Companies will have to review their current processes and also sensitise their workforce in handling of personal data, once the Digital Personal Data Protection Bill becomes a law, several experts and analysts said.
“In view of the Bill’s extra territorial coverage, enterprises based outside India serving individuals in India will also be expected to adhere to the provisions of this Bill once enacted,” Manish Sehgal, partner at Deloitte India said. He also said that enterprises will have to review the current ways of working, especially for personal data of employees, customers, merchants and vendors to honour their right to access, update and erase their personal data.
Founding director of technology policy think tank The Dialogue Kazim Rizvi commended several elements in the Bill but sought clarity on some other provisions.
“The 2023 Bill has expanded the provision for the creation of a grievance resolution mechanism to consent managers. This is also a beneficial step, however it will be great that any future rules related to this clause align with other sector-specific regulations for consent managers which will help to avoid regulatory disparity,” he said. “It will be further helpful to clarify the mechanisms like binding corporate rules, contractual clauses etc that enterprises may follow to transfer the data,” he said on cross-border data.
Shahana Chatterji, partner at Shardul Amarchand Mangaldas and Co, said the Bill is a forward-looking legislation having horizontal application across sectors, and will impact businesses of all sizes.
