Personal Data Protection Bill 2023: What will change for a normal user?

Agama Law Associates partner Archana Balasubramanian shares her views on the alignment of this Bill with sectoral laws for business operating in India in an article by Hindustan Times titled “Personal data protection bill 2023: What will change for a normal user?”

How will normal users get affected post-implementation of the data bill?

Once the Digital Personal Data Protection Bill becomes law, there will be a framework and an ombudsman system to handle data breach problems. But only digital data will be covered, not physical data. This means even taking a picture of data counts. However, if someone only uses paper and never makes it digital, they won’t have to follow these rules, no matter how much data they have, says Archana Balasubramanian, partner at Agama Law Associates.

Also, Indian businesses already deal with rules from the US and Europe, so not much will change in how they work, she adds.

Users might notice a few things, like clearer privacy notices, choices to say no, alerts if data is misused, and the right to see and fix data.

For example:

1. Websites and apps will ask for permission before using your data.

2. You’ll need to give consent before getting emails or texts for promotions.

3. Once this new law starts, online businesses will tell you about your data and how they use it.

Startups may feel difficulty initially but will get help in the long term:

Startups get extra protection if they collect data for research or tech development, says Balasubramanian. She adds, tech and IP-focused firms can now shield trade secrets better, preventing leaks or espionage as accessing employee data for this purpose is seen as employee consent.

Industry friendly:

This is a minimally disruptive law – laws finally being aligned with sectoral laws, recognising processing outside India for Indian subjects and allowing businesses to continue validity based on pre-existing consent – basically retaining the “opt-out” right as opposed to international standards of “Opt-In”, says Agama Law Associates’ Balasubramanian.

Simple:

“It’s also lovely to see those illustrations and examples to throw light on the provision – much like the Indian contract act and IPC,” she adds.

Special provision for children:

“It is heartening to see measures around personal data processing of children especially guiding data fiduciaries to not track or undertake behavioral monitoring or advertising securing their digital privacy.”