Industry bodies suggested the government regarding Digital Personal Data Protection Bill

The government must follow a phased implementation once the recently drafted Digital Personal Data Protection Bill, 2022, becomes law, industry bodies have said. Its provisions should kick in gradually so that entities have adequate time to transition to the new regime, they said.

According to a report by The Economic Times, Nasscom has suggested that the government consider a timeframe of 24 months for implementation of the new iteration, the same as was for the earlier versions of the draft.

Industry body BSA (The Software Alliance) has suggested a transitional period of at least two years for the implementation of the bill. In its submission to the government, BSA said all implementing regulations should be finalized at least 12 months before they take effect to ensure that companies have sufficient time to operationalise the requirements.

Scope of the Digital Personal Data Protection Bill

The Digital Personal Data Protection Bill applies to any 'digital personal data' processed within India. For the purpose of understanding, the term 'data' is used in the Digital Personal Data Protection Bill to mean the 'representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by humans or by automated means'; while the term 'personal data' is defined as 'any data about an individual who is identifiable by or in relation to such data'.

The term 'digital personal data' (in the Digital Personal Data Protection Bill) encompasses data collected offline and subsequently digitized as well as data collected online by a 'Data Principal' (viz. the individual to whom the personal data processed is in relation to). Notably, if such a private individual is a 'child' (viz. less than eighteen years of age), then the term 'Data Principal' includes the parents or lawful guardian(s) of such a child.