New Provisions for Startups in the Data Protection Bill

The Digital Personal Data Protection Bill is a piece of legislation that frames the rights and duties of the citizens (Digital Nagrik) on the one hand and the obligations of the Data Fiduciary to use collected data lawfully on the other.

The modified version of the draught digital personal data protection (DPSP) bill has brought reason for cheer in the startup ecosystem with relaxations for cross-border data transfer, the removal of non-personal data, and certain other exemptions.

According to this new, revised version of the 24-page document, which is a legal framework for collecting and processing personal digital data, the users will be given an itemised notice before the collection of their data. The draught has also prescribed additional obligations for significant data fiduciaries. 

These significant fiduciaries will be determined by the volume and sensitivity of the data and also based on the risk of harm to the users. This risk-based approach used to define this significant data fiduciary instead of the volume-based criteria will be very beneficial for the startups.

In the words of Rohit Kumar, a legal expert and founding partner of THQ Consulting, “There are many startups that have a lot of users on the platform but not enough active users.” The risk of harm on this platform is also lower. So, generally speaking, this approach can benefit such platforms. On the face of it, the bill is industry-friendly and does take into account some concerns from startups.

The draught bill prescribes financial penalties up to INR 250 cr for failing to take security safeguards to prevent personal data breaches.

The country’s startups are exempt from certain provisions of the revamped data protection bill to ease their compliance burden. The new law might also have a regulatory sandbox for startups, which would allow them to operate for a certain period of time without having to adhere to the provisions of the law.