Introduction
A new data protection law is on the anvil and all stakeholders
are keenly awaiting the outcome of the consultation process for the
draft Personal Data Protection Bill, 2019, recently initiated by
the Joint Parliamentary Committee. Even after the new data privacy
law is enacted, it is likely to take at least a year, if not more,
for the infrastructure required to implement the new law to be put
in place. Therefore, it will be an useful exercise to review and
understand India's existing data privacy law which can be found
in the form of the Information Technology (Reasonable Security
Practices and Procedures and Sensitive Personal Data or
Information) Rules, 2011 ("2011 Rules").
The 2011 Rules have been framed under Section 43A of the
Information Technology Act, 2000 ("IT
Act").
