February 25, 2026

Draft Data Protection Bill Needs More Clarity And Less Government Control

By Our Editorial Team
First publised on 2022-11-21 03:38:38

About the Author

The India Commentary view

View all posts by this Author

In this age of technical innovations, the government has to learn to regulate with flexibility and realize that a level playing field means that it does not appropriate extraordinary powers. It is in this respect that the draft Digital Personal Data Protection Bill, 2022, though a vast improvement on the 2019 Bill, is fouund wanting. 

The new Bill, uploaded for public consultations and likely to be introduced in the winter session of Parliament, has been reduced to just 30 sections (instead of 99 earlier) and has tried to address the concerns of the industry and civil society. The Bill is centred entirely on personal data, allows restricted cross-border flow of data and removes the categorization of data into sensitive and critical (which, by the way, will allow flow of all data across borders). However, some terms used are vague and certain sections lack clarity.

The Bill proposes to have a Data Protection Board as regulator which will under total control of the Centre. It will appoint the members, set out terms and conditions of appointment and decide their functions. Also, the government, through notification, can exempt its departments from seeking consent from users to store data. The users will be 'deemed' to have given consent as and when they choose to register on notified government sites. The government departments can then store and use this personal data in any which way they think fit.

This is not correct. Although the remit of Data Protection Board has been narrowed considerably than what was envisaged for the earlier Data Protection Authority, its members must still be appointed by an expert committee (as proposed in the earlier Bill) and must include experts from industry and civil society. Further, the government must also seek consent from users to store and use their personal data. No exemption must be allowed to any government department in this regard.