{"id":4584,"date":"2018-07-29T21:32:04","date_gmt":"2018-07-29T16:02:04","guid":{"rendered":"https:\/\/beluru.com\/?p=4584"},"modified":"2025-05-19T17:11:53","modified_gmt":"2025-05-19T11:41:53","slug":"read-the-personal-data-protection-bill-2018","status":"publish","type":"post","link":"https:\/\/www.xn--4scekqbpyn4fbh2dwe.xn--2scrj9c\/?p=4584","title":{"rendered":"READ: THE PERSONAL DATA PROTECTION BILL, 2018"},"content":{"rendered":"<p><strong>THE PERSONAL DATA PROTECTION BILL, 2018<\/strong><\/p>\n<p><strong>CHAPTER I <\/strong><\/p>\n<p><strong>PRELIMINARY<\/strong><\/p>\n<p><!--more--><\/p>\n<p><a href=\"https:\/\/beluru.com\/wp-content\/uploads\/2018\/07\/PDPB-1.jpg\"><img fetchpriority=\"high\" decoding=\"async\" class=\"alignnone size-large wp-image-4586\" src=\"https:\/\/beluru.com\/wp-content\/uploads\/2018\/07\/PDPB-1-1024x673.jpg\" alt=\"\" width=\"800\" height=\"526\" \/><\/a><\/p>\n<ol>\n<li>Short title, extent and commencement.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;.. 1<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"2\">\n<li>Application of the Act to processing of personal data.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;.. 1<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"3\">\n<li>Definitions.\u2014 In this Act, unless the context otherwise requires, \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;.. 2<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p><strong>CHAPTER II<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p><strong>DATA PROTECTION OBLIGATIONS<\/strong><\/p>\n<p>&nbsp;<\/p>\n<ol start=\"4\">\n<li>Fair and reasonable processing.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 6<\/li>\n<li>Purpose limitation.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 6<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"6\">\n<li>Collection limitation. \u2014. &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 7<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"7\">\n<li>Lawful processing.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 7<\/li>\n<li>Notice.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 7<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"9\">\n<li>Data quality.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 8<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"10\">\n<li>Data storage limitation.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 8<\/li>\n<li>Accountability.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 9<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p><strong>CHAPTER III<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p><strong>G<\/strong><strong>ROUNDS FOR PROCESSING OF PERSONAL DATA<\/strong><\/p>\n<p>&nbsp;<\/p>\n<ol start=\"12\">\n<li>Processing of personal data on the basis of consent.\u2014&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 9<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"13\">\n<li>Processing of personal data for functions of the State. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 10<\/li>\n<li>Processing of personal data in compliance with law or any order of any court or tribunal. \u2014<\/li>\n<\/ol>\n<p>10<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"15\">\n<li>Processing of personal data necessary for prompt action. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 10<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"16\">\n<li>Processing of personal data necessary for purposes related to employment. \u2014&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 10<\/li>\n<li>Processing of data for reasonable purposes. \u2014&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;.. 11<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p><strong>CHAPTER IV<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p><strong>G<\/strong><strong>ROUNDS FOR PROCESSING OF SENSITIVE PERSONAL DATA<\/strong><\/p>\n<p>&nbsp;<\/p>\n<ol start=\"18\">\n<li>Processing of sensitive personal data based on explicit consent. \u2014&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 11<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"19\">\n<li>Processing of sensitive personal data for certain functions of the State. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 12<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"20\">\n<li>Processing of sensitive personal data in compliance with law or any order of any court or tribunal. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 12<\/li>\n<li>Processing of certain categories of sensitive personal data for prompt action. \u2014&#8230;&#8230;&#8230;&#8230;&#8230; 12<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>i<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"22\">\n<li>Further categories of sensitive personal data.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 13<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p><strong>CHAPTER V<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p><strong>P<\/strong><strong>E<\/strong><strong>RSONAL AND SENSITIVE PERSONAL DATA OF CHILDREN<\/strong><\/p>\n<p>&nbsp;<\/p>\n<ol start=\"23\">\n<li>Processing of personal data and sensitive personal data of children. \u2014&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 13<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p><strong>CHAPTER VI<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p><strong>DATA PRINCIPAL RIGHTS<\/strong><\/p>\n<p>&nbsp;<\/p>\n<ol start=\"24\">\n<li>Right to confirmation and access. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;.. 14<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"25\">\n<li>Right to correction, etc.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 14<\/li>\n<li>Right to Data Portability. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 15<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"27\">\n<li>Right to Be Forgotten. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;.. 16<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"28\">\n<li>General conditions for the exercise of rights in this Chapter. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;.. 16<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p><strong>CHAPTER VII<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p><strong>T<\/strong><strong>RANSPARENCY AND ACCOUNTABILITY MEASURES<\/strong><\/p>\n<p>&nbsp;<\/p>\n<ol start=\"29\">\n<li>Privacy by Design. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 17<\/li>\n<li>Transparency. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 18<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"31\">\n<li>Security Safeguards.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 18<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"32\">\n<li>Personal Data Breach.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 18<\/li>\n<li>Data Protection Impact Assessment. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 19<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"34\">\n<li>Record-Keeping. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 20<\/li>\n<li>Data Audits. \u2014&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 20<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"36\">\n<li>Data Protection Officer. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;.. 21<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"37\">\n<li>Processing by entities other than data fiduciaries. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 22<\/li>\n<li>Classification of data fiduciaries as significant data fiduciaries. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 22<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"39\">\n<li>Grievance Redressal. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 23<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p><strong>CHAPTER VIII<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p><strong>T<\/strong><strong>RANSFER OF PERSONAL DATA OUTSIDE <\/strong><strong>I<\/strong><strong>NDIA<\/strong><\/p>\n<ol start=\"40\">\n<li>Restrictions on Cross-Border Transfer of Personal Data. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;.. 23<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"41\">\n<li>Conditions for Cross-Border Transfer of Personal Data. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 24<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p><strong>CHAPTER IX<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p><strong>E<\/strong><strong>X<\/strong><strong>EM<\/strong><strong>P<\/strong><strong>T<\/strong><strong>IONS<\/strong><\/p>\n<ol start=\"42\">\n<li>Security of the State.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;.. 25<\/li>\n<li>Prevention, detection, investigation and prosecution of contraventions of law.\u2014 &#8230;&#8230;&#8230;&#8230;.. 25<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"44\">\n<li>Processing for the purpose of legal proceedings.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 26<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"45\">\n<li>Research, archiving or statistical purposes. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;.. 27<\/li>\n<li>Personal or domestic purposes. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 27<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"47\">\n<li>Journalistic purposes.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 28<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"48\">\n<li>Manual processing by small entities.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 28<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p><strong>CHAPTER X<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p><strong>D<\/strong><strong>ATA <\/strong><strong>P<\/strong><strong>R<\/strong><strong>O<\/strong><strong>TE<\/strong><strong>CTION <\/strong><strong>A<\/strong><strong>UTHORITY OF <\/strong><strong>I<\/strong><strong>NDIA<\/strong><\/p>\n<ol start=\"49\">\n<li>Establishment and incorporation of Authority.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 29<\/li>\n<li>Composition and qualifications for appointment of members.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 29<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"51\">\n<li>Terms and conditions of appointment.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;.. 30<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"52\">\n<li>Removal of members.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 30<\/li>\n<li>Powers of the chairperson.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;.. 31<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"54\">\n<li>Meetings of the Authority.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;.. 31<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"55\">\n<li>Vacancies, etc. not to invalidate proceedings of the Authority.\u2014&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 31<\/li>\n<li>Officers and Employees of the Authority.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;.. 31<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"57\">\n<li>Grants by Central Government.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 32<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"58\">\n<li>Accounts and Audit \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 32<\/li>\n<li>Furnishing of returns, etc. to Central Government.\u2014&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 32<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"60\">\n<li>Powers and Functions of the Authority.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 33<\/li>\n<li>Codes of Practice.\u2014&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 35<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"62\">\n<li>Power of Authority to issue directions.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 36<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"63\">\n<li>Power of Authority to call for information.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 37<\/li>\n<li>Power of Authority to conduct inquiry. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;.. 37<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"65\">\n<li>Action to be taken by Authority pursuant to an inquiry.\u2014&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;.. 38<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"66\">\n<li>Search and Seizure.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 39<\/li>\n<li>Coordination between the Authority and other regulators or authorities.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 40<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"68\">\n<li>Appointment of Adjudicating Officer.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;.. 41<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p><strong>CHAPTER XI PENALTIES AND REMEDIES<\/strong><\/p>\n<ol start=\"69\">\n<li>Penalties.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;.. 41<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"70\">\n<li>Penalty for failure to comply with data principal requests under Chapter VI.\u2014&#8230;&#8230;&#8230;&#8230;&#8230;.. 42<\/li>\n<li>Penalty for failure to furnish report, returns, information, etc.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 42<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"72\">\n<li>Penalty for failure to comply with direction or order issued by the Authority.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230; 43<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"73\">\n<li>Penalty for contravention where no separate penalty has been provided.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;.. 43<\/li>\n<li>Adjudication by Adjudicating Officer.\u2014&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;.. 43<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"75\">\n<li>Compensation.\u2014&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 44<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"76\">\n<li>Compensation or penalties not to interfere with other punishment.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;.. 45<\/li>\n<li>Data Protection Funds.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;.. 45<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"78\">\n<li>Recovery of Amounts.\u2014&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 46<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p><strong>CHAPTER XII APPELLATE TRIBUNAL<\/strong><\/p>\n<ol start=\"79\">\n<li>Establishment of Appellate Tribunal.\u2014&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 47<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"80\">\n<li>Qualifications, appointment, term, conditions of service of members.\u2014&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 48<\/li>\n<li>Vacancies.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 48<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"82\">\n<li>Staff of Appellate Tribunal.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 48<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"83\">\n<li>Distribution of business amongst benches.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 48<\/li>\n<li>Appeals to Appellate Tribunal.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 49<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"85\">\n<li>Procedure and powers of Appellate Tribunal.\u2014&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 49<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"86\">\n<li>Orders passed by Appellate Tribunal to be executable as a decree.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;.. 50<\/li>\n<li>Appeal to Supreme Court of India.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 50<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"88\">\n<li>Right to legal representation.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 50<\/li>\n<li>Civil court not to have jurisdiction.\u2014&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 51<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p><strong>CHAPTER XIII OFFENCES<\/strong><\/p>\n<ol start=\"90\">\n<li>Obtaining, transferring or selling of personal data contrary to the Act.\u2014&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 51<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"91\">\n<li>Obtaining, transferring or selling of sensitive personal data contrary to the Act.\u2014&#8230;&#8230;&#8230;&#8230; 51<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"92\">\n<li>Re-identification and processing of de-identified personal data. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 52<\/li>\n<li>Offences to be cognizable and non-bailable.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 52<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"94\">\n<li>Power to investigate offences.\u2014&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 52<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"95\">\n<li>Offences by companies.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 52<\/li>\n<li>Offences by Central or State Government departments. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 53<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p><strong>CHAPTER XIV TRANSITIONAL PROVISIONS<\/strong><\/p>\n<ol start=\"97\">\n<li>Transitional provisions and commencement. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 54<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p><strong>CHAPTER XV MISCELLANEOUS<\/strong><\/p>\n<ol start=\"98\">\n<li>Power of Central Government to issue directions in certain circumstances. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 55<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"99\">\n<li>Members, etc., to be public servants. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 55<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"100\">\n<li>Protection of action taken in good faith. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;.. 55<\/li>\n<li>Exemption from tax on income. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 55<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"102\">\n<li>Delegation. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;.. 55<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"103\">\n<li>Power to remove difficulties. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 56<\/li>\n<li>Power to exempt certain data processors.\u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 56<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"105\">\n<li>No application to non-personal data&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;.. 56<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"106\">\n<li>Bar on processing certain forms of biometric data&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 56<\/li>\n<li>Power to make rules. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;.. 56<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"108\">\n<li>Power to make regulations. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 58<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"109\">\n<li>Rules and Regulations to be laid before Parliament.\u2014&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230; 59<\/li>\n<li>Overriding effect of this Act. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 60<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"111\">\n<li>Amendment of Act 21 of 2000. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 60<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<ol start=\"112\">\n<li>Amendment of Act 22 of 2005. \u2014 &#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 60<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p><strong>T<\/strong><strong>H<\/strong><strong>E FIRST SCHEDULE <\/strong><strong>&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 61<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p><strong>T<\/strong><strong>H<\/strong><strong>E SECOND SCHEDULE<\/strong><strong>&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;&#8230;. 62<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p><strong>THE PERSONAL DATA PROTECTION BILL<\/strong><strong>, 2018<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>WHEREAS the right to privacy is a fundamental right and it is necessary to protect personal data as an essential facet of informational privacy;<\/p>\n<p>&nbsp;<\/p>\n<p>WHEREAS the growth of the digital economy has meant the use of data as a critical means of communication between persons;<\/p>\n<p>&nbsp;<\/p>\n<p>WHEREAS it is necessary to create a collective culture that fosters a free and fair digital economy, respecting the informational privacy of individuals, and ensuring empowerment, progress and innovation;<\/p>\n<p>&nbsp;<\/p>\n<p>AND WHEREAS it is expedient to make provision: toprotect the autonomy of individuals in relation with their personal data, to specify where the flow and usage of personal data is appropriate, to create a relationship of trust between persons and entities processing their personal data, to specify the rights of individuals whose personal data are processed, to create a framework for implementing organisational and technical measures in processing personal data, to lay down norms for cross-border transfer of personal data, \u00a0to \u00a0ensure \u00a0the \u00a0accountability \u00a0of \u00a0entities \u00a0processing \u00a0personal \u00a0data, \u00a0to \u00a0provide \u00a0remedies \u00a0for unauthorised and harmful processing, and to establish a Data Protection Authority for overseeing processing activities;<\/p>\n<p>&nbsp;<\/p>\n<p>BE IT ENACTED by Parliament in the Sixty-Ninth Year of the Republic of India as follows: <em>\u2014<\/em><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p><strong>CHAPTER I PRELIMINARY<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol>\n<li><strong> Short title, extentand commencement.\u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0\u00a0 This Act may be called the Personal Data Protection Act, 2018. (2)\u00a0\u00a0 It extends to the whole of India.<\/p>\n<p>(3)\u00a0\u00a0\u00a0 \u00a0The provisions of Chapter XIV of this Act shall come into force on such date, as the Central Government may by notification appointand the remaining provisions of the Act shall come into force in accordance with the provisions in that Chapter.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"2\">\n<li><strong> Application of the Act to processing of personal data.\u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0\u00a0 This Act applies to the following\u2014<\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 processing of personal data where such data has been collected, disclosed, shared or otherwise processed within the territory of India; and<\/p>\n<p>&nbsp;<\/p>\n<p>(b)\u00a0\u00a0\u00a0\u00a0 processing of personal data by the State, any Indian company, any Indian citizen or any person or body of persons incorporated or created under Indian law.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0 \u00a0Notwithstanding anything contained insub-section (1), the Act shall apply to the processing of personal data by data fiduciaries or data processors not present within the territory of India, only if such processing is \u2014<\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 in connection with any business carried on in India, or any systematic activity of offering goods or services to data principals within the territory of India; or<\/p>\n<p>&nbsp;<\/p>\n<p>(b)\u00a0\u00a0\u00a0\u00a0 in connection with any activity which involves profiling of data principals within the territory of India.<\/p>\n<p>&nbsp;<\/p>\n<p>(3)\u00a0\u00a0\u00a0 \u00a0Notwithstanding anything contained in sub-sections (1) and (2), the Act shall not apply to processing ofanonymised data.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"3\">\n<li><strong> Definitions.\u2014In this Act, unless the context otherwise requires, \u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0 \u00a0<strong>\u201cAadhaar number\u201d<\/strong>shall have the meaning assigned to it under clause (a) of section 2 of the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 (18 of 2016);<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0\u00a0 <strong>\u201cAdjudicating Officer\u201d <\/strong>means an officer of the adjudication wing under section 68;<\/p>\n<p>&nbsp;<\/p>\n<p>(3)\u00a0\u00a0\u00a0 \u00a0<strong>\u201cAnonymisation\u201d<\/strong>in \u00a0relation \u00a0to \u00a0personal \u00a0data, \u00a0means \u00a0the \u00a0irreversible \u00a0process \u00a0of transforming or converting personal data to a form in which a data principal cannot be identified, meeting the standards specified by the Authority.<\/p>\n<p>&nbsp;<\/p>\n<p>(4)\u00a0\u00a0\u00a0 \u00a0\u201c<strong>Anonymised data<\/strong>\u201d means data which has undergone the process of anonymisation under sub-clause (3) of this section;<\/p>\n<p>&nbsp;<\/p>\n<p>(5)\u00a0\u00a0\u00a0\u00a0 <strong>\u201cAppellate Tribunal\u201d<\/strong>means the tribunal notified under Chapter XIIof this Act;<\/p>\n<p>&nbsp;<\/p>\n<p>(6)\u00a0\u00a0\u00a0\u00a0 <strong>\u201cAuthority\u201d <\/strong>means the Data Protection Authority of India established under Chapter X<\/p>\n<p>of this Act;<\/p>\n<p>&nbsp;<\/p>\n<p>(7)\u00a0\u00a0\u00a0 \u00a0<strong>\u201cAutomated \u00a0means\u201d<\/strong>means \u00a0any \u00a0equipment \u00a0capable \u00a0of \u00a0operating \u00a0automatically \u00a0in response to instructions given for the purpose of processing data;<\/p>\n<p>&nbsp;<\/p>\n<p>(8)\u00a0\u00a0\u00a0 \u00a0<strong>\u201cBiometric \u00a0data\u201d<\/strong>means \u00a0facial \u00a0images, \u00a0fingerprints, \u00a0iris \u00a0scans, \u00a0or \u00a0any \u00a0other \u00a0similar personal data resulting from measurements or technical processing operations carried out on physical, physiological, or behavioural characteristics of a data principal, which allow or confirm the unique identification of that natural person;<\/p>\n<p>&nbsp;<\/p>\n<p>(9)\u00a0\u00a0\u00a0\u00a0 <strong>\u201cChild\u201d <\/strong>means a data principal below the age of eighteen years;<\/p>\n<p>&nbsp;<\/p>\n<p>(10)\u00a0 \u00a0<strong>\u201cCode of Practice\u201d<\/strong>means a code of practice issued by the Authority under section 61; (11)\u00a0 \u00a0<strong>\u201cConsent\u201d<\/strong>means consent under section 12;<\/p>\n<p>&nbsp;<\/p>\n<p>(12)\u00a0 \u00a0<strong>\u201cData\u201d<\/strong>means and includes a representation of information, facts, concepts, opinions, or instructions in a manner suitable for communication, interpretation, or processing by humans or by automated means;<\/p>\n<p>&nbsp;<\/p>\n<p>(13)\u00a0 \u00a0<strong>\u201cData fiduciary\u201d<\/strong>means any person, including the State, a company, any juristic entity or any individual who alone or in conjunction with others determines the purpose and means of processing of personal data;<\/p>\n<p>&nbsp;<\/p>\n<p>(14)\u00a0 \u00a0<strong>\u201cData principal\u201d<\/strong>means the natural person to whom the personal data referred to in sub- clause (28) relates;<\/p>\n<p>&nbsp;<\/p>\n<p>(15)\u00a0 \u00a0<strong>\u201cData processor\u201d<\/strong>means any person, including the State, a company, any juristic entity or any individual who processes personal data on behalf of a data fiduciary, but does not include an employee of the data fiduciary;<\/p>\n<p>&nbsp;<\/p>\n<p>(16)\u00a0 \u00a0<strong>\u201cDe-identification\u201d<\/strong>meansthe process by which a data fiduciary or data processor may remove, or mask identifiers from personal data, or replace them with such other fictitious name or code that is unique to an individual but does not, on its own, directly identify the data principal;<\/p>\n<p>&nbsp;<\/p>\n<p>(17)\u00a0 \u00a0<strong>\u201cDisaster\u201d <\/strong>shall have the same meaning assigned to it underclause (d) of section 2 of the<\/p>\n<p>Disaster Management Act, 2005 (53 of 2005);<\/p>\n<p>&nbsp;<\/p>\n<p>(18)\u00a0 \u00a0<strong>\u201cExplicit consent\u201d<\/strong>means consent under section 18;<\/p>\n<p>&nbsp;<\/p>\n<p>(19)\u00a0 \u00a0<strong>\u201cFinancial data\u201d<\/strong>means any number or other personal data used to identify an account opened by, or card or payment instrument issued by a financial institution to a data principal or any personal data regarding the relationship between a financial institution and a data principal including financial status and credit history;<\/p>\n<p>&nbsp;<\/p>\n<p>(20) \u00a0<strong>\u201cGenetic data\u201d<\/strong>means personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the behavioural characteristics, physiology or the health of that natural person and which result,in particular, from an analysis of a biological sample from the natural person in question;<\/p>\n<p>&nbsp;<\/p>\n<p>(21)\u00a0 \u00a0<strong>\u201cHarm\u201d<\/strong>includes\u2014<\/p>\n<p>&nbsp;<\/p>\n<p>(i)\u00a0\u00a0\u00a0\u00a0\u00a0 bodily or mental injury;<\/p>\n<p>&nbsp;<\/p>\n<p>(ii)\u00a0\u00a0\u00a0\u00a0 loss, distortion or theft of identity; (iii)\u00a0\u00a0 financial loss or loss of property, (iv)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 loss of reputation, or humiliation; (v)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 loss of employment;<\/p>\n<p>(vi)\u00a0\u00a0\u00a0 any discriminatory treatment;<\/p>\n<p>&nbsp;<\/p>\n<p>(vii)\u00a0 \u00a0any subjection to blackmail or extortion;<\/p>\n<p>&nbsp;<\/p>\n<p>(viii) \u00a0any \u00a0denial \u00a0or \u00a0withdrawal \u00a0of \u00a0a \u00a0service, \u00a0benefit \u00a0or \u00a0good \u00a0resulting \u00a0from \u00a0an evaluative decision about the data principal;<\/p>\n<p>&nbsp;<\/p>\n<p>(ix)\u00a0\u00a0\u00a0 any restriction placed or suffered directly or indirectly on speech, movement or any other action arising out of a fear of being observed or surveilled; or<\/p>\n<p>&nbsp;<\/p>\n<p>(x)\u00a0\u00a0\u00a0\u00a0 any observation or surveillance that is not reasonably expected by the data principal.<\/p>\n<p>&nbsp;<\/p>\n<p>(22)\u00a0 \u00a0<strong>\u201cHealth data\u201d<\/strong>means data related to the state of physical or mental health of the data principal and includes records regarding the past, present or future state of the health of such data principal, data collected in the course of registration for, or provision of health services, data associating the data principal to the provision of specific health services.<\/p>\n<p>&nbsp;<\/p>\n<p>(23)\u00a0 \u00a0<strong>\u201cIntersex status\u201d<\/strong>means the condition of a data principal who is\u2014<\/p>\n<p>&nbsp;<\/p>\n<p>(i)\u00a0\u00a0\u00a0\u00a0\u00a0 a combination of female or male;<\/p>\n<p>&nbsp;<\/p>\n<p>(ii)\u00a0\u00a0\u00a0\u00a0 neither wholly female nor wholly male; or<\/p>\n<p>&nbsp;<\/p>\n<p>(iii)\u00a0\u00a0\u00a0 neither female nor male.<\/p>\n<p>&nbsp;<\/p>\n<p>(24)\u00a0 \u00a0<strong>\u201cIntra-group schemes\u201d <\/strong>means schemes approved by the Authority under section 41;<\/p>\n<p>&nbsp;<\/p>\n<p>(25)\u00a0 \u00a0<strong>\u201cJournalistic purpose\u201d <\/strong>means any activity intended towards the dissemination through print, electronic or any other media of factual reports, analysis, opinions, views or documentaries regarding\u2014<\/p>\n<p>&nbsp;<\/p>\n<p>(i)\u00a0\u00a0\u00a0\u00a0\u00a0 news, recent or current events; or<\/p>\n<p>&nbsp;<\/p>\n<p>(ii)\u00a0\u00a0\u00a0\u00a0 any other \u00a0information\u00a0 which \u00a0the \u00a0data \u00a0fiduciary believes \u00a0the \u00a0public, \u00a0or \u00a0any significantly discernible class of the public, to have an interest in;<\/p>\n<p>&nbsp;<\/p>\n<p>(26)\u00a0 \u00a0<strong>\u201cNotification\u201d \u00a0<\/strong>means \u00a0a \u00a0notification \u00a0published \u00a0in \u00a0the \u00a0Official \u00a0Gazette \u00a0and \u00a0the \u00a0term<\/p>\n<p>\u201cnotify\u201d shall be construed accordingly;<\/p>\n<p>&nbsp;<\/p>\n<p>(27) \u00a0<strong>\u201cOfficial identifier\u201d <\/strong>means any number, code, or other identifier, including Aadhaar number, assigned to a data principal under a law made by Parliament or any State Legislature \u00a0which \u00a0may\u00a0 be \u00a0used \u00a0for \u00a0the \u00a0purpose \u00a0of \u00a0verifying\u00a0 the \u00a0identity\u00a0 of \u00a0a \u00a0data principal;<\/p>\n<p>&nbsp;<\/p>\n<p>(28)\u00a0 \u00a0<strong>\u201cPerson\u201d<\/strong>means\u2014<\/p>\n<p>&nbsp;<\/p>\n<p>(i)\u00a0\u00a0\u00a0\u00a0\u00a0 an individual,<\/p>\n<p>(ii)\u00a0\u00a0\u00a0\u00a0 a Hindu undivided family, (iii)\u00a0\u00a0 a company,<\/p>\n<p>&nbsp;<\/p>\n<p>(iv)\u00a0\u00a0\u00a0 a firm,<\/p>\n<p>(v)\u00a0\u00a0\u00a0\u00a0 an association of persons or a body of individuals, whether incorporated or not, (vi)\u00a0\u00a0\u00a0 the State, and<\/p>\n<p>(vii)\u00a0 \u00a0every artificial juridical person, not falling within any of the preceding sub- clauses;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>(29) \u00a0<strong>\u201cPersonal data\u201d<\/strong>means data about or relating to a natural person who is directly or indirectly identifiable, having regard to any characteristic, trait, attribute or any other feature of the identity of such natural person, or any combination of such features, or any combination of such features with any other information;<\/p>\n<p>&nbsp;<\/p>\n<p>(30)\u00a0 \u00a0<strong>\u201cPersonal data breach\u201d <\/strong>means any unauthorised or accidental disclosure, acquisition, sharing, use, alteration, destruction, loss of access to, of personal data that compromises the confidentiality, integrity or availability of personal data to a data principal;<\/p>\n<p>(31)\u00a0 \u00a0<strong>\u201cPrescribed\u201d<\/strong>means prescribed by rules made by the Central Government under this Act; (32)\u00a0 \u00a0<strong>\u201cProcessing\u201d<\/strong>in \u00a0relation \u00a0to \u00a0personal \u00a0data, \u00a0means \u00a0an \u00a0operation \u00a0or \u00a0set \u00a0of \u00a0operations<\/p>\n<p>performed\u00a0 \u00a0on\u00a0 \u00a0personal\u00a0 \u00a0data,\u00a0 \u00a0and\u00a0 \u00a0may\u00a0 \u00a0include\u00a0 \u00a0operations\u00a0 \u00a0such\u00a0 \u00a0as\u00a0 \u00a0collection,<\/p>\n<p>recording,organisation,\u00a0 structuring,\u00a0\u00a0 storage,\u00a0\u00a0 adaptation,\u00a0\u00a0 alteration,\u00a0\u00a0 retrieval,\u00a0\u00a0 use, alignment \u00a0or \u00a0combination, \u00a0indexing, \u00a0disclosure \u00a0by \u00a0transmission, \u00a0dissemination \u00a0or<\/p>\n<p>otherwise making available, restriction, erasure or destruction;<\/p>\n<p>&nbsp;<\/p>\n<p>(33)\u00a0 \u00a0<strong>\u201cProfiling\u201d<\/strong>means \u00a0any form of \u00a0processing of personal \u00a0data \u00a0that analyses \u00a0or predicts aspects concerning the behaviour, attributes or interest of a data principal;<\/p>\n<p>&nbsp;<\/p>\n<p>(34)\u00a0 \u00a0<strong>\u201cRe-identification\u201d<\/strong>meansthe process by which a data fiduciary or data processor may reverse a process of de-identification;<\/p>\n<p>&nbsp;<\/p>\n<p>(35)\u00a0 \u00a0<strong>\u201cSensitive Personal Data\u201d<\/strong>means personal data revealing, related to, or constituting, as may be applicable\u2014<\/p>\n<p>&nbsp;<\/p>\n<p>(i)\u00a0\u00a0\u00a0\u00a0\u00a0 passwords;<\/p>\n<p>(ii)\u00a0\u00a0\u00a0\u00a0 financial data; (iii)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 health data;<\/p>\n<p>(iv)\u00a0\u00a0\u00a0 official identifier; (v)\u00a0\u00a0\u00a0\u00a0\u00a0 sex life;<\/p>\n<p>(vi)\u00a0\u00a0\u00a0 sexual orientation; (vii)\u00a0 \u00a0biometric data; (viii) \u00a0genetic data;<\/p>\n<p>(ix)\u00a0\u00a0\u00a0 transgender status; (x)\u00a0\u00a0\u00a0\u00a0 intersex status;<\/p>\n<p>(xi)\u00a0\u00a0\u00a0 caste or tribe;<\/p>\n<p>&nbsp;<\/p>\n<p>(xii)\u00a0 \u00a0religiousor political belief or affiliation; or<\/p>\n<p>(xiii) \u00a0any other category of data specified by the Authority under section 22.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>(36)\u00a0 \u00a0<strong>\u201cSignificant data fiduciary\u201d<\/strong>means a data fiduciary notified by the Authority under section 38;<\/p>\n<p>&nbsp;<\/p>\n<p>(37)\u00a0 \u00a0<strong>\u201cSignificant harm\u201d<\/strong>means harm that has an aggravated effect having regard to the nature of the personal data being processed,the impact, continuity, persistence or irreversibility of the harm;<\/p>\n<p>&nbsp;<\/p>\n<p>(38)\u00a0 \u00a0<strong>\u201cSpecified\u201d <\/strong>means specified by regulations made by the Authority under this Act and the<\/p>\n<p>term \u201cspecify\u201d shall be construed accordingly;<\/p>\n<p>&nbsp;<\/p>\n<p>(39)\u00a0 \u00a0<strong>\u201cState\u201d <\/strong>shall, unless the context otherwise requires, have the same meaning assigned to itunder Article 12 of the Constitution;<\/p>\n<p>&nbsp;<\/p>\n<p>(40)\u00a0 \u00a0<strong>\u201cSystematic \u00a0activity\u201d \u00a0<\/strong>means \u00a0any \u00a0structured \u00a0or \u00a0organised \u00a0activity \u00a0that \u00a0involves \u00a0an element of planning, method, continuity or persistence;<\/p>\n<p>&nbsp;<\/p>\n<p>(41)\u00a0 \u00a0<strong>\u201cTransgender status\u201d<\/strong>means the condition of a data principal whose sense of gender does not match with the gender assigned to that data principal at birth, whether or not they have undergone sex reassignment surgery, hormone therapy, laser therapy, or any other similar medical procedure.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p><strong>CHAPTER II<\/strong><\/p>\n<p><strong>DATA PROTECTION OBLIGATIONS<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"4\">\n<li><strong> Fair and reasonable processing.\u2014<\/strong>Any person processing personal data owes a duty to the data principal to process such personal data in a fair and reasonable manner that respects the privacy of the data principal.<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"5\">\n<li><strong> Purpose limitation.\u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0\u00a0 Personal data shall be processed only for purposes that are clear, specific and lawful.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0 \u00a0Personal data shall be processed only for purposes specified or for any other incidental purpose that the data principal would reasonably expect the personal data to be used for, having regard to the specified purposes, and the context and circumstances in which the personal data was collected.<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"6\">\n<li><strong> Collection limitation. \u00a0<\/strong>\u2014Collection \u00a0of \u00a0personal \u00a0data \u00a0shall \u00a0be \u00a0limited \u00a0to \u00a0such \u00a0data \u00a0that \u00a0is necessary for the purposes of processing.<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"7\">\n<li><strong> Lawful processing.\u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0 \u00a0Personal data shall be processed only on the basis of one or a combination of grounds of processing in Chapter III.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0 \u00a0Sensitive personal data shall be processed only on the basis of one or a combination of grounds of processing in Chapter IV.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"8\">\n<li><strong> Notice.\u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0 \u00a0Thedata fiduciary shall provide the data principal with the following information, no later than at the time of collection of the personal data or, if the data is not collected from the data principal, as soon as is reasonably practicable<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 the purposes for which the personal data is to be processed; (b)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 the categories of personal data being collected;<\/p>\n<p>(c)\u00a0\u00a0\u00a0\u00a0 the identity and contact details of the data fiduciary and the contact details of the<\/p>\n<p>data protection officer, if applicable;<\/p>\n<p>(d)\u00a0\u00a0\u00a0\u00a0 the right of the data principal to withdraw such consent, and the procedure for such withdrawal, if the personal data is intended to be processed on the basis of consent;<\/p>\n<p>(e)\u00a0\u00a0\u00a0\u00a0 the basis for such processing, and the consequences of the failure to provide such<\/p>\n<p>personal data, if the processing of the personal data is based on the grounds in section 12 to section 17, and section 18 to section 22;<\/p>\n<p>(f)\u00a0\u00a0\u00a0\u00a0\u00a0 the source of such collection, if the personal data is not collected from the data principal;<\/p>\n<p>(g)\u00a0\u00a0\u00a0\u00a0 theindividuals or entities including other data fiduciaries or data processors, with<\/p>\n<p>whom such personal data may be shared, if applicable;<\/p>\n<p>(h)\u00a0\u00a0\u00a0\u00a0 information regarding any cross-border transfer of the personal data that the data fiduciary intends to carry out, if applicable;<\/p>\n<p>(i)\u00a0\u00a0\u00a0\u00a0\u00a0 the period for which the personal data will be retained in terms of section 10 or<\/p>\n<p>where such period is not known, the criteria for determining such period;<\/p>\n<p>(j)\u00a0\u00a0\u00a0\u00a0\u00a0 the existence of and procedure for the exercise of data principal rights mentioned in<\/p>\n<p>Chapter VI and any related contact details for the same; (k)\u00a0\u00a0\u00a0\u00a0 the procedure for grievance redressal under section 39;<\/p>\n<p>(l)\u00a0\u00a0\u00a0\u00a0\u00a0 the existence of a right to file complaints to the Authority;<\/p>\n<p>(m)\u00a0\u00a0\u00a0 where applicable, any rating in the form of a data trust score that may be assignedto the data fiduciary under section 35; and<\/p>\n<p>(n)\u00a0\u00a0\u00a0\u00a0 any other information as may be specified by the Authority.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0 \u00a0Thedata fiduciary shall provide the information as required under this section to the data principal in a clear and concise manner that is easily comprehensible to a reasonable person and in multiple languages where necessary and practicable.<\/p>\n<p>&nbsp;<\/p>\n<p>(3)\u00a0\u00a0\u00a0 \u00a0Sub-section (1) shall not apply where the provision of notice under this section would substantially prejudice the purpose of processing of personal data under sections15or 21of this Act.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"9\">\n<li><strong> Data quality.\u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0\u00a0 Thedata fiduciary shall take reasonable steps to ensure that personal data processed is complete, accurate, not misleading and updated, having regard to the purposes for which it is processed.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0 \u00a0In considering whether any reasonable step is necessaryunder sub-section (1), the data fiduciary shall have regard to whether the personal data\u2014<\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 is likely to be used to make a decision about the data principal;<\/p>\n<p>(b)\u00a0\u00a0\u00a0\u00a0 is \u00a0likely \u00a0to \u00a0be \u00a0disclosed \u00a0to \u00a0other \u00a0individuals \u00a0or \u00a0entities \u00a0including \u00a0other \u00a0data fiduciaries or processors; or<\/p>\n<p>(c)\u00a0\u00a0\u00a0\u00a0 is kept in a form that distinguishes personal data based on facts from personal data based on opinions or personal assessments.<\/p>\n<p>&nbsp;<\/p>\n<p>(3)\u00a0\u00a0 \u00a0Where personal data is disclosed to other individuals or entities, including other data fiduciaries or processors, and the data fiduciary subsequently finds that such data does not comply with sub-section (1), the data fiduciary shall take reasonable steps to notify suchindividuals or entities of thisfact.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"10\">\n<li><strong> Data storage limitation.\u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0 \u00a0Thedata fiduciary shall retain personal data only as long as may be reasonably necessary to satisfy the purpose for which it is processed.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0 \u00a0Notwithstanding sub-section (1), personal data may be retained for a longer period of time if such retention is explicitly mandated, or necessary to comply with any obligation, under a law.<\/p>\n<p>&nbsp;<\/p>\n<p>(3)\u00a0\u00a0\u00a0\u00a0 The data fiduciary must undertake periodic review in order to determine whether it is necessary to retain the personal data in its possession.<\/p>\n<p>&nbsp;<\/p>\n<p>(4)\u00a0\u00a0\u00a0 \u00a0Where it is not necessary for personal data to be retained by the data fiduciary under sub- sections (1) and (2), then such personal data must be deleted in a manner as may be specified.<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"11\">\n<li><strong> Accountability.\u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0\u00a0 The data fiduciary shall be responsible for complying with all obligations set out in this<\/p>\n<p>Act in respect of any processing undertaken by it or on its behalf.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0 \u00a0The data fiduciary should be able to demonstrate that any processing undertaken by it or on its behalf is in accordance with the provisions of this Act.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p><strong>CHAPTER III<\/strong><\/p>\n<p><strong>G<\/strong><strong>ROUNDS FOR PROCESSING OF PERSONAL DATA<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"12\">\n<li><strong> Processing of personal data on the basis of consent.\u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0 \u00a0Personal data may be processed on the basis of the consent of the data principal, given no later than at the commencement of the processing.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0\u00a0 For the consent of the data principal to be valid, it must be<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 free, having regard to whether it meets the standard under section 14 of the Indian<\/p>\n<p>Contract Act, 1872 (9 of 1872);<\/p>\n<p>(b)\u00a0\u00a0\u00a0\u00a0 informed, having regard to whether the data principal has been provided with the information required under section 8;<\/p>\n<p>(c)\u00a0\u00a0\u00a0\u00a0 specific, having regard to whether the data principal can determine the scope of consent in respect of the purposes of processing;<\/p>\n<p>(d)\u00a0\u00a0\u00a0\u00a0 clear, having regard to whether it is indicated through an affirmative action that is meaningful in a given context; and<\/p>\n<p>(e)\u00a0\u00a0\u00a0\u00a0 capable of being withdrawn, having regard to whether the ease of such withdrawal<\/p>\n<p>is comparable to the ease with which consent may be given.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>(3)\u00a0\u00a0\u00a0 \u00a0The data fiduciary shall not make the provision of any goods or services or the quality thereof, the performance of any contract, or the enjoyment of any legal right or claim, conditional on consent to processing of any personal data not necessary for that purpose.<\/p>\n<p>&nbsp;<\/p>\n<p>(4)\u00a0\u00a0\u00a0 \u00a0The data fiduciaryshall bear the burden of proof to establish that consent has been given by the data principal for processing of personal data in accordance with sub-section (2).<\/p>\n<p>&nbsp;<\/p>\n<p>(5)\u00a0\u00a0 \u00a0Where the data principal withdraws consent for the processing of any personal data necessary for the performance of a contract to which the data principal is a party, all legal consequences for the effects of such withdrawal shall be borne by the data principal.<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"13\">\n<li><strong> Processing of personal data for functions of the State. \u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0\u00a0 Personal data may be processed if such processing is necessary for any function of<\/p>\n<p>Parliament or any State Legislature.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0\u00a0 Personal data may be processed if such processing isnecessary forthe exercise of any function of the State authorised by law for:<\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 the provision of any service or benefit to the data principal from the State; or<\/p>\n<p>(b)\u00a0\u00a0\u00a0 \u00a0the issuance of any certification, license or permit for any action or activity of the data principal by the State.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"14\">\n<li><strong> Processing of personal data in compliance with law or any order of any court or tribunal. \u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>Personal data may be processed if such processing is<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 explicitly mandated under any law made by Parliament or any State Legislature; or<\/p>\n<p>(b)\u00a0\u00a0\u00a0\u00a0 for compliance with any order or judgment of any Court or Tribunal in India.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"15\">\n<li><strong> Processing of personal data necessary for prompt action. \u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>Personal data may be processed if such processing is necessary<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0 \u00a0to respond to any medical emergency involving a threat to the life or a severe threat to the health of the data principal or any other individual;<\/p>\n<p>(b)\u00a0\u00a0\u00a0 \u00a0to undertake any measure to provide medical treatment or health services to any individual during an epidemic, outbreak of disease or any other threat to public health; or<\/p>\n<p>(c)\u00a0\u00a0\u00a0 \u00a0to undertake any measure to ensure safety of, or provide assistance or services to, any individual during any disaster or any breakdown of public order.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"16\">\n<li><strong> Processing of personal data necessary for purposes related to employment. \u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0\u00a0 Personal data may be processed if such processing is necessary for<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 recruitmentor termination of employment of a data principal by the data fiduciary; (b)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 provision of any service to, or benefit sought by,the data principal who is an<\/p>\n<p>employee of the data fiduciary;<\/p>\n<p>(c)\u00a0\u00a0\u00a0 \u00a0verifying the attendance of the data principal who is an employee of the data fiduciary; or<\/p>\n<p>(d)\u00a0\u00a0\u00a0 \u00a0any \u00a0other \u00a0activity \u00a0relating \u00a0to \u00a0the \u00a0assessment \u00a0of \u00a0the \u00a0performance \u00a0of \u00a0the \u00a0data principal who is an employee of the data fiduciary.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0\u00a0 Sub-section (1) shall apply only where processing on the basis of consent of the data principal is not appropriate having regard to the employment relationship between the<\/p>\n<p>&nbsp;<\/p>\n<p>data fiduciary and the data principal, or would involve a disproportionate effort on the part of the data fiduciary due to the nature of the processing activities under this section.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"17\">\n<li><strong> Processing of data for reasonable purposes. \u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0 \u00a0In addition to the grounds for processing contained in section12 to section 16, personal data may be processed if such processing is necessary for such reasonable purposes as may be specified after taking into consideration<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 the interest of the data fiduciary in processing for that purpose;<\/p>\n<p>(b)\u00a0\u00a0\u00a0 \u00a0whether the data fiduciary can reasonably be expected to obtain the consent of the data principal;<\/p>\n<p>(c)\u00a0\u00a0\u00a0\u00a0 any public interest in processing for that purpose;<\/p>\n<p>(d)\u00a0\u00a0\u00a0\u00a0 the effect of the processing activity on the rights of the data principal; and<\/p>\n<p>(e)\u00a0\u00a0\u00a0 \u00a0the reasonable expectations of the data principal having regard to the context of the processing.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0 \u00a0For the purpose of sub-section (1), the Authority may specify reasonable purposes related to the following activities, including<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 prevention and detection of any unlawful activity including fraud; (b)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 whistle blowing;<\/p>\n<p>(c)\u00a0\u00a0\u00a0\u00a0 mergers and acquisitions;<\/p>\n<p>(d)\u00a0\u00a0\u00a0\u00a0 network and information security; (e)\u00a0\u00a0 credit scoring;<\/p>\n<p>(f)\u00a0\u00a0\u00a0\u00a0\u00a0 recovery of debt;<\/p>\n<p>(g)\u00a0\u00a0\u00a0\u00a0 processing of publicly available personal data;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>(3)\u00a0\u00a0\u00a0\u00a0 Where the Authority specifies a reasonable purpose under sub-section (1), it shall:<\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0 \u00a0lay down such safeguards as may be appropriate to ensure the protection of the rights of data principals; and<\/p>\n<p>(b)\u00a0\u00a0\u00a0 \u00a0determine where the provision of notice under section 8 would not apply having regard to whether such provision would substantially prejudice the relevant reasonable purpose.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p><strong>CHAPTER IV<\/strong><\/p>\n<p><strong>G<\/strong><strong>ROUNDS FOR PROCESSING OF SENSITIVE PERSONAL DATA<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"18\">\n<li><strong> Processing of sensitive personal data based on explicit consent. \u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0\u00a0 Sensitive personal data may be processed on the basis of explicit consent.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0\u00a0 For the purposes of sub-section (1), consent shall be considered explicit only if it isvalid as per section 12 and is additionally:<\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0 \u00a0informed, having regard to whether the attention of the data principal has been drawn to purposes ofor operations in processing that may have significant consequences for the data principal;<\/p>\n<p>(b)\u00a0\u00a0\u00a0 \u00a0clear, having regard to whether it is meaningful without recourse to inference from conduct in a context; and<\/p>\n<p>(c)\u00a0\u00a0\u00a0\u00a0 specific, \u00a0having \u00a0regard \u00a0to \u00a0whether \u00a0the \u00a0data \u00a0principal \u00a0is \u00a0given \u00a0the \u00a0choice \u00a0of<\/p>\n<p>separately consenting to the purposes of, operations in, and the use of different categories of sensitive personal data relevant to processing.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"19\">\n<li><strong> Processing of sensitive personal data for certain functions of the State. \u2014<\/strong><\/li>\n<\/ol>\n<p>Sensitive personal data may be processed if such processing is strictly necessary for: (a)\u00a0\u00a0\u00a0\u00a0 any function of Parliament or any State Legislature.<\/p>\n<p>(b)\u00a0\u00a0\u00a0\u00a0 the exercise of any function of the State authorised by law forthe provision of any<\/p>\n<p>service or benefit to the data principal.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"20\">\n<li><strong> Processing of sensitive personal data in compliance with law or any order of any court or tribunal. \u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>Sensitive personal data may be processed if such processing is<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 explicitly mandated under any law made by Parliament or any State Legislature; or<\/p>\n<p>(b)\u00a0\u00a0\u00a0\u00a0 necessaryfor compliance with any order or judgment of any Court or Tribunal in<\/p>\n<p>India.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"21\">\n<li><strong> Processing of certain categories of sensitive personal data for prompt action. \u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>Passwords,financial data, health data, official identifiers, genetic data, and biometric data may be processed where such processing is strictly necessary<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0 \u00a0to respond to any medical emergency involving a threat to the life or a severe threat to the health of the data principal;<\/p>\n<p>(b)\u00a0\u00a0\u00a0\u00a0 to undertake any measure to provide medical treatment or health services to any<\/p>\n<p>individual during an epidemic, outbreak of disease or any other threat to public health; or<\/p>\n<p>(c)\u00a0\u00a0\u00a0 \u00a0to undertake any measure to ensure safety of, or provide assistance or services to, any individual during any disaster or any breakdown of public order.<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"22\">\n<li><strong> Further categories of sensitive personal data.\u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0 \u00a0Such further categories of personal data as may be specified by the Authority shall be sensitive personal data and, where such categories of personal data have been specified, the Authority may also specify any further grounds on which such specified categories of personal data may be processed.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0 \u00a0The Authority shall specify categories of personal data under sub-section (1) having regard to<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 theriskof \u00a0significant \u00a0harm \u00a0that \u00a0may \u00a0be \u00a0caused \u00a0to \u00a0the \u00a0data \u00a0principal \u00a0by \u00a0the processing of such category of personal data;<\/p>\n<p>(b)\u00a0\u00a0\u00a0\u00a0 the expectation of confidentiality attached to such category of personal data;<\/p>\n<p>(c)\u00a0\u00a0\u00a0\u00a0 whether a significantly discernible class of data principals may suffer significant harm from the processing of such category of personal data; and<\/p>\n<p>(d)\u00a0\u00a0\u00a0\u00a0 the adequacy of protection afforded by ordinary provisions applicable to personal data.<\/p>\n<p>&nbsp;<\/p>\n<p>(3)\u00a0\u00a0 \u00a0The Authority may also specify categories of personal data, which require additional safeguards or restrictions where repeated, continuous or systematic collection for the purposes of profiling takes place and, where such categories of personal data have been specified, the Authority may also specify such additional safeguards or restrictions applicable to such processing.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p><strong>CHAPTER V<\/strong><\/p>\n<p><strong>PERSONAL AND SENSITIVE PERSONAL DATA OF CHILDREN<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"23\">\n<li><strong> Processing of personal data and sensitive personal data of children. \u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0 \u00a0Every data fiduciary shall process personal data of children in a manner that protects and advances the rights and best interests of the child.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0 \u00a0Appropriate mechanisms for age verification and parental consent shall be incorporated by data fiduciaries in order to process personal data of children.<\/p>\n<p>&nbsp;<\/p>\n<p>(3)\u00a0\u00a0\u00a0 \u00a0Appropriateness of an age verification mechanism incorporated by a data fiduciary shall be determined on the basis of\u2014<\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 volume of personal data processed;<\/p>\n<p>(b)\u00a0\u00a0\u00a0\u00a0 proportion of such personal data likely to be that of children;<\/p>\n<p>(c)\u00a0\u00a0\u00a0\u00a0 possibility of harm to children arising out of processing of personal data; and<\/p>\n<p>(d)\u00a0\u00a0\u00a0\u00a0 such other factors as may be specified by the Authority.<\/p>\n<p>&nbsp;<\/p>\n<p>(4)\u00a0\u00a0\u00a0\u00a0 The Authority shall notify the following as guardian data fiduciaries\u2014<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 data fiduciaries who operate commercial websites or online services directed at children; or<\/p>\n<p>(b)\u00a0\u00a0\u00a0\u00a0 data fiduciaries who process large volumes of personal data of children.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>(5)\u00a0\u00a0\u00a0 \u00a0Guardian \u00a0data \u00a0fiduciaries \u00a0shall \u00a0be \u00a0barred \u00a0from \u00a0profiling, \u00a0tracking, \u00a0or \u00a0behavioural monitoring of, or targeted advertising directed at, children and undertaking any other processing of personal data that can cause significant harm to the child.<\/p>\n<p>&nbsp;<\/p>\n<p>(6)\u00a0\u00a0\u00a0 \u00a0Sub-section (5) may apply in such modified form, to data fiduciaries offering counseling or child protection services to a child, as the Authority may specify.<\/p>\n<p>&nbsp;<\/p>\n<p>(7)\u00a0\u00a0 \u00a0Where a guardian data fiduciary notified under sub-section (4)exclusively provides counseling or child protection services to a child, as under sub-section (6), then such guardian data fiduciary will not be required to obtain parental consent as set out under sub-section (2).<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p><strong>CHAPTER VI<\/strong><\/p>\n<p><strong>DATA PRINCIPAL RIGHTS<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"24\">\n<li><strong> Right to confirmation and access. \u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0\u00a0 The data principal shall have the right to obtain from the data fiduciary<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 confirmation whether the data fiduciary is processing or has processed personal data of the data principal;<\/p>\n<p>(b)\u00a0\u00a0\u00a0\u00a0 a brief summary ofthe personal data of the data principal being processed or that has been processed by the data fiduciary;<\/p>\n<p>(c)\u00a0\u00a0\u00a0\u00a0 abrief \u00a0summary of \u00a0processing activities \u00a0undertaken by the \u00a0data fiduciary\u00a0 with<\/p>\n<p>respect \u00a0to \u00a0the \u00a0personal \u00a0data \u00a0of \u00a0the \u00a0data \u00a0principal, \u00a0including \u00a0any \u00a0information provided in the notice under section 8 in relation to such processing activities.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0 \u00a0The data fiduciary shall provide the information as required under this section to the data principal in a clear and concise manner that is easily comprehensible to a reasonable person.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"25\">\n<li><strong> Right to correction, etc.\u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0 \u00a0Where \u00a0necessary, \u00a0having \u00a0regard \u00a0to \u00a0the \u00a0purposes \u00a0for \u00a0which \u00a0personal \u00a0data \u00a0is \u00a0being processed, the data principal shall have the right to obtain from the data fiduciary processing personal data of the data principal<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 the correction of inaccurate or misleading personal data; (b)\u00a0\u00a0\u00a0 the completion of incomplete personal data; and<\/p>\n<p>(c)\u00a0\u00a0\u00a0\u00a0 the updating of personal data that is out of date.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0 \u00a0Where the data fiduciary receives a request under sub-section (1), and the data fiduciary does not agree with the need for such correction, completion or updatinghaving regard to the purposes of processing, the data fiduciary shall provide the data principal with adequate justificationin writing for rejecting the application.<\/p>\n<p>&nbsp;<\/p>\n<p>(3)\u00a0\u00a0\u00a0 \u00a0Where \u00a0the \u00a0data \u00a0principal \u00a0is \u00a0not \u00a0satisfied \u00a0with \u00a0thejustification \u00a0provided \u00a0by \u00a0the \u00a0data fiduciary under sub-section (2), the data principalmay require that the data fiduciary take reasonable steps to indicate,alongside the relevant personal data, that the same is disputed by the data principal.<\/p>\n<p>&nbsp;<\/p>\n<p>(4)\u00a0\u00a0\u00a0 \u00a0Where the data fiduciary corrects, completes, or updates personal data in accordance with sub-section (1), the data fiduciary shall also take reasonable steps to notify all relevant entities or individuals to whom such personal data may have been disclosed regarding the relevant correction, completion or updating, particularly where such action would have an impact on the rights and interests of the data principal or on decisions made regarding them.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"26\">\n<li><strong> Right to Data Portability. \u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0\u00a0 The data principal shall have the right to\u2014<\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 receivethe following personal data related to the data principal in a structured, commonly used and machine-readable format\u2014<\/p>\n<p>&nbsp;<\/p>\n<p>(i)\u00a0\u00a0\u00a0\u00a0\u00a0 whichsuch data principal has provided to the data fiduciary;<\/p>\n<p>(ii)\u00a0\u00a0\u00a0\u00a0 which has been generated in the course of provision of services or use of goods by the data fiduciary;or<\/p>\n<p>(iii)\u00a0\u00a0\u00a0 which forms part of any profile on the data principal, or which the data<\/p>\n<p>fiduciaryhas otherwise obtained.<\/p>\n<p>&nbsp;<\/p>\n<p>(b)\u00a0\u00a0\u00a0\u00a0 have \u00a0the \u00a0personal \u00a0data \u00a0referred \u00a0to \u00a0in \u00a0clause \u00a0(a) \u00a0transferred \u00a0to \u00a0any \u00a0other \u00a0data fiduciary in the format referred to in that clause.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0 \u00a0Sub-section (1) shall only apply where the processing has been carried out through automated means, and shall not apply where\u2014<\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 processing is necessary for functions of the State undersection 13; (b)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 processing is in compliance of law as referred to in section 14; or<\/p>\n<p>(c)\u00a0\u00a0\u00a0\u00a0 compliance with the request in sub-section (1) would reveal a trade secret of any data fiduciaryor would not be technically feasible.<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"27\">\n<li><strong> Right to Be Forgotten. \u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0 \u00a0The data principal shall have the right to restrict or prevent continuing disclosure of personal data by a data fiduciaryrelated to the data principalwhere such disclosure<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 has served the purpose for which it was made or is no longer necessary;<\/p>\n<p>(b)\u00a0\u00a0\u00a0 \u00a0was made on the basis of consent under section 12 and such consent has since been withdrawn;or<\/p>\n<p>(c)\u00a0\u00a0\u00a0\u00a0 was \u00a0made \u00a0contrary \u00a0to \u00a0the \u00a0provisions \u00a0of \u00a0this \u00a0Act \u00a0or \u00a0any \u00a0other \u00a0law \u00a0made \u00a0by<\/p>\n<p>Parliament or any State Legislature.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0\u00a0 Sub-section \u00a0(1) \u00a0shall\u00a0 \u00a0only \u00a0apply \u00a0where \u00a0the\u00a0\u00a0 Adjudicating \u00a0Officer \u00a0under \u00a0section<\/p>\n<p>68determines the applicability of clause (a), (b) or (c) of sub-section (1) and that the rights \u00a0and \u00a0interests \u00a0of \u00a0the \u00a0data \u00a0principal \u00a0in \u00a0preventing \u00a0or \u00a0restricting \u00a0the \u00a0continued<\/p>\n<p>disclosure of personal data override the right to freedom of speech and expression and the<\/p>\n<p>right to information of any citizen.<\/p>\n<p>&nbsp;<\/p>\n<p>(3)\u00a0\u00a0\u00a0\u00a0 In determining whether the condition in sub-section (2) is satisfied, the Adjudicating<\/p>\n<p>Officer shall have regard to<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 the sensitivity of the personal data;<\/p>\n<p>(b)\u00a0\u00a0 \u00a0the scale of disclosure and the degree of accessibility sought to be restricted or prevented;<\/p>\n<p>(c)\u00a0\u00a0\u00a0\u00a0 the role of the data principal in public life;<\/p>\n<p>(d)\u00a0\u00a0\u00a0\u00a0 the relevance of the personal data to the public; and<\/p>\n<p>(e)\u00a0\u00a0\u00a0 \u00a0the nature of the disclosure and of the activities of the data fiduciary, particularly whether the data fiduciarysystematically facilitates access to personal data and whether the activities would be significantly impeded if disclosures of the relevant nature were to be restricted or prevented.<\/p>\n<p>&nbsp;<\/p>\n<p>(4)\u00a0\u00a0\u00a0 \u00a0The right under sub-section (1) shall be exercised by filing an application in such form and manner as may be prescribed.<\/p>\n<p>&nbsp;<\/p>\n<p>(5)\u00a0\u00a0\u00a0 \u00a0Where any person finds that personal data, the disclosure of which has been restricted or prevented by an order of the Adjudicating Officerunder sub-section (2) does not satisfy the conditions referred to in that sub-section any longer, they may apply for the review of that order to the Adjudicating Officer in such manner as may be prescribed, and such Adjudicating Officer shall review her order on the basis of the considerations referred to in sub-section (3).<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"28\">\n<li><strong> General conditions for the exercise of rights in this Chapter. \u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0 \u00a0The exercise of any right under this Chapter, except the right undersection 27,shall only be on the basis of a request made in writing to the data fiduciarywith reasonable information to satisfy the data fiduciaryof the identity of the data principal making the request and the data fiduciary shall acknowledge receipt of such request within such period of time as may be specified.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0 \u00a0Thedata fiduciary may chargea reasonable fee to be paid for complying with requests made under this Chapter, except for requestsmade under clauses (a) and (b) of sub-section (1) ofsection 24 and section 25 which shall be complied with by the\u00a0 data fiduciary without charging any fee.<\/p>\n<p>&nbsp;<\/p>\n<p>(3)\u00a0\u00a0\u00a0 \u00a0The Authority may specify a reasonable time period within which the data fiduciaryshall comply with the requests under this Chapter, and such time period shall be communicated to the data principal along with the acknowledgement referred to in sub-section (1).<\/p>\n<p>&nbsp;<\/p>\n<p>(4)\u00a0\u00a0\u00a0 \u00a0Where any request made under this Chapter is refused by the data fiduciary, it shall provide the data principal making such request with adequate reasons for suchrefusal as per the provisions of this Chapter in writing,and shall inform the data principal regarding the right to file a complaint with the Authority against the refusal within such period and in such manner as may be specified.<\/p>\n<p>&nbsp;<\/p>\n<p>(5)\u00a0\u00a0\u00a0 \u00a0The data fiduciary is not obliged to comply with any request made under this Chapter where such compliance would harm the rights of any other data principal under this Act.<\/p>\n<p>&nbsp;<\/p>\n<p>(6)\u00a0\u00a0\u00a0 \u00a0The manner of exercise of rights under this Chapter shall be in such form as may be provided by law or in the absence of such law, in a reasonable format to be followed by each data fiduciary.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p><strong>CHAPTER VII<\/strong><\/p>\n<p><strong>TRANSPARENCY AND ACCOUNTABILITY MEASURES<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"29\">\n<li><strong> Privacy by Design. \u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>Every data fiduciary shall implement policies and measures to ensure that\u2014<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0 \u00a0managerial, organisational, business practices and technical systems are designed in a manner to anticipate, identify and avoid harm to the data principal;<\/p>\n<p>(b)\u00a0\u00a0 \u00a0theobligations mentioned in Chapter II are embedded in organisational and business practices;<\/p>\n<p>(c)\u00a0\u00a0\u00a0 \u00a0technology used in the processing of personal data is in accordance with commercially accepted or certified standards;<\/p>\n<p>(d)\u00a0 \u00a0legitimate interests of businesses including any innovation is achieved without compromising privacy interests;<\/p>\n<p>(e)\u00a0\u00a0\u00a0 \u00a0privacy is protected throughout processing from the point of collection to deletion of personal data;<\/p>\n<p>(f)\u00a0\u00a0\u00a0\u00a0 processing of personal data is carried out in a transparent manner; and<\/p>\n<p>(g)\u00a0\u00a0\u00a0 \u00a0the interest of the data principal is accounted for at every stage of processing of personal data.<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"30\">\n<li><strong> Transparency. \u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0 \u00a0The data fiduciary shall take reasonable steps to maintain transparency regarding its general practices related to processing personal data and shall make the following information available in an easily accessible form as may be specified\u2014<\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 the \u00a0categories \u00a0of \u00a0personal \u00a0data \u00a0generally \u00a0collected \u00a0and \u00a0the \u00a0manner \u00a0of \u00a0such collection;<\/p>\n<p>(b)\u00a0\u00a0\u00a0\u00a0 the purposes for which personal data is generally processed;<\/p>\n<p>(c)\u00a0\u00a0\u00a0\u00a0 any \u00a0categories \u00a0of \u00a0personal \u00a0data \u00a0processed \u00a0in \u00a0exceptional \u00a0situations \u00a0or \u00a0any exceptional purposes of processing that create a risk of significant harm;<\/p>\n<p>(d)\u00a0\u00a0\u00a0\u00a0 the existence of and procedure for the exercise of data principal rights mentioned in<\/p>\n<p>Chapter VI, and any related contact details for the same; (e)\u00a0\u00a0\u00a0 the existence of a right to file complaints to the Authority;<\/p>\n<p>(f)\u00a0\u00a0\u00a0\u00a0\u00a0 where applicable, any rating in the form of a data trust score that may be accorded to the data fiduciary under section 35;<\/p>\n<p>(g)\u00a0\u00a0\u00a0\u00a0 where applicable, information regarding cross-border transfers of personal data that<\/p>\n<p>the data fiduciary generally carries out;and<\/p>\n<p>(h)\u00a0\u00a0\u00a0\u00a0 any other information as may be specified by the Authority.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0 \u00a0The data fiduciary shall notify the data principal of important operations in the processing of personal data related to the data principal through periodic notifications in such manner as may be specified.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"31\">\n<li><strong> Security Safeguards.\u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0 \u00a0Having regard to the nature, scope and purpose of processing personal data undertaken, the risks associated with such processing, and the likelihood and severity of the harm that may result from such processing, the data fiduciaryand the data processor shall implement appropriate security safeguards including\u2014<\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 use of methods such as de-identification and encryption;<\/p>\n<p>(b)\u00a0\u00a0\u00a0\u00a0 steps necessary to protect the integrity of personal data; and<\/p>\n<p>(c)\u00a0\u00a0\u00a0\u00a0 steps necessary to prevent misuse, unauthorised access to, modification, disclosure or destruction of personal data.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0 \u00a0Every data fiduciary and data processor shall undertake a review of its security safeguards periodicallyas may be specified and may take appropriate measures accordingly.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"32\">\n<li><strong> Personal Data Breach.\u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0 \u00a0The data fiduciary shall notify the Authority of any personal data breach relating to any personal data processed by the data fiduciarywhere such breach is likely to causeharm to any data principal.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0\u00a0 The notification referred to in sub-section (1) shall include the following particulars<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 nature of personal data which is the subject matter of the breach; (b)\u00a0\u00a0 number of data principals affected by the breach;<\/p>\n<p>(c)\u00a0\u00a0\u00a0\u00a0 possible consequences of the breach; and<\/p>\n<p>(d)\u00a0\u00a0\u00a0\u00a0 measures being taken by the data fiduciary to remedy the breach.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>(3)\u00a0\u00a0\u00a0 \u00a0The notification referred to in sub-section (1) shall be made by the data fiduciary to the Authority\u00a0 as\u00a0 soon\u00a0 as \u00a0possible \u00a0and \u00a0not \u00a0later \u00a0than\u00a0 the \u00a0time \u00a0period \u00a0specified\u00a0 by\u00a0 the Authority, following the breach after accounting for any time that may be required to adopt any urgent measures to remedy the breach or mitigate any immediate harm.<\/p>\n<p>&nbsp;<\/p>\n<p>(4)\u00a0\u00a0\u00a0 \u00a0Where it is not possible to provide all the information as set out in sub-section (2) at the same time, the data fiduciary shall provide such information to the Authority in phases without undue delay.<\/p>\n<p>&nbsp;<\/p>\n<p>(5)\u00a0\u00a0\u00a0 \u00a0Upon receipt of notification, the Authority shall determine whether such breach should be reported by the data fiduciary to the data principal, taking into account the severity of the harm that may be caused to such data principal or whether some action is required on the part of the data principal to mitigate such harm.<\/p>\n<p>&nbsp;<\/p>\n<p>(6)\u00a0\u00a0\u00a0 \u00a0The Authority, may in addition to requiring the data fiduciary to report the personal data breach to the data principal under sub-section (5), direct the data fiduciary to take appropriate remedial action as soon as possible andto conspicuously post the details of the personal data breach on its website.<\/p>\n<p>&nbsp;<\/p>\n<p>(7)\u00a0\u00a0\u00a0 \u00a0The Authority may, in addition, also post the details of the personal data breach on its own website.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"33\">\n<li><strong> Data Protection Impact Assessment. \u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0 \u00a0Where the data fiduciary intends to undertake any processing involving new technologies or large scale profiling or use of sensitive personal data such as genetic data or biometric data, or any other processing which carries a risk of significant harm to data principals, such processing shall not be commenced unless the data fiduciary has undertaken a data protection impact assessment in accordance with the provisions of this section.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0 \u00a0The \u00a0Authority \u00a0may, \u00a0in \u00a0addition, \u00a0specify \u00a0those \u00a0circumstances, \u00a0or \u00a0classes \u00a0of \u00a0data fiduciaries, or processing operations where such data protection impact assessment shall be mandatory, and may also specify those instances where a data auditor under this Act shall be engaged by the data fiduciary to undertake a data protection impact assessment.<\/p>\n<p>&nbsp;<\/p>\n<p>(3)\u00a0\u00a0\u00a0\u00a0 A data protection impact assessment shall contain, at a minimum<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 detailed \u00a0description \u00a0of \u00a0the \u00a0proposed \u00a0processing \u00a0operation, \u00a0the \u00a0purpose \u00a0of processing and the nature of personal data being processed;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<table>\n<tbody>\n<tr>\n<td rowspan=\"3\" width=\"36\"><\/td>\n<td width=\"51\"><\/td>\n<td width=\"543\">(b)\u00a0\u00a0\u00a0\u00a0 assessment of the potential harm that may be caused to the data principals whose personal data is proposed to be processed; and<\/p>\n<p>(c)\u00a0\u00a0\u00a0\u00a0 measures for managing, minimising, mitigating or removing such risk of harm.<\/td>\n<\/tr>\n<tr>\n<td width=\"51\">&nbsp;<\/p>\n<p>(4)<\/td>\n<td width=\"543\">&nbsp;<\/p>\n<p>Upon completion of the data protection impact assessment, the data protection officer shall review the assessment prepared and shall submit the same to the Authorityin such manner as may be specified.<\/td>\n<\/tr>\n<tr>\n<td width=\"51\">&nbsp;<\/p>\n<p>(5)<\/td>\n<td width=\"543\">&nbsp;<\/p>\n<p>On receipt of the assessment, if the Authority has reason to believe that the processing is likely to cause harm to the data principals, the Authority may direct the data fiduciary to cease such processingor direct that such processing shall be subject to such conditions as may be issued by the Authority.<\/td>\n<\/tr>\n<tr>\n<td width=\"36\">&nbsp;<\/p>\n<p><strong>34.<\/strong><\/td>\n<td width=\"51\">&nbsp;<\/p>\n<p><strong>R<\/strong><strong>ecor<\/strong><\/td>\n<td width=\"543\">&nbsp;<\/p>\n<p><strong>d-Keeping. \u2014<\/strong><\/td>\n<\/tr>\n<tr>\n<td width=\"36\"><\/td>\n<td width=\"51\">&nbsp;<\/p>\n<p>(1)<\/td>\n<td width=\"543\">&nbsp;<\/p>\n<p>The data fiduciary shall maintain accurate and up-to-date records of the following<strong>\u2014<\/strong><\/td>\n<\/tr>\n<tr>\n<td width=\"36\"><\/td>\n<td width=\"51\"><\/td>\n<td width=\"543\">&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 important \u00a0operations \u00a0in \u00a0the \u00a0data \u00a0life-cycle \u00a0including \u00a0collection, \u00a0transfers, \u00a0and<\/td>\n<\/tr>\n<tr>\n<td width=\"36\"><\/td>\n<td width=\"51\"><\/td>\n<td width=\"543\">erasure of personal data to demonstrate compliance as required under section 11;<\/td>\n<\/tr>\n<tr>\n<td width=\"36\"><\/td>\n<td width=\"51\"><\/td>\n<td width=\"543\">(b)\u00a0\u00a0\u00a0\u00a0 periodic review of security safeguards under section 31;<\/td>\n<\/tr>\n<tr>\n<td width=\"36\"><\/td>\n<td width=\"51\"><\/td>\n<td width=\"543\">(c)\u00a0\u00a0\u00a0\u00a0 dataprotection impact assessments under section 33; and<\/td>\n<\/tr>\n<tr>\n<td width=\"36\"><\/td>\n<td width=\"51\"><\/td>\n<td width=\"543\">(d)\u00a0\u00a0\u00a0\u00a0 any other aspect of processing as may be specified by the Authority.<\/td>\n<\/tr>\n<tr>\n<td width=\"36\"><\/td>\n<td width=\"51\">&nbsp;<\/p>\n<p>(2)<\/td>\n<td width=\"543\">&nbsp;<\/p>\n<p>The records in sub-section (1) shall be maintained in such form as specified by the<\/p>\n<p>Authority.<\/td>\n<\/tr>\n<tr>\n<td width=\"36\"><\/td>\n<td width=\"51\">&nbsp;<\/p>\n<p>(3)<\/td>\n<td width=\"543\">&nbsp;<\/p>\n<p>Notwithstanding anything contained in this Act, this section shall apply to the Central or State Government, departments of the Central and State Government, and any agency instrumentality or authority which is \u201cthe State\u201d under Article 12 of the Constitution.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>&nbsp;<\/p>\n<ol start=\"35\">\n<li><strong> Data Audits. \u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0\u00a0 The data fiduciary shall have its policies and the conduct of its processing of personal data audited annually by an independent data auditor under this Act.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0\u00a0 The data auditor will evaluate the compliance of the data fiduciary with the provisions of this Act, including<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 clarity and effectiveness of notices under section 8; (b)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 effectiveness of measures adopted under section 29;<\/p>\n<p>(c)\u00a0\u00a0\u00a0\u00a0 transparency in relation to processing activities under section 30; (d)\u00a0 security safeguards adopted pursuant to section 31;<\/p>\n<p>(e)\u00a0\u00a0\u00a0\u00a0 instances of personal data breach and response of the data fiduciary, including the<\/p>\n<p>promptness of notification to the Authority under section 32; and<\/p>\n<p>(f)\u00a0\u00a0\u00a0\u00a0 any other matter as may be specified.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>(3)\u00a0\u00a0\u00a0 \u00a0The Authority shall specify the form, manner and procedure for conducting audits under this section including any civil penalties on data auditors for negligence.<\/p>\n<p>&nbsp;<\/p>\n<p>(4)\u00a0\u00a0\u00a0 \u00a0The Authority shall register persons with expertise in the area of information technology, computer systems, data science, data protection or privacy, with such qualifications, experience and eligibility having regard to factors such as independence, integrity and ability, as it may specify, as data auditors under this Act.<\/p>\n<p>&nbsp;<\/p>\n<p>(5)\u00a0\u00a0\u00a0 \u00a0A data auditor may assign a rating in the form of a data trust score to the data fiduciary pursuant to a data audit conducted under this section.<\/p>\n<p>&nbsp;<\/p>\n<p>(6)\u00a0\u00a0\u00a0 \u00a0The Authority shall specify the criteria for assigning a rating in the form of a data trust score having regard to the factors mentioned in sub-section (2).<\/p>\n<p>&nbsp;<\/p>\n<p>(7)\u00a0\u00a0\u00a0 \u00a0Notwithstanding sub-section (1) where the Authority is of the view that the data fiduciary is processing personal data in a manner that is likely to cause harm to a data principal, the Authority may order the data fiduciary to conduct an audit and shall appoint a data auditor for that purpose.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"36\">\n<li><strong> Data Protection Officer. \u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0 \u00a0The data fiduciary shall appoint a data protection officer for carrying out the following functions<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0 \u00a0providing \u00a0information \u00a0and \u00a0advice \u00a0to \u00a0the \u00a0data \u00a0fiduciary \u00a0on \u00a0matters \u00a0relating \u00a0to fulfilling its obligations under this Act;<\/p>\n<p>(b)\u00a0\u00a0\u00a0 \u00a0monitoring personal data processing activities of the data fiduciary to ensure that such processing does not violate the provisions of this Act;<\/p>\n<p>(c)\u00a0\u00a0\u00a0 \u00a0providing advice to the data fiduciary where required on the manner in which data protection impact assessments must be carried out, and carry out the review of such assessment as under sub-section (4) of section 33;<\/p>\n<p>(d)\u00a0\u00a0\u00a0 \u00a0providing advice to the data fiduciary, where required on the manner in which internal mechanisms may be developed in order to satisfy the principles set out under section 29;<\/p>\n<p>(e)\u00a0\u00a0\u00a0 \u00a0providing \u00a0assistance \u00a0to \u00a0and \u00a0cooperating \u00a0with \u00a0the \u00a0Authority \u00a0on \u00a0matters \u00a0of compliance of the data fiduciary with provisions under this Act;<\/p>\n<p>(f)\u00a0\u00a0\u00a0\u00a0\u00a0 act \u00a0as \u00a0the \u00a0point \u00a0of \u00a0contact \u00a0for \u00a0the \u00a0data \u00a0principal \u00a0for \u00a0the \u00a0purpose \u00a0of \u00a0raising grievances to the data fiduciary pursuant to section 39 of this Act; and<\/p>\n<p>(g)\u00a0\u00a0\u00a0\u00a0 maintaining an inventory of all records maintained by the data fiduciary pursuant to<\/p>\n<p>section 34.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0 \u00a0Nothing shall prevent the data fiduciary from assigning any other function to the data protection officer, which it may consider necessary, in addition to the functions provided in sub-section (1) above.<\/p>\n<p>&nbsp;<\/p>\n<p>(3)\u00a0\u00a0\u00a0 \u00a0The data protection officer shall meet the eligibility and qualification requirements to carry out its functions under sub-section (1) as may be specified.<\/p>\n<p>&nbsp;<\/p>\n<p>(4)\u00a0\u00a0\u00a0 \u00a0Where any data fiduciary not present within the territory of India carries on processing to which the Act applies under section 2(2), and the data fiduciary is required to appoint a data protection officer under this Act, the data fiduciary shall appoint such officer who shall be basedin India and shall represent the data fiduciary in compliance of obligations under this Act.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"37\">\n<li><strong> Processing by entities other than data fiduciaries. \u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0 \u00a0The data fiduciary shall only engage, appoint, use or involve a data processor to processpersonal data on its behalf through avalid contract.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0 \u00a0The data processor referred to in sub-section (1) shall not further engage, appoint, use, or involve another data processor in the relevant processing on its behalf except with the authorisation of the data fiduciary, unless permitted through the contract referred to in sub-section (1).<\/p>\n<p>&nbsp;<\/p>\n<p>(3)\u00a0\u00a0\u00a0 \u00a0The data processor, and any employee of the data fiduciary or the data processor, shall only process personal data in accordance with the instructions of the data fiduciary unless they are required to do otherwise under law and shall treat any personal data that comes within their knowledge as confidential.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"38\">\n<li><strong> Classification of data fiduciaries as significant data fiduciaries. \u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0 \u00a0The Authority shall, having regard to the following factors, notify certain data fiduciaries or classes of data fiduciaries as significant data fiduciaries<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 volume of personal data processed;<\/p>\n<p>(b)\u00a0\u00a0\u00a0\u00a0 sensitivity of personal data processed; (c)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 turnover of the data fiduciary;<\/p>\n<p>(d)\u00a0\u00a0\u00a0\u00a0 risk of harm resulting from any processing or any kind of processing undertaken by the fiduciary;<\/p>\n<p>(e)\u00a0\u00a0\u00a0\u00a0 use of new technologies for processing; and<\/p>\n<p>(f)\u00a0\u00a0\u00a0\u00a0\u00a0 any other factor relevant in causing harm to any data principal as a consequence of such processing.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0 \u00a0The notification of a data fiduciary or classes of data fiduciaries as significant data fiduciaries by the Authority under sub-section (1) shall require such data fiduciary or class of data fiduciaries to register with the Authority in such manner as may be specified.<\/p>\n<p>&nbsp;<\/p>\n<p>(3)\u00a0\u00a0\u00a0 \u00a0All or any ofthe following obligations in this Chapter, as determined by the Authority, shall apply only to significant data fiduciaries\u2014<\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 data protection impact assessments under section 33; (b)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 record-keeping under section 34;<\/p>\n<p>(c)\u00a0\u00a0\u00a0\u00a0 data audits under section 35; and<\/p>\n<p>(d)\u00a0\u00a0\u00a0\u00a0 data protection officer under section 36.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>(4)\u00a0\u00a0\u00a0 \u00a0Notwithstanding sub-section (3), the Authority may notify the application of all or any of the obligations in sub-section (3) to such data fiduciary or class of data fiduciaries, not being a significant data fiduciary, if it is of the view that any processing activity undertaken by such data fiduciary or class of data fiduciaries carries a risk of significant harm to data principals.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"39\">\n<li><strong> Grievance Redressal. \u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0 \u00a0Every data fiduciary shall have in place proper procedures and effective mechanisms to address grievances of data principals efficiently and in a speedy manner.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0 \u00a0A data principal may raise a grievance in case of a violation of any of the provisions of this Act, or rules prescribed, or regulations specified thereunder, which has caused or is likely to cause harm to such data principal, to<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 the data protection officer, in case of a significant data fiduciary; or<\/p>\n<p>(b)\u00a0\u00a0\u00a0\u00a0 an officer designated for this purpose, in case of any other data fiduciary.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>(3)\u00a0\u00a0\u00a0 \u00a0A grievance raised under sub-section (2) shall be resolved by the data fiduciary in an expeditious manner and no later than thirty days from the date of receipt of grievance by such data fiduciary.<\/p>\n<p>&nbsp;<\/p>\n<p>(4)\u00a0\u00a0\u00a0 \u00a0Where, \u00a0a \u00a0grievance \u00a0under \u00a0sub-section \u00a0(2) \u00a0is \u00a0not \u00a0resolved \u00a0within \u00a0the \u00a0time \u00a0period mentioned under sub-section (3), or where the data principal is not satisfied with the manner in which the grievance is resolved, or the data fiduciary has rejected the grievance raised, the data principal shall have the right to file a complaint with the adjudication wing under section 68 of the Act in the manner prescribed.<\/p>\n<p>&nbsp;<\/p>\n<p>(5)\u00a0\u00a0\u00a0 \u00a0Any person aggrieved by an order made under this section by an Adjudicating Officerin accordance with the procedure prescribed in this regard, may prefer an appeal to the Appellate Tribunal.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p><strong>CHAPTER VIII<\/strong><\/p>\n<p><strong>TRANSFER OF PERSONAL DATA OUTSIDE <\/strong><strong>I<\/strong><strong>NDIA<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"40\">\n<li><strong> Restrictions on Cross-Border Transfer of Personal Data. \u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0 \u00a0Every data fiduciary shall ensure the storage, on a server or data centre located in India, of at least one serving copy of personal data to which this Act applies.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0 \u00a0The Central Government shall notify categories of personal data as critical personal data that shall only be processed in a server or data centre located in India.<\/p>\n<p>&nbsp;<\/p>\n<p>(3)\u00a0\u00a0\u00a0 \u00a0Notwithstanding anything contained in sub-section (1), the Central Government may notify certain categories of personal data as exempt from the requirement under sub- section (1) on the grounds of necessity or strategic interests of the State.<\/p>\n<p>&nbsp;<\/p>\n<p>(4)\u00a0\u00a0\u00a0\u00a0 Nothing contained in sub-section (3) shall apply to sensitive personal data.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"41\">\n<li><strong> Conditions for Cross-Border Transfer of Personal Data. \u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0 \u00a0Personal data other than those categories of sensitive personal data notified under sub- section (2) of section 40 may be transferred outside the territory of Indiawhere<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0 \u00a0the transfer is made subject to standard contractual clauses or intra-group schemes that have been approved by the Authority; or<\/p>\n<p>(b)\u00a0\u00a0\u00a0 \u00a0the Central Government, after consultation with the Authority, has prescribed that transfers to a particular country, or to a sector within a country or to a particular international organisation is permissible; or<\/p>\n<p>(c)\u00a0\u00a0\u00a0 \u00a0the Authority approves a particular transfer or set of transfers as permissible due to a situation of necessity; or<\/p>\n<p>(d)\u00a0\u00a0\u00a0 \u00a0in addition to clause (a) or (b) being satisfied, the data principal has consented to such transfer of personal data; or<\/p>\n<p>(e)\u00a0\u00a0\u00a0 \u00a0in addition to clause (a) or (b) being satisfied, the data principal has explicitly consented to such transfer of sensitive personal data, which does not include the categories of sensitive personal data notified under sub-section (2) of section 40.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0 \u00a0The Central Government may only prescribe the permissibility of transfers under clause (b) of sub-section (1) where it finds that the relevant personal data shall be subject to an adequate level of protection, having regard to the applicable laws and international agreements, and the effectiveness of the enforcement by authorities with appropriate jurisdiction, and shall monitor the circumstances applicable to such data in order to review decisions made under this sub-section.<\/p>\n<p>&nbsp;<\/p>\n<p>(3)\u00a0\u00a0\u00a0\u00a0 Notwithstanding sub-section (2) of Section 40,sensitive personal data notified by the<\/p>\n<p>Central Government may betransferred outside the territory of India<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0 \u00a0to a particular person or entity engaged in the provision of health services or emergency services where such transfer is strictly necessary for prompt action under section 16; and<\/p>\n<p>(b)\u00a0\u00a0 \u00a0to a particular country, a prescribed sector within a country or to a particular international organisation that has beenprescribed under clause (b) of sub-section (1), \u00a0wherethe \u00a0Central \u00a0Government \u00a0is \u00a0satisfied \u00a0that \u00a0such \u00a0transfer \u00a0or \u00a0class \u00a0of<\/p>\n<p>&nbsp;<\/p>\n<p>transfersis necessary for any class of data fiduciaries or data principals anddoesnot hamper the effective enforcement of this Act.<\/p>\n<p>&nbsp;<\/p>\n<p>(4)\u00a0\u00a0\u00a0 \u00a0Any transfer under clause (a) ofsub-section (3) shall be notified to the Authority within such time period as may be prescribed.<\/p>\n<p>&nbsp;<\/p>\n<p>(5)\u00a0\u00a0\u00a0 \u00a0The Authority may only approve standard contractual clauses or intra-group schemes under clause (a) of sub-section (1) where such clauses or schemes effectively protect the rights of data principals under this Act, including in relation with further transfers from the transferees of personal data under this sub-section to any other person or entity.<\/p>\n<p>&nbsp;<\/p>\n<p>(6)\u00a0\u00a0\u00a0 \u00a0Where a data fiduciary seeks to transfer personal data subject to standard contractual clauses or intra-group schemes under clause (a) of sub-section (1), it shall certify and periodically report to the Authority as may be specified, that the transfer is made under a contract that adheres to such standard contractual clauses or intra-group schemes and that it \u00a0shall \u00a0bear \u00a0any \u00a0liability \u00a0for \u00a0the \u00a0harm caused\u00a0 due \u00a0to\u00a0 any \u00a0non-compliance with\u00a0 the standard contractual clauses or intra-group schemes by the transferee.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p><strong>CHAPTER IX<\/strong><\/p>\n<p><strong>E<\/strong><strong>X<\/strong><strong>EMPTIONS<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"42\">\n<li><strong> Security of the State.\u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0 \u00a0Processing of personal data in the interests of the security of the State shall not be permitted unless it is authorised pursuant to a law,andis in accordance with the procedure established by such law, made by Parliament and is necessary for, and proportionate to, such interests being achieved.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0 \u00a0Any processing authorised by a lawreferred to in sub-section (1) shall be exempted from the following provisions of the Act<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 Chapter II, except section 4; (b)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Chapter III;<\/p>\n<p>(c)\u00a0\u00a0\u00a0\u00a0 Chapter IV; (d)\u00a0 Chapter V; (e)\u00a0\u00a0\u00a0\u00a0 Chapter VI;<\/p>\n<p>(f)\u00a0\u00a0\u00a0\u00a0\u00a0 Chapter VII, except section 31; and<\/p>\n<p>(g)\u00a0\u00a0\u00a0\u00a0 Chapter VIII.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"43\">\n<li><strong> Prevention, detection, investigation and prosecution of contraventions of law.\u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0 \u00a0Processing of personal data in the interests of prevention, detection,investigation and prosecution of any offence or any other contravention of law shall not be permitted unless<\/p>\n<p>&nbsp;<\/p>\n<p>it is authorised by a law made by Parliament and State Legislatureand is necessary for, and proportionate to, such interests being achieved.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0 \u00a0Any processing authorised by law referred to in sub-section (1) shall be exempted from the following provisions of the Act<strong>\u2014<\/strong><\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 Chapter II, except section 4; (b)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Chapter III;<\/p>\n<p>(c)\u00a0\u00a0\u00a0\u00a0 Chapter IV; (d)\u00a0 Chapter V; (e)\u00a0\u00a0\u00a0\u00a0 Chapter VI;<\/p>\n<p>(f)\u00a0\u00a0\u00a0\u00a0\u00a0 Chapter VII except section 31; and<\/p>\n<p>(g)\u00a0\u00a0\u00a0\u00a0 Chapter VIII.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>(3)\u00a0\u00a0\u00a0 \u00a0Sub-section (1) shall apply in relation to processing of personal data of a data principal who is a victim, witness, or any person with information about the relevant offence or contravention only if processing in compliance with the provisions of this law would be prejudicial to the prevention, detection, investigation or prosecution of any offence or other contravention of law.<\/p>\n<p>(4)\u00a0\u00a0\u00a0 \u00a0Personal data processed under sub-section (1) shall not be retained once the purpose of prevention, detection, investigation or prosecution of any offence or other contravention of law is complete except where such personal data is necessary for the maintenance of any record or database which constitutes a proportionate measure to prevent, detect or investigate or prosecute any offence or class of offences in future.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"44\">\n<li><strong> Processing for the purpose of legal proceedings.\u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0 \u00a0Where disclosure of personal data is necessary for enforcing any legal right or claim, seeking any relief, defending any charge,opposing any claim, or obtaining any legal advice from an advocate in any impending legal proceeding such processing shall be exempted from the following provisions of this Act\u2014<\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 Chapter II, except section 4; (b)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Chapter III;<\/p>\n<p>(c)\u00a0\u00a0\u00a0\u00a0 Chapter IV; (d)\u00a0 Chapter V;<\/p>\n<p>(e)\u00a0\u00a0\u00a0\u00a0 Chapter VI; and<\/p>\n<p>(f)\u00a0\u00a0\u00a0\u00a0\u00a0 Chapter VII, except section 31.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0 \u00a0Where processing of personal data by any Court or Tribunal in India is necessary for the exercise of any judicial function, such processing shall be exempted from the following provisions of this Act\u2014<\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 Chapter II, except section 4; (b)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Chapter III;<\/p>\n<p>(c)\u00a0\u00a0\u00a0\u00a0 Chapter IV; (d)\u00a0 Chapter V;<\/p>\n<p>(e)\u00a0\u00a0\u00a0\u00a0 Chapter VI; and<\/p>\n<p>(f)\u00a0\u00a0\u00a0\u00a0\u00a0 Chapter VII, except section 31.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"45\">\n<li><strong> Research, archiving or statisticalpurposes. \u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0 \u00a0Where processing of personal data is necessary for research, archiving, or statistical purposes, such processing may be exempted from such provisions of this Act as the Authority may specify except section 4, section 31 and section 33.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0 \u00a0For the purpose of sub-section (1), the Authority may exempt different categories of research, archiving, or statistical purposes from different provisions of the Act.<\/p>\n<p>&nbsp;<\/p>\n<p>(3)\u00a0\u00a0\u00a0\u00a0 Sub-section (1) shall apply only where<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 compliance with the provisions of this Act will disproportionately divert resources from the purpose referred to in sub-section (1);<\/p>\n<p>(b)\u00a0\u00a0\u00a0\u00a0 the purposes of processing cannot be achieved if the personal data is anonymised; (c)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 the data fiduciary has carried out de-identification meeting the standard contained<\/p>\n<p>in any code of practice under section 61, where the purpose of processing can be achieved if the personal data is in a de-identified form;<\/p>\n<p>(d)\u00a0\u00a0\u00a0\u00a0 personal data will not be used to take any decision specific to or action directed specifically towards the data principal; and<\/p>\n<p>(e)\u00a0\u00a0\u00a0\u00a0 personal \u00a0data \u00a0will \u00a0not \u00a0be \u00a0processed \u00a0in \u00a0a \u00a0manner \u00a0that \u00a0gives \u00a0rise \u00a0to \u00a0a \u00a0risk \u00a0of<\/p>\n<p>significant harm to the data principal.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"46\">\n<li><strong> Personal or domestic purposes. \u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0 \u00a0Personal data processed by a natural person in the course of a purely personal or domestic purpose, shall be exempted from the following provisions of this Act<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 Chapter II, except section 4; (b)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Chapter III;<\/p>\n<p>(c)\u00a0\u00a0\u00a0\u00a0 Chapter IV; (d)\u00a0 Chapter V; (e)\u00a0\u00a0\u00a0\u00a0 Chapter VI;<\/p>\n<p>(f)\u00a0\u00a0\u00a0\u00a0\u00a0 Chapter VII; and<\/p>\n<p>(g)\u00a0\u00a0\u00a0\u00a0 Chapter VIII.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0\u00a0 Sub-section (1) shall not apply where the relevant processing<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 involvesdisclosure to the public; or<\/p>\n<p>(b)\u00a0\u00a0\u00a0\u00a0 is undertaken in connection with any professional or commercial activity.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"47\">\n<li><strong> Journalistic purposes.\u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0 \u00a0Where \u00a0the \u00a0processing of \u00a0personal \u00a0data \u00a0is \u00a0necessary for \u00a0or \u00a0relevant \u00a0to \u00a0a journalistic purpose, the following provisions of the Act shall not apply<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 Chapter II, except section 4; (b)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Chapter III;<\/p>\n<p>(c)\u00a0\u00a0\u00a0\u00a0 Chapter IV; (d)\u00a0 Chapter V; (e)\u00a0\u00a0\u00a0\u00a0 Chapter VI;<\/p>\n<p>(f)\u00a0\u00a0\u00a0\u00a0\u00a0 Chapter VII except section 31; and<\/p>\n<p>(g)\u00a0\u00a0\u00a0\u00a0 Chapter VIII.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0 \u00a0Sub-section (1) shall apply only where itcan be demonstrated that the processing is in compliance with any code of ethics issued by<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 the Press Council of India, or<\/p>\n<p>(b)\u00a0\u00a0\u00a0\u00a0 any media self-regulatory organisation<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"48\">\n<li><strong> Manual processing by small entities.\u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0 \u00a0Subject to any law for the time being in force, where personal data is processed through means other than automated means by a small entity, the following provisions of the Act shall not apply<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 Sections 8, 9 and 10 in Chapter II;<\/p>\n<p>(b)\u00a0\u00a0\u00a0\u00a0 Clause (c) of sub-section (1) of section 24, and sections 26 and 27 in Chapter VI;<\/p>\n<p>and<\/p>\n<p>(c)\u00a0\u00a0\u00a0\u00a0 Section 29 to section 36, and sections 38 and 39 in Chapter VII.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0\u00a0 For the purposes of sub-section (1), a small entity shall be any data fiduciary which<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0 \u00a0did not have a turnover of more than twenty lakh rupees or such other lower amount as may be prescribed by the Central Government in the preceding financial year;<\/p>\n<p>(b)\u00a0\u00a0\u00a0 \u00a0does not collect personal data for the purpose of disclosure to any other individuals or entities, including other data fiduciaries or processors; and<\/p>\n<p>(c)\u00a0\u00a0\u00a0 \u00a0did not process personal data of more than one hundred data principals in any one day in the preceding twelve calendar months.<\/p>\n<p>&nbsp;<\/p>\n<p><em>Explanation: \u00a0<\/em>For \u00a0the\u00a0 purpose \u00a0of \u00a0sub-section\u00a0 (2),\u00a0 \u201cturnover\u201d\u00a0 means\u00a0 the\u00a0 gross \u00a0amount \u00a0of \u00a0revenue recognised in the profit and loss account or any other equivalent statement, as applicable, from the sale, supply or distribution of goods or services or on account of services rendered, or both, by the data fiduciary in the preceding financial year.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p><strong>CHAPTER X<\/strong><\/p>\n<p><strong>D<\/strong><strong>ATA <\/strong><strong>P<\/strong><strong>ROTECTION <\/strong><strong>A<\/strong><strong>UTHORITY OF <\/strong><strong>I<\/strong><strong>NDIA<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"49\">\n<li><strong> Establishment and incorporation of Authority.\u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0\u00a0 The Central Government shall, by notification, establish for the purposes of this Act, an<\/p>\n<p>Authority to be called the Data Protection Authority of India.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0 \u00a0The \u00a0Authority \u00a0shall \u00a0be \u00a0a \u00a0body \u00a0corporate \u00a0by \u00a0the \u00a0name \u00a0aforesaid, \u00a0having \u00a0perpetual succession and a common seal, with power, subject to the provisions of this Act, to acquire, hold and dispose of property, both movable and immovable, and to contract and shall, by the said name, sue or be sued.<\/p>\n<p>&nbsp;<\/p>\n<p>(3)\u00a0\u00a0\u00a0\u00a0 The head office of the Authority shall be at such place as may be prescribed.<\/p>\n<p>&nbsp;<\/p>\n<p>(4)\u00a0\u00a0\u00a0 \u00a0The Authority may, with the prior approval of the Central Government, establish its offices at other places in India<em>.<\/em><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ol start=\"50\">\n<li><strong> Composition and qualifications for appointment of members.\u2014<\/strong><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>(1)\u00a0\u00a0\u00a0\u00a0 The Authority shall consist of a chairpersonand sixwhole-time members.<\/p>\n<p>&nbsp;<\/p>\n<p>(2)\u00a0\u00a0\u00a0\u00a0 The chairperson and the members of the Authority shall be appointed by the Central<\/p>\n<p>Government on the recommendation made by a selection committee consisting of<strong>\u2014<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>(a)\u00a0\u00a0\u00a0\u00a0 the Chief Justice of India or a judge of the Supreme Court of India nominated by the Chief Justice of India, who shall be the chairperson of the selection committee;<\/p>\n<p>(b)\u00a0\u00a0\u00a0\u00a0 theCabinet Secretary; and<\/p>\n<p>(c)\u00a0\u00a0\u00a0\u00a0 oneexpert of repute as mentioned in sub-section (6), to be nominated by the Chief<\/p>\n<p>Justice of India or a judge of the Supreme Court of India nominated by the Chief<\/p>\n<p>Justice of India,in consultation with the Cabinet Secretary.<\/p>\n<p>&nbsp;<\/p>\n<p>(3)\u00a0\u00a0\u00a0 \u00a0The procedure to be followed by the selection committee for recommending the names under sub-section (2) shall be such as may be prescribed.<\/p>\n<p>&nbsp;<\/p>\n<p>(4)\u00a0\u00a0\u00a0 \u00a0The chairperson and the members of the Authority shall be persons of ability, integrity and standing, and must have specialised knowledge of, and not less than ten years professional experience in the field of data protection, information technology, data management, data science, data security, cyber and internet laws, and related subjects.<\/p>\n<p>&nbsp;<\/p>\n<p>(5)\u00a0\u00a0\u00a0 \u00a0A vacancy caused to the office of the chairperson or any other member shall be filled <\/p>\n","protected":false},"excerpt":{"rendered":"<p>THE PERSONAL DATA PROTECTION BILL, 2018 CHAPTER I PRELIMINARY<\/p>\n","protected":false},"author":1,"featured_media":4585,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-4584","post","type-post","status-publish","format-standard","has-post-thumbnail","category-4"],"_links":{"self":[{"href":"https:\/\/www.xn--4scekqbpyn4fbh2dwe.xn--2scrj9c\/index.php?rest_route=\/wp\/v2\/posts\/4584","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.xn--4scekqbpyn4fbh2dwe.xn--2scrj9c\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.xn--4scekqbpyn4fbh2dwe.xn--2scrj9c\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.xn--4scekqbpyn4fbh2dwe.xn--2scrj9c\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.xn--4scekqbpyn4fbh2dwe.xn--2scrj9c\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4584"}],"version-history":[{"count":1,"href":"https:\/\/www.xn--4scekqbpyn4fbh2dwe.xn--2scrj9c\/index.php?rest_route=\/wp\/v2\/posts\/4584\/revisions"}],"predecessor-version":[{"id":5634,"href":"https:\/\/www.xn--4scekqbpyn4fbh2dwe.xn--2scrj9c\/index.php?rest_route=\/wp\/v2\/posts\/4584\/revisions\/5634"}],"wp:attachment":[{"href":"https:\/\/www.xn--4scekqbpyn4fbh2dwe.xn--2scrj9c\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4584"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.xn--4scekqbpyn4fbh2dwe.xn--2scrj9c\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4584"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.xn--4scekqbpyn4fbh2dwe.xn--2scrj9c\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4584"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}