remove Amendment of Act 21 of SCHEDULE.(iv)CLAUSESTHE PERSONAL data PROTECTION bill , 2019 ABILLto provide for PROTECTION of the privacy of individuals relating to their PERSONAL data ,specify the flow and usage of PERSONAL data , create a relationship of trust betweenpersons and entities processing the PERSONAL data , protect the rights of individualswhose PERSONAL data are processed, to create a framework for organisational andtechnical measures in processing of data , laying down norms for social mediaintermediary.

8 Cross-border transfer, accountability of entities processing personaldata, remedies for unauthorised and harmful processing, and to establish a DataProtection Authority of India for the said purposes and for matters connected therewithor incidental the right to privacy is a fundamental right and it is necessary to protectpersonal data as an essential facet of informational privacy;AND WHEREAS the growth of the digital economy has expanded the use of data as acritical means of communication between persons;AS INTRODUCED IN LOK SABHABill No.

9 373 of 20192 AND WHEREAS it is necessary to create a collective culture that fosters a free and fairdigital economy, respecting the informational privacy of individuals, and ensuringempowerment, progress and innovation through digital governance and inclusion and formatters connected therewith or incidental it enacted by Parliament in the Seventieth Year of the Republic of India as follows: CHAPTER IPRELIMINARY1. (1) This Act may be called the PERSONAL data PROTECTION Act, 2019.(2) It shall come into force on such date as the Central Government may, by notificationin the Official Gazette, appoint; and different dates may be appointed for different provisionsof this Act and any reference in any such provision to the commencement of this Act shallbe construed as a reference to the coming into force of that The provisions of this Act, (A) shall apply to (a) the processing of PERSONAL data where such data has been collected,disclosed, shared or otherwise processed within the territory of India.

10 (b) the processing of PERSONAL data by the State, any Indian company, anycitizen of India or any person or body of persons incorporated or created underIndian law;(c) the processing of PERSONAL data by data fiduciaries or data processorsnot present within the territory of India, if such processing is (i) in connection with any business carried on in India, or anysystematic activity of offering goods or services to data principals withinthe territory of India; or(ii) in connection with any activity which involves profiling of dataprincipals within the territory of India.