Sep 26,2022 | 7 min read

Legislation on data protection is long overdue—know why, and its current status

What is data protection and why is it needed?

Data protection generally refers to formulating robust governmental policies and legislations to regulate the collection, storage, and circulation of data. This is done to maintain the privacy of an individual. In the contemporary world, data is highly weaponizable and prone to misuse. A benign online shopping experience can turn into a nightmare when malicious persons steal bank account information and other private details. Data protection helps in the prevention of infringement of privacy or the leak of sensitive information. Moreover, data stored online can be used by enemy forces to plan and coordinate an offense. 

Hence, regulation of the flow of information and its protection is highly important for any country. Many countries have realized its importance and have implemented legislation for the same, e.g., European Union has formulated GDPR.

What is the status of such a law in India?

A data protection law is long overdue in India. India currently does not have a single, all-encompassing statute for the same. The government relies on the Information Technology Act, 2000, and the (Indian) Contract Act, 1872. 

But that soon changed when a high-level expert group headed by former Supreme Court Judge BN Sri Krishna put together the Personal Data Protection Bill, 2018. It was tabled in the Lok Sabha in 2019 and immediately sent to a joint parliamentary committee. The JPC recently put forward 81 amendments and 12 major recommendations, due to which, it was withdrawn. 

In the words of the Union Electronics and Information Technology Minister Ashwini Vaishnav, "Considering the report of the JCP, a comprehensive legal framework is being worked upon Hence, in the circumstances, it is proposed to withdraw 'The Personal Data Protection Bill, 2019' and present a new bill that fits into the comprehensive legal framework,". 

The constitutional validity of the right to privacy and the contents of the bill

The constitution does not explicitly grant the right to privacy, but recently, in the landmark case of Justice K S Puttaswamy (Retd.) & Anr. vs. Union of India and Ors., the constitution bench of the Hon'ble Supreme Court has held the Right to Privacy as a fundamental right, subject to certain reasonable restrictions.

The bill proposes far-reaching changes in users’ data collection, storage, and dissemination by social media companies. It proposes to set up a Data Protection Authority (DPA) that will oversee the use of users’ data by social media companies. The bill proposes these companies create a mechanism so that “every user who registers their service from India or uses their service from India, a voluntary verifiable account mechanism has to be made". This is added mainly to check online trolling. The bill classifies data into three categories—critical, sensitive, and general. Sensitive data include financial, health, sexual orientation, biometrics, transgender status, religious or political beliefs, and affiliation. Such data can be stored only in India. 

The bottom line

The constitution sanction of the right to privacy has put into motion a new era of legislation that will protect the online presence of the people of India. It will further restrict social media companies from manipulating users’ data for monetary motives. It will also strengthen India's national security as the most vulnerable and gullible will be protected under the act.


Need Free Legal Advice or Assistance Online?

For any Other related matter, please Post Your Requirement anonymously and get free proposals OR find the Best Lawyers and book a free appointment directly.


Comparing Employment Laws of UK and US

Understanding the Concept of Bail in India

Compliance and Regulatory of Startups

Summarizing the Event of Mass Lay-offs around the World with Special Focus on Indian Labour Laws

Scope of Interim Relief Post Arbitral Award and Enforcement of Arbitral Award when all the parties to the Arbitration proceeding challenge the Arbitral Award




Settlement in Divorce Law with Mutual Consent


Vidyut Bedekar

am the co-founder of TLA [Tree of Life Associates], a boutique law firm with depth of understanding and domain expertise in Technology & Outsourcing, IP, Privacy law, Labour & Employment matters, and Start-Up legal offerings. My focused domains are Corporate and Commercial laws, M&A, Laws relating to in-bound and out-bound investment, IP, in specific trademark and copyright law and start-up investments and I am the Practice Head of these areas at TLA, Bangalore.