india-map

FIND YOUR MP

Switch to Hindi (हिंदी)
  • MPs & MLAs
    Parliament States 2024 Elections
  • Legislatures
    Parliament
    Session Track Parliament Diary Parliament Committees Primer Vital Stats
    States
    Legislature Track Vital Stats
    Discussion Papers
  • Bills & Acts
    Bills Parliament Acts Parliament Bills States State Legislative Briefs Acts States
  • Budgets
    Parliament States Discussion Papers
  • Policy
    Discussion Papers Science & Technology Policy Monthly Policy Reviews Annual Policy Reviews Committee Reports President Address Vital Stats COVID-19
  • LAMP
    About the LAMP Fellowship How to Apply Life at LAMP Videos Meet our Fellows Get in touch
  • Careers

FIND YOUR MP

Parliament States 2024 Elections
Session Track Parliament Diary Parliament Committees Primer Vital Stats
Legislature Track Vital Stats
Discussion Papers
Bills Parliament Acts Parliament Bills States State Legislative briefs Acts States
Parliament States Discussion Papers
Discussion Papers Science & Technology Policy Monthly Policy Reviews Annual Policy Reviews Committee Reports President Address Vital Stats COVID-19
About the LAMP Fellowship How to Apply Life at LAMP Videos Meet our Fellows Get in touch
  • The PRS Blog
  • The Personal Data Protection Bill, 2019: How it differs from the draft Bill
Legislation

The Personal Data Protection Bill, 2019: How it differs from the draft Bill

Anurag Vaishnav - December 27, 2019

The Personal Data Protection Bill, 2019 was recently introduced in Parliament.  The Bill has been referred to a Joint Parliamentary Committee for detailed examination, and the Committee is expected to submit its report by the last week of Budget Session, 2020.  The Bill seeks to provide for the protection of personal data of individuals (known as data principals), and creates a framework for processing such personal data by other entities (known as data fiduciaries).  It provides the data principal with certain rights with respect to their data, such as seeking correction, completion or transfer of their data to other fiduciaries.   Similarly, it sets out certain obligations, and other transparency and accountability measures to be undertaken by the data fiduciary, such as instituting grievance redressal mechanisms to address complaints of individuals.  Processing of personal data is exempted from the provisions of the Bill in certain cases, such as security of state, public order, or for prevention, investigation, or prosecution of any offence.  The Bill also establishes a Data Protection Authority to ensure compliance with the provisions of the Bill and provide for further regulations. 

 

As per the Statement of Objects and Reasons of the 2019 Bill, the provisions of the Bill are based on the recommendations of the report of the Expert Committee (Chair: Justice B. N. Srikrishna) which examined issues related to protection of personal data and proposed a Draft Personal Data Protection Bill, 2018.  

 

In a previous blog, we provided a brief background to the 2019 Bill, explained why a Bill was brought for personal data protection and what are some of the key provisions of the Bill.  In this blog, we look at how the 2019 Bill differs from the 2018 Draft Bill.

Table 1: Comparison of the provisions of the 2018 Draft Bill with the 2019 Bill

Provision

Draft Personal Data Protection Bill, 2018

Personal Data Protection Bill, 2019

Definition of personal data 

  • Personal data pertains to characteristics, traits or attributes of identity, which can be used to identify an individual.
  • The Bill retains the definition and adds that such characteristics or traits will also include any inference drawn from such data for the purpose of profiling.

Sensitive personal data

  • Sensitive personal data includes personal data related to health, sex life, sexual orientation, financial data, passwords, among others.  
  • The Data Protection Authority can categorise any other personal data as sensitive personal data. 
  • The Bill removes passwords from the category of sensitive personal data.  
  • The power to further categorise personal data as sensitive personal data will lie with the central government (in consultation with Data Protection Authority and the sector regulator concerned).

Rights of individual (data principal)

  • The data principal has certain rights with respect to their data such as obtaining confirmation on whether their data has been processed, seeking correction, transfer, or restriction on continuing disclosure of their data.
  • The Bill provides the right to erasure of personal data which is no longer necessary for the purpose for which it was processed, as an additional right for the data principal.

Non-consensual processing of personal data

  • Personal data may be processed without obtaining the consent of the individual on certain grounds.  These include: (i) any function of Parliament or state legislature, (ii) if required by the State for providing benefits to the individual, and (iii) for reasonable purposes specified by the Authority, such as fraud detection, debt recovery, and whistle blowing.   
  • The Bill removes the provision on any function of Parliament or state legislature as a ground for non-consensual processing of personal data. 
  • The Bill adds ‘operation of search engines’ as a reasonable purpose for which non-consensual processing of personal data may be allowed by the Authority.

Social media intermediaries

  • The draft Bill did not contain this term.
  • The Bill defines a social media intermediary as an intermediary which enables online interaction between users and allows for sharing of information.  
  • All social media intermediaries which are classified as significant data fiduciaries (fiduciaries with users above a notified threshold whose actions can impact electoral democracy or public order) must provide a voluntary user verification mechanism for all users in India. 

Exemptions for the government for processing of personal data 

  • The State is exempted from the provisions of the Bill while processing personal data in the interest of national security.     However, such processing must be permitted by a law and must be proportionate to the interests being achieved.  Further, such processing must be done in a fair and reasonable manner. 
  • The government can exempt any of its agencies from any or all provisions of the Act, for processing of personal data in certain cases.     These include: (i) in interest of security of state, public order, sovereignty and integrity of India and friendly relations with foreign states, and (ii) for preventing incitement to commission of any cognisable offence relating to the above matters.

Exemptions for manual processing by small entities

  • Transparency and accountability measures and certain other obligations will not apply to small entities.  These are fiduciaries which: (i) have annual turnover below Rs 20 lakh (or such lower amount as prescribed), and (ii) did not process data of more than 100 individuals in any one day in the last year.
  • The Bill retains the exemption for small entities.     However, it does away with the prescribed limits and allows the Authority to classify fiduciaries as small entities based on the annual turnover of fiduciary and the volume of data processed by such fiduciary. 

Transfer of personal data outside country

 

  • One serving copy of all personal data should be stored in India. 
  • The Bill removes the provision for mandatory storage of all personal data in the country.  It provides that sensitive personal data must continue to be stored in India.  Such data can be transferred outside India if explicitly consented by the individual, and subject to certain additional conditions.

Composition of Data Protection Authority of India

  • The chairperson and members of the Authority will be appointed by the central government on the recommendations of a selection committee.  The selection committee will be comprised of: (i) Chief Justice of India or a Judge of Supreme Court as the chairperson, (ii) Cabinet Secretary, and (iii) an expert in field of data protection, information technology and related subjects.
  • The Bill provides that the selection committee will be comprised of: (i) Cabinet Secretary as the chairperson, (ii) Secretary, Department of Legal Affairs, and (iii) Secretary, Ministry of Electronics and Information Technology. 

Offences and penalties 

  • Under the Bill, offences such as: (i) obtaining, disclosing, transferring, or selling personal data in contravention of the Act, and (ii) re-identification and processing of de-identified personal data (data from which identifiers have been removed) without consent, are punishable with imprisonment. 
  • Under the Bill, re-identification and processing of de-identified personal without consent is the only offence punishable with imprisonment.  

Non-personal and anonymised personal data

  • No provision of the Bill would apply to non-personal data used by government for formulation of policies for digital economy, growth or security. 
  • The Bill retains the provision and further provides that the government can direct data fiduciaries to provide it any: (i) non-personal data and (ii) anonymised personal data (where it is not possible to identify data principal) for better targeting of services and formulation of evidence-based policy.

Sources: The Draft Personal Data Protection Bill, 2018; The Personal Data Protection Bill, 2019; PRS. 

Read More
Legislation

Explainer: The Citizenship (Amendment) Bill, 2019

Roshni Sinha - December 9, 2019

The Minister of Home Affairs introduced the Citizenship (Amendment) Bill, 2019 today in Lok Sabha.   It is scheduled to be taken up for discussion and passing by the House later today.  The Bill amends the Citizenship Act, 1955, and seeks to make foreign illegal migrants of certain religious communities coming from Afghanistan, Bangladesh, and Pakistan eligible for Indian citizenship.  In this blog, we look at the criteria for determining citizenship in India, discuss how the Bill proposes to change the criteria, and highlight other key changes proposed by the Bill. 

How is citizenship acquired in India?

In India, citizenship is regulated by the Citizenship Act, 1955.  The Act specifies that citizenship may be acquired in India through five methods – by birth in India, by descent, through registration, by naturalisation (extended residence in India), and by incorporation of territory into India. [1]  

Can illegal migrants acquire citizenship?

An illegal migrant is prohibited from acquiring Indian citizenship.  An illegal immigrant is a foreigner who either enters India illegally, i.e., without valid travel documents, like a visa and passport, or enters India legally, but stays beyond the time period permitted in their travel documents.  An illegal migrant can be prosecuted in India, and deported or imprisoned.   

In September 2015 and July 2016, the central government exempted certain groups of illegal migrants from being imprisoned or deported. [2]  These are illegal migrants who came into India from Afghanistan, Bangladesh, or Pakistan on or before December 31, 2014, and belong to the Hindu, Sikh, Buddhist, Jain, Parsi, or Christian religious communities.  

How does the Bill seek to change the criteria for determining citizenship?

The Bill proposes that the specified class of illegal migrants from the three countries will not be treated as illegal migrants, making them eligible for citizenship.  On acquiring citizenship, such migrants shall be deemed to be Indian citizens from the date of their entry into India and all legal proceedings regarding their status as illegal migrants or their citizenship will be closed.

The Act allows a person to apply for citizenship by naturalisation, if the person meets certain qualifications.  One of the qualifications is that the person must have resided in India or been in central government service for the last 12 months and at least 11 years of the preceding 14 years.  For the specified class of illegal migrants, the number of years of residency has been relaxed from 11 years to five years.  

Are the provisions of the Bill applicable across the country?

The Bill clarifies that the proposed amendments on citizenship to the specified class of illegal migrants will not apply to certain areas.  These are: (i) the tribal areas of Assam, Meghalaya, Mizoram, and Tripura, as included in the Sixth Schedule to the Constitution, and (ii) the states regulated by the “Inner Line” permit under the Bengal Eastern Frontier Regulations 1873.  These Sixth Schedule tribal areas include Karbi Anglong (in Assam), Garo Hills (in Meghalaya), Chakma District (in Mizoram), and Tripura Tribal Areas District.   Further, the Inner Line Permit regulates visit of all persons, including Indian citizens, to Arunachal Pradesh, Mizoram, and Nagaland.

Is the differentiation among the specified class of illegal migrants and all other illegal migrants reasonable?

The Bill makes only certain illegal migrants eligible for citizenship.  These are persons belonging to the six specified religious communities, from the three specified countries, who entered India on or before December 31, 2014, and do not reside in the Sixth Schedule areas or in the states regulated by the Inner Line Permit states.  This implies that all other illegal migrants will not be able to claim the benefit of citizenship conferred by the Bill, and may continue to be prosecuted as illegal migrants.  Any provision which distinguishes between two groups may violate the standard of equality guaranteed under Article 14 of the Constitution, unless one can show a reasonable rationale for doing so. [3]   The Bill provides differential treatment to illegal migrants on the basis of (a) their country of origin, (b) religion, (c) date of entry into India, and (d) place of residence in India.   The question is whether these factors serve a reasonable purpose to justify the differential treatment.  We examine this below. 

The Bill classifies migrants based on their country of origin to include only Afghanistan, Pakistan and Bangladesh.  While the Statement of Objects and Reasons (SoR) in the Bill reasons that millions of citizens of undivided India were living in Pakistan and Bangladesh, no reason has been provided to explain the inclusion of Afghanistan.  The SoR also states that these countries have a state religion, which has resulted in religious persecution of minority groups.  However, there are other countries which may fit this qualification.   For instance, two of India’s neighboring countries, Sri Lanka (Buddhist state religion) [4] and Myanmar (primacy to Buddhism) [5], have had a history of persecution of Tamil Eelams (a linguistic minority in Sri Lanka), and the Rohingya Muslims, respectively. [6], [7], [8]   

Further, there are other religious minorities from Pakistan, Afghanistan and Bangladesh, such as the Ahmadiyya Muslims in Pakistan (considered non-Muslims in that country) [9], and atheists in Bangladesh [10] who have faced religious persecution and may have illegally migrated to India.  Given that the objective of the Bill is to provide citizenship to migrants escaping from religious persecution, it is not clear why illegal migrants belonging to other neighbouring countries, or belonging to religious minorities from these three specified countries, have been excluded from the Bill.  

The Bill also creates further differentiation between the specified class of illegal migrants based on when they entered India (before or after December 31, 2014), and where they live in India (provisions not applicable to Sixth Schedule and Inner Line Permit areas).  However, the reasons provided to explain the distinction is unclear.  Note that certain restrictions apply to persons (both citizens and foreigners) in the Sixth Schedule areas and in the states regulated by the Inner Line Permit.  Once an illegal migrant residing in these areas acquires citizenship, he would be subject to the same restrictions in these areas, as are applicable to other Indian citizens.  Therefore, it is unclear why the Bill excludes illegal migrants residing in these areas. 

How does the Bill change the regulations for Overseas Citizens of India?

The Bill also amends the provisions on registration of Overseas Citizens of India (OCI). OCI cardholders are foreigners who are persons of Indian origin. For example, they may have been former Indian citizens, or children of current Indian citizens. An OCI enjoys benefits such as the right to travel to India without a visa, or to work and study here.  At present, the government may cancel a person’s OCI registration on various grounds specified in the Act.  In case of a cancellation, an OCI residing in India may be required to leave the country. The Bill adds another ground for cancelling OCI registration — violation of any law notified by the central government.  However, the Bill does not provide any guidance on the nature of laws which the central government may notify.  The Supreme Court has noted that this guidance is necessary to set limits on the authority’s powers and to avoid any arbitrariness in exercise of powers. [11]    Therefore, the powers given to the government under the Bill may go beyond the permissible limits of valid delegation. 

Note:  The blog has been updated to remove the following issue: “Second, the Bill delegates the power to notify laws and not offences.  This may result in the cancellation of OCI for minor violations.  For instance, the government may want to cancel the registration of an OCI who is found guilty of sedition, under the Indian Penal Code, 1861.  However, since the government cannot notify one offence, it will need to notify the entire Indian Penal Code, which would include minor offences such as rash and negligent driving.” 

[1].  Section 2(1)(b) of the Citizenship Act, 1955.

[2].  State of West Bengal vs Anwar Ali Sarkar, AIR 1952 SC 75.  

[3].  State of West Bengal vs Anwar Ali Sarkar, AIR 1952 SC 75.  

[4].  Article 9 of the Constitution of the Democratic Socialist Republic of Sri Lanka states: “The Republic of Sri Lanka shall give to Buddhism the foremost place and accordingly it shall be the duty of the State to protect and foster the Buddha Sasana, while assuring to all religions the rights granted by Articles 10 and 14(1)(e).”

[5].  Articles 361 and 362 of the Constitution of the Republic of the Union of Myanmar state the following.  “361. The Union recognizes special position of Buddhism as the faith professed by the great majority of the citizens of the Union. 362. The Union also recognizes Christianity, Islam, Hinduism and Animism as the religions existing in the Union at the day of the coming into operation of this Constitution.”

[6]. It is estimated that there are over a lakh Sri Lankan refugees in India, two-thirds of them in government camps.  See https://timesofindia.indiatimes.com/city/chennai/why-lankan-refugees-are-reluctant-to-go-back-home/articleshow/65591130.cms

[7]. “Myanmar Rohingya: What you need to know about the crisis”, BBC News, April 24, 2018, https://www.bbc.com/news/world-asia-41566561.

[8]. “Why India is refusing refuge to Rohingyas”, Times of India, September 6, 2017, https://timesofindia.indiatimes.com/india/why-india-is-refusing-refuge-to-rohingyas/articleshow/60386974.cms.

[9].  The Second Amendment to the Constitution of Pakistan passed in 1974 effectively declared Ahmaddiyas as non-Muslims. 

[10].  For example, see https://www.theguardian.com/world/2016/jun/11/bangladesh-murders-bloggers-foreigners-religion.

[11].  Hamdard Dawakhana and Anr., v. The Union of India (UOI) and Ors., AIR1960SC554; Confederation of Indian Alcoholic Beverage Companies and Ors. vs. The State of Bihar and Ors., 2016(4) PLJR369. 

Read More
  • «
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • »

Recent Posts

  1. 1. A note of gratitude to Mr. N. Vaghul
  2. 2. What is Fuelling Power Sector Losses?
  3. 3. First no-confidence motion of the 17th Lok Sabha discussed today
  4. 4. Anti-cheating laws for competitive examinations
  5. 5. Uttarakhand Assembly concludes 2-day session; 13 Bills introduced and passed

Follow Us

Creative Commons License

PRS Legislative Research is licensed under a Creative Commons Attribution 4.0 International License

Disclaimer: This data is being furnished to you for your information. PRS makes every effort to use reliable and comprehensive information, but PRS does not represent that this information is accurate or complete. PRS is an independent, not-for-profit group. This data has been collated without regard to the objectives or opinions of those who may receive it.

  • About Us
  • Careers
Copyright © 2026    prsindia.org    All Rights Reserved.