India Proposes New Data Protection Bill With Heavy Penalties
The Government of India has proposed a new Digital Personal Data Protection Bill 2022, focusing on strengthening data privacy principles and imposing heavy penalties for non-compliance. The draft bill emphasizes the importance of a robust security framework and responsible data handling.
The bill introduces a Data Protection Board of India to oversee compliance and enforce penalties, with a cap of Rs. 500 Crore per instance. In case of a breach, the board can direct data fiduciaries to remedy the situation and mitigate harm to data principals.
Currently, Indian enterprises face gaps in their data privacy strategy, often focusing solely on compliance without understanding the 'what' and 'why' of privacy. They also heavily rely on technology solutions. To address this, companies should limit personnel file access, maintain confidentiality, avoid third-party sharing, manage data digitally for timely deletion, and use privacy management software.
To avoid penalties, enterprises should integrate privacy into their core operations, not just comply with regulations. Privacy by design, data mapping, governance frameworks, and implementing privacy controls throughout data handling processes are recommended best practices.
The new bill, once finalized, will require Indian enterprises to elevate their data privacy strategies. It's crucial for them to understand and address privacy principles proactively, not just reactively, to avoid substantial penalties and ensure data processing integrity.
