Venkatesh Krishnamoorthy, Country Manager – India, BSA | The Software Alliance issued the following statement responding to the tabling of the 2023 Digital Personal Data Protection Bill:

“BSA commends the Ministry of Electronics and Information Technology (MeitY) and the Government of India for undertaking a consultative legislative process in drafting and tabling a robust Digital Personal Data Protection Bill 2023. The 2023 Bill addresses the need for effective privacy legislation to protect and safeguard consumers’ personal data and will help India achieve a USD $1 trillion digital economy by 2026.

Enterprise software companies encourage the Government to make continued improvements to the Digital Personal Data Protection Bill to address two key areas of concern.

While the 2023 Bill makes welcome improvements to more generally permit data transfers, it also includes broad and vague authorities to restrict data transfers. Instead of this half-step forward, the 2023 Bill should explicitly recognize a variety of transfer mechanisms that will provide a stable and predictable legal framework to support data transfers.

The 2023 Bill also contains an extremely narrow set of “legitimate uses” for which personal data may be processed and lacks grounds for processing data that are routinely used by companies and recognized under other global data protection laws. This will create significant practical concerns for companies and may lead to voluminous consent requests to individuals. We recommend that the Bill restore provisions from the 2022 DPDP Bill, including permitting processing of data in the public interest and processing that is “fair and reasonable.” This approach toward data processing will also better align with India’s desire to promote the development and use of AI technologies.”