Withdrawal of the Personal Data Protection Bill, 2019 (2022)

An important stage in the legislative journey towards the Digital Personal Data Protection Act, 2023 occurred on 3 August 2022, when the Government of India formally withdrew the Personal Data Protection Bill, 2019 from Parliament. This decision followed extensive parliamentary deliberations and the submission of the Joint Parliamentary Committee (JPC) report in December 2021.

The withdrawal of the Bill did not signify the abandonment of India’s data protection policy objectives. Rather, it reflected the Government’s recognition that the existing Bill required substantial restructuring instead of incremental amendments.

Reasons for Withdrawal

Several factors led to the decision to withdraw the 2019 Bill:

  1. Need for Comprehensive Redrafting
    The recommendations of the Joint Parliamentary Committee suggested extensive structural changes to the Bill. Implementing these recommendations would have required rewriting significant portions of the legislation, making piecemeal amendments impractical.
  2. Shift Toward a Simpler Legislative Framework
    The Government indicated that a new approach would focus on creating a simpler and more streamlined legal structure that could be implemented efficiently and reduce regulatory complexity.
  3. Alignment with India’s Digital Governance Priorities
    India’s rapidly expanding digital ecosystem required a regulatory framework capable of supporting innovation, digital commerce, and governance initiatives. The Government therefore decided to draft a new law that would align more closely with evolving digital policy objectives.

Importantly, the withdrawal was largely procedural in nature. It was not a rejection of the need for data protection legislation but rather a strategic step toward developing a revised framework.

AND Law offices

Digital Personal Data Protection Act, 2023

  1. Enactment

Following the withdrawal of the earlier Bill, the Government introduced a new legislative proposal which ultimately led to the enactment of the Digital Personal Data Protection Act, 2023 in August 2023. This Act marked India’s first dedicated statute governing the processing and protection of personal data in the digital environment.

  1. Key Characteristics of the Act

The Digital Personal Data Protection Act, 2023 reflects a more focused and operational framework compared to the earlier legislative proposals.

  • Applicability to Digital Personal Data
    The Act applies specifically to digital personal data, including data collected online as well as data collected offline that is subsequently digitised.
  • Establishment of the Data Protection Board of India
    Instead of the Data Protection Authority proposed in earlier drafts, the Act creates a Data Protection Board of India, responsible for adjudicating complaints and enforcing compliance.
  • Penalty-Based Enforcement Framework
    The Act primarily relies on financial penalties and regulatory enforcement mechanisms rather than criminal liability. This approach aims to ensure compliance while maintaining regulatory efficiency.
  • Cross-Border Data Transfers
    Unlike earlier localisation-heavy proposals, the Act permits cross-border transfer of personal data, except to countries specifically restricted by the Central Government.
  • State Exemption Powers
    The legislation retains provisions allowing the State to exempt certain agencies from its application on specified grounds, supported by statutory authority.

Overall, the Act represents a narrower but more implementable framework, designed to facilitate regulatory clarity and practical enforcement.

Rules and Implementation (2024–2025)

Following the enactment of the Act, the Government began working on its implementation through subordinate legislation and institutional mechanisms.

Between 2024 and 2025, the focus shifted toward operationalising the law through several measures:

  • Drafting and notification of Digital Personal Data Protection Rules
  • Establishment and regulation of consent managers
  • Development of enforcement and grievance redressal mechanisms
  • Introduction of phased compliance timelines for organizations processing personal data

These steps marked the transition of the law from a purely legislative framework to a functional regulatory regime.

Concluding Analysis

The legislative development of India’s data protection framework can be understood through distinct phases:

  • 2018 Draft: Expert-driven and rights-oriented framework.
  • 2019 Bill: Government-led proposal with broader regulatory ambition and state exemptions.
  • JPC Phase: Parliamentary scrutiny leading to structural critique and expansionist recommendations.
  • Withdrawal (2022): Recognition that the Bill required fundamental redesign.
  • DPDP Act, 2023: A streamlined, digital-focused, and implementation-oriented statute.

This evolution illustrates India’s effort to balance constitutional privacy protections, economic development, governmental interests, and the realities of technological governance in an increasingly digital society.

Recent Posts