The Personal Data Protection Bill, 2019 ("PDP
Bill"), which was presented before the lower house of
the Indian Parliament on December 11, 2019, seeks to provide for
the protection of personal data of individuals and establish a Data
Protection Authority ("DPA"). The PDP
Bill has been referred to a joint select committee of both the
houses of the Indian Parliament, which is expected to submit its
report in early 2020. Accordingly, there may be changes to the PDP
Bill based on the recommendations of the joint select committee.
Once enacted, the PDP Bill will replace Section 43 of the
Information Technology Act, 2000 and the Information Technology
(Reasonable Security Practices and Procedures and Sensitive
Personal Data or Information) Rules, 2011 and prevail over any
other inconsistent laws in this regard (e.g., any
sector-specific laws).
