Amid protests, the Lok Sabha on Monday passed the Digital Personal Data Protection (DPDP) Bill, 2023, with a voice vote, bringing India a step closer to its first law that establishes how private or government entities can use or process citizens’ data. 

Minister for Electronics and Information Technology Ashwini Vaishnaw moved the Bill in the Lok Sabha. The Bill will now head to the Rajya Sabha, where the ruling coalition is short of the majority mark. 

The Opposition, which has expressed concerns over the legislation, has been demanding that the Bill be sent to a Parliamentary panel for further deliberations. 

On August 3, Mr Vaishnaw had tabled the Bill in the lower house of the Parliament amid protests from the Opposition, which alleged that the Bill violated citizens’ right to privacy. 

The Centre has introduced certain “legitimate causes” where the government and private entities can process citizens’ data without explicit consent. It will also impose restrictions on platforms on processing children’s data. 

The highest prescribed penalty has been capped at Rs 250 crore for not having enough safeguards against data breaches.

The Bill also mandates that India have its data protection regulator in the form of a data protection board. It says that the chairperson and members of the board will be appointed by the Union government. 

The Bill amends the Right to Information Act, 2005, to remove public interest exemptions on disclosing personal information.

Apart from that, the Bill also has provisions that give wide exemptions to the government. The proposed law says its provisions will not apply in respect to the processing of personal data when notified by “instrumentality of the State as the Central government may notify”. 

These could be in cases related to the sovereignty and integrity of the country, security, friendly relations with foreign States, maintenance of public order or preventing incitement to any cognisable offence relating to any of these.